• binji's avatar
    Fix cluster-fuzz regression with Workers and recursive serialization · 5023335b
    binji authored
    Shell::SerializeValue was using a HandleScope, but was also storing Handles in
    an ObjectList. The ObjectList handles would persist after the function had
    returned, but will have already been destroyed by the HandleScope, so there is
    a use-after-free.
    
    This change removes the HandleScope in Shell::SerializeValue and relies on the
    caller's HandleScope.
    
    BUG=chromium:503968
    R=jochen@chromium.org
    LOG=n
    
    Review URL: https://codereview.chromium.org/1211433003
    
    Cr-Commit-Position: refs/heads/master@{#29265}
    5023335b
Name
Last commit
Last update
..
arm Loading commit data...
arm64 Loading commit data...
base Loading commit data...
compiler Loading commit data...
extensions Loading commit data...
heap Loading commit data...
ia32 Loading commit data...
ic Loading commit data...
libplatform Loading commit data...
mips Loading commit data...
mips64 Loading commit data...
ppc Loading commit data...
runtime Loading commit data...
snapshot Loading commit data...
third_party Loading commit data...
x64 Loading commit data...
x87 Loading commit data...
DEPS Loading commit data...
OWNERS Loading commit data...
accessors.cc Loading commit data...
accessors.h Loading commit data...
allocation-site-scopes.cc Loading commit data...
allocation-site-scopes.h Loading commit data...
allocation-tracker.cc Loading commit data...
allocation-tracker.h Loading commit data...
allocation.cc Loading commit data...
allocation.h Loading commit data...
api-natives.cc Loading commit data...
api-natives.h Loading commit data...
api.cc Loading commit data...
api.h Loading commit data...
arguments.cc Loading commit data...
arguments.h Loading commit data...
array-iterator.js Loading commit data...
array.js Loading commit data...
arraybuffer.js Loading commit data...
assembler.cc Loading commit data...
assembler.h Loading commit data...
assert-scope.cc Loading commit data...
assert-scope.h Loading commit data...
ast-numbering.cc Loading commit data...
ast-numbering.h Loading commit data...
ast-value-factory.cc Loading commit data...
ast-value-factory.h Loading commit data...
ast.cc Loading commit data...
ast.h Loading commit data...
background-parsing-task.cc Loading commit data...
background-parsing-task.h Loading commit data...
bailout-reason.cc Loading commit data...
bailout-reason.h Loading commit data...
basic-block-profiler.cc Loading commit data...
basic-block-profiler.h Loading commit data...
bignum-dtoa.cc Loading commit data...
bignum-dtoa.h Loading commit data...
bignum.cc Loading commit data...
bignum.h Loading commit data...
bit-vector.cc Loading commit data...
bit-vector.h Loading commit data...
bootstrapper.cc Loading commit data...
bootstrapper.h Loading commit data...
builtins.cc Loading commit data...
builtins.h Loading commit data...
bytecodes-irregexp.h Loading commit data...
cached-powers.cc Loading commit data...
cached-powers.h Loading commit data...
char-predicates-inl.h Loading commit data...
char-predicates.cc Loading commit data...
char-predicates.h Loading commit data...
checks.cc Loading commit data...
checks.h Loading commit data...
circular-queue-inl.h Loading commit data...
circular-queue.h Loading commit data...
code-factory.cc Loading commit data...
code-factory.h Loading commit data...
code-stubs-hydrogen.cc Loading commit data...
code-stubs.cc Loading commit data...
code-stubs.h Loading commit data...
code.h Loading commit data...
codegen.cc Loading commit data...
codegen.h Loading commit data...
collection-iterator.js Loading commit data...
collection.js Loading commit data...
compilation-cache.cc Loading commit data...
compilation-cache.h Loading commit data...
compilation-dependencies.cc Loading commit data...
compilation-dependencies.h Loading commit data...
compilation-statistics.cc Loading commit data...
compilation-statistics.h Loading commit data...
compiler.cc Loading commit data...
compiler.h Loading commit data...
contexts.cc Loading commit data...
contexts.h Loading commit data...
conversions-inl.h Loading commit data...
conversions.cc Loading commit data...
conversions.h Loading commit data...
counters.cc Loading commit data...
counters.h Loading commit data...
cpu-profiler-inl.h Loading commit data...
cpu-profiler.cc Loading commit data...
cpu-profiler.h Loading commit data...
d8-debug.cc Loading commit data...
d8-debug.h Loading commit data...
d8-posix.cc Loading commit data...
d8-readline.cc Loading commit data...
d8-windows.cc Loading commit data...
d8.cc Loading commit data...
d8.gyp Loading commit data...
d8.h Loading commit data...
d8.js Loading commit data...
date.cc Loading commit data...
date.h Loading commit data...
date.js Loading commit data...
dateparser-inl.h Loading commit data...
dateparser.cc Loading commit data...
dateparser.h Loading commit data...
debug-debugger.js Loading commit data...
debug.cc Loading commit data...
debug.h Loading commit data...
deoptimizer.cc Loading commit data...
deoptimizer.h Loading commit data...
disasm.h Loading commit data...
disassembler.cc Loading commit data...
disassembler.h Loading commit data...
diy-fp.cc Loading commit data...
diy-fp.h Loading commit data...
double.h Loading commit data...
dtoa.cc Loading commit data...
dtoa.h Loading commit data...
effects.h Loading commit data...
elements-kind.cc Loading commit data...
elements-kind.h Loading commit data...
elements.cc Loading commit data...
elements.h Loading commit data...
execution.cc Loading commit data...
execution.h Loading commit data...
expression-classifier.h Loading commit data...
factory.cc Loading commit data...
factory.h Loading commit data...
fast-dtoa.cc Loading commit data...
fast-dtoa.h Loading commit data...
field-index-inl.h Loading commit data...
field-index.h Loading commit data...
fixed-dtoa.cc Loading commit data...
fixed-dtoa.h Loading commit data...
flag-definitions.h Loading commit data...
flags.cc Loading commit data...
flags.h Loading commit data...
frames-inl.h Loading commit data...
frames.cc Loading commit data...
frames.h Loading commit data...
full-codegen.cc Loading commit data...
full-codegen.h Loading commit data...
func-name-inferrer.cc Loading commit data...
func-name-inferrer.h Loading commit data...
gdb-jit.cc Loading commit data...
gdb-jit.h Loading commit data...
generator.js Loading commit data...
global-handles.cc Loading commit data...
global-handles.h Loading commit data...
globals.h Loading commit data...
handles-inl.h Loading commit data...
handles.cc Loading commit data...
handles.h Loading commit data...
harmony-array-includes.js Loading commit data...
harmony-array.js Loading commit data...
harmony-atomics.js Loading commit data...
harmony-object.js Loading commit data...
harmony-reflect.js Loading commit data...
harmony-regexp.js Loading commit data...
harmony-sharedarraybuffer.js Loading commit data...
harmony-spread.js Loading commit data...
harmony-tostring.js Loading commit data...
harmony-typedarray.js Loading commit data...
hashmap.h Loading commit data...
heap-profiler.cc Loading commit data...
heap-profiler.h Loading commit data...
heap-snapshot-generator-inl.h Loading commit data...
heap-snapshot-generator.cc Loading commit data...
heap-snapshot-generator.h Loading commit data...
hydrogen-alias-analysis.h Loading commit data...
hydrogen-bce.cc Loading commit data...
hydrogen-bce.h Loading commit data...
hydrogen-bch.cc Loading commit data...
hydrogen-bch.h Loading commit data...
hydrogen-canonicalize.cc Loading commit data...
hydrogen-canonicalize.h Loading commit data...
hydrogen-check-elimination.cc Loading commit data...
hydrogen-check-elimination.h Loading commit data...
hydrogen-dce.cc Loading commit data...
hydrogen-dce.h Loading commit data...
hydrogen-dehoist.cc Loading commit data...
hydrogen-dehoist.h Loading commit data...
hydrogen-environment-liveness.cc Loading commit data...
hydrogen-environment-liveness.h Loading commit data...
hydrogen-escape-analysis.cc Loading commit data...
hydrogen-escape-analysis.h Loading commit data...
hydrogen-flow-engine.h Loading commit data...
hydrogen-gvn.cc Loading commit data...
hydrogen-gvn.h Loading commit data...
hydrogen-infer-representation.cc Loading commit data...
hydrogen-infer-representation.h Loading commit data...
hydrogen-infer-types.cc Loading commit data...
hydrogen-infer-types.h Loading commit data...
hydrogen-instructions.cc Loading commit data...
hydrogen-instructions.h Loading commit data...
hydrogen-load-elimination.cc Loading commit data...
hydrogen-load-elimination.h Loading commit data...
hydrogen-mark-deoptimize.cc Loading commit data...
hydrogen-mark-deoptimize.h Loading commit data...
hydrogen-mark-unreachable.cc Loading commit data...
hydrogen-mark-unreachable.h Loading commit data...
hydrogen-osr.cc Loading commit data...
hydrogen-osr.h Loading commit data...
hydrogen-range-analysis.cc Loading commit data...
hydrogen-range-analysis.h Loading commit data...
hydrogen-redundant-phi.cc Loading commit data...
hydrogen-redundant-phi.h Loading commit data...
hydrogen-removable-simulates.cc Loading commit data...
hydrogen-removable-simulates.h Loading commit data...
hydrogen-representation-changes.cc Loading commit data...
hydrogen-representation-changes.h Loading commit data...
hydrogen-sce.cc Loading commit data...
hydrogen-sce.h Loading commit data...
hydrogen-store-elimination.cc Loading commit data...
hydrogen-store-elimination.h Loading commit data...
hydrogen-types.cc Loading commit data...
hydrogen-types.h Loading commit data...
hydrogen-uint32-analysis.cc Loading commit data...
hydrogen-uint32-analysis.h Loading commit data...
hydrogen.cc Loading commit data...
hydrogen.h Loading commit data...
i18n.cc Loading commit data...
i18n.h Loading commit data...
i18n.js Loading commit data...
icu_util.cc Loading commit data...
icu_util.h Loading commit data...
interface-descriptors.cc Loading commit data...
interface-descriptors.h Loading commit data...
interpreter-irregexp.cc Loading commit data...
interpreter-irregexp.h Loading commit data...
isolate.cc Loading commit data...
isolate.h Loading commit data...
iterator-prototype.js Loading commit data...
json-parser.h Loading commit data...
json-stringifier.h Loading commit data...
json.js Loading commit data...
jsregexp-inl.h Loading commit data...
jsregexp.cc Loading commit data...
jsregexp.h Loading commit data...
layout-descriptor-inl.h Loading commit data...
layout-descriptor.cc Loading commit data...
layout-descriptor.h Loading commit data...
list-inl.h Loading commit data...
list.h Loading commit data...
lithium-allocator-inl.h Loading commit data...
lithium-allocator.cc Loading commit data...
lithium-allocator.h Loading commit data...
lithium-codegen.cc Loading commit data...
lithium-codegen.h Loading commit data...
lithium-inl.h Loading commit data...
lithium.cc Loading commit data...
lithium.h Loading commit data...
liveedit-debugger.js Loading commit data...
liveedit.cc Loading commit data...
liveedit.h Loading commit data...
log-inl.h Loading commit data...
log-utils.cc Loading commit data...
log-utils.h Loading commit data...
log.cc Loading commit data...
log.h Loading commit data...
lookup-inl.h Loading commit data...
lookup.cc Loading commit data...
lookup.h Loading commit data...
macro-assembler.h Loading commit data...
macros.py Loading commit data...
math.js Loading commit data...
messages.cc Loading commit data...
messages.h Loading commit data...
messages.js Loading commit data...
mirror-debugger.js Loading commit data...
modules.cc Loading commit data...
modules.h Loading commit data...
msan.h Loading commit data...
object-observe.js Loading commit data...
objects-debug.cc Loading commit data...
objects-inl.h Loading commit data...
objects-printer.cc Loading commit data...
objects.cc Loading commit data...
objects.h Loading commit data...
optimizing-compile-dispatcher.cc Loading commit data...
optimizing-compile-dispatcher.h Loading commit data...
ostreams.cc Loading commit data...
ostreams.h Loading commit data...
parser.cc Loading commit data...
parser.h Loading commit data...
pattern-rewriter.cc Loading commit data...
pending-compilation-error-handler.cc Loading commit data...
pending-compilation-error-handler.h Loading commit data...
preparse-data-format.h Loading commit data...
preparse-data.cc Loading commit data...
preparse-data.h Loading commit data...
preparser.cc Loading commit data...
preparser.h Loading commit data...
prettyprinter.cc Loading commit data...
prettyprinter.h Loading commit data...
profile-generator-inl.h Loading commit data...
profile-generator.cc Loading commit data...
profile-generator.h Loading commit data...
prologue.js Loading commit data...
promise.js Loading commit data...
property-details.h Loading commit data...
property.cc Loading commit data...
property.h Loading commit data...
prototype.h Loading commit data...
proxy.js Loading commit data...
regexp-macro-assembler-irregexp-inl.h Loading commit data...
regexp-macro-assembler-irregexp.cc Loading commit data...
regexp-macro-assembler-irregexp.h Loading commit data...
regexp-macro-assembler-tracer.cc Loading commit data...
regexp-macro-assembler-tracer.h Loading commit data...
regexp-macro-assembler.cc Loading commit data...
regexp-macro-assembler.h Loading commit data...
regexp-stack.cc Loading commit data...
regexp-stack.h Loading commit data...
regexp.js Loading commit data...
rewriter.cc Loading commit data...
rewriter.h Loading commit data...
runtime-profiler.cc Loading commit data...
runtime-profiler.h Loading commit data...
runtime.js Loading commit data...
safepoint-table.cc Loading commit data...
safepoint-table.h Loading commit data...
sampler.cc Loading commit data...
sampler.h Loading commit data...
scanner-character-streams.cc Loading commit data...
scanner-character-streams.h Loading commit data...
scanner.cc Loading commit data...
scanner.h Loading commit data...
scopeinfo.cc Loading commit data...
scopeinfo.h Loading commit data...
scopes.cc Loading commit data...
scopes.h Loading commit data...
signature.h Loading commit data...
simulator.h Loading commit data...
small-pointer-list.h Loading commit data...
smart-pointers.h Loading commit data...
splay-tree-inl.h Loading commit data...
splay-tree.h Loading commit data...
startup-data-util.cc Loading commit data...
startup-data-util.h Loading commit data...
string-builder.cc Loading commit data...
string-builder.h Loading commit data...
string-iterator.js Loading commit data...
string-search.cc Loading commit data...
string-search.h Loading commit data...
string-stream.cc Loading commit data...
string-stream.h Loading commit data...
string.js Loading commit data...
strings-storage.cc Loading commit data...
strings-storage.h Loading commit data...
strtod.cc Loading commit data...
strtod.h Loading commit data...
symbol.js Loading commit data...
templates.js Loading commit data...
token.cc Loading commit data...
token.h Loading commit data...
transitions-inl.h Loading commit data...
transitions.cc Loading commit data...
transitions.h Loading commit data...
type-feedback-vector-inl.h Loading commit data...
type-feedback-vector.cc Loading commit data...
type-feedback-vector.h Loading commit data...
type-info.cc Loading commit data...
type-info.h Loading commit data...
typedarray.js Loading commit data...
types-inl.h Loading commit data...
types.cc Loading commit data...
types.h Loading commit data...
typing.cc Loading commit data...
typing.h Loading commit data...
unbound-queue-inl.h Loading commit data...
unbound-queue.h Loading commit data...
unicode-decoder.cc Loading commit data...
unicode-decoder.h Loading commit data...
unicode-inl.h Loading commit data...
unicode.cc Loading commit data...
unicode.h Loading commit data...
unique.h Loading commit data...
uri.js Loading commit data...
utils.cc Loading commit data...
utils.h Loading commit data...
v8.cc Loading commit data...
v8.h Loading commit data...
v8dll-main.cc Loading commit data...
v8memory.h Loading commit data...
v8natives.js Loading commit data...
v8threads.cc Loading commit data...
v8threads.h Loading commit data...
variables.cc Loading commit data...
variables.h Loading commit data...
vector.h Loading commit data...
version.cc Loading commit data...
version.h Loading commit data...
vm-state-inl.h Loading commit data...
vm-state.h Loading commit data...
weak-collection.js Loading commit data...
zone-allocator.h Loading commit data...
zone-containers.h Loading commit data...
zone.cc Loading commit data...
zone.h Loading commit data...