From 892e45ff85ed4e3899371eca950a7fb4810bde37 Mon Sep 17 00:00:00 2001
From: Paul Leathers <pleath@microsoft.com>
Date: Wed, 26 Feb 2020 09:51:09 -0800
Subject: [PATCH] [CVE-2020-0970]

---
 lib/Runtime/Types/PathTypeHandler.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/Runtime/Types/PathTypeHandler.cpp b/lib/Runtime/Types/PathTypeHandler.cpp
index 57cd0480c86..c329b40cd95 100644
--- a/lib/Runtime/Types/PathTypeHandler.cpp
+++ b/lib/Runtime/Types/PathTypeHandler.cpp
@@ -2013,6 +2013,16 @@ namespace Js
                 {
                     newSetters = this->UpdateSetterSlots(recycler, oldSetters, oldPathSize, newTypePath->GetPathSize());
                 }
+
+#if ENABLE_FIXED_FIELDS
+#ifdef SUPPORT_FIXED_FIELDS_ON_PATH_TYPES
+                if (PathTypeHandlerBase::FixPropsOnPathTypes())
+                {
+                    Assert(this->HasSingletonInstanceOnlyIfNeeded());
+                    this->GetTypePath()->ClearSingletonInstanceIfSame(instance);
+                }
+#endif
+#endif
             }
             else if (growing)
             {