• binji's avatar
    Fix cluster-fuzz regression with Workers and recursive serialization · 5023335b
    binji authored
    Shell::SerializeValue was using a HandleScope, but was also storing Handles in
    an ObjectList. The ObjectList handles would persist after the function had
    returned, but will have already been destroyed by the HandleScope, so there is
    a use-after-free.
    
    This change removes the HandleScope in Shell::SerializeValue and relies on the
    caller's HandleScope.
    
    BUG=chromium:503968
    R=jochen@chromium.org
    LOG=n
    
    Review URL: https://codereview.chromium.org/1211433003
    
    Cr-Commit-Position: refs/heads/master@{#29265}
    5023335b
Name
Last commit
Last update
benchmarks Loading commit data...
build Loading commit data...
include Loading commit data...
infra Loading commit data...
samples Loading commit data...
src Loading commit data...
test Loading commit data...
testing Loading commit data...
third_party/binutils Loading commit data...
tools Loading commit data...
.clang-format Loading commit data...
.gitignore Loading commit data...
.ycm_extra_conf.py Loading commit data...
AUTHORS Loading commit data...
BUILD.gn Loading commit data...
ChangeLog Loading commit data...
DEPS Loading commit data...
LICENSE Loading commit data...
LICENSE.strongtalk Loading commit data...
LICENSE.v8 Loading commit data...
LICENSE.valgrind Loading commit data...
Makefile Loading commit data...
Makefile.android Loading commit data...
Makefile.nacl Loading commit data...
OWNERS Loading commit data...
PRESUBMIT.py Loading commit data...
README.md Loading commit data...
WATCHLISTS Loading commit data...
codereview.settings Loading commit data...