-
Clemens Hammacher authored
The platform is allowed to remove the foreground task without ever executing it if the isolate is shutting down. This can happen immediately when spawning the task. This would leave a stale pointer to the deleted task in the engine, and can lead to UAF. Thus deregister the task also from the destructor. At that point, we do not need to report back any live code for that isolate. R=ahaas@chromium.org Bug: v8:8217, chromium:971293 Change-Id: I7081efde8f306649d08956e758254a8875db8271 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669694Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#62312}
3ea51d46