• binji's avatar
    Fix cluster-fuzz regression with Workers and recursive serialization · 5023335b
    binji authored
    Shell::SerializeValue was using a HandleScope, but was also storing Handles in
    an ObjectList. The ObjectList handles would persist after the function had
    returned, but will have already been destroyed by the HandleScope, so there is
    a use-after-free.
    
    This change removes the HandleScope in Shell::SerializeValue and relies on the
    caller's HandleScope.
    
    BUG=chromium:503968
    R=jochen@chromium.org
    LOG=n
    
    Review URL: https://codereview.chromium.org/1211433003
    
    Cr-Commit-Position: refs/heads/master@{#29265}
    5023335b
Name
Last commit
Last update
..
benchmarks Loading commit data...
cctest Loading commit data...
intl Loading commit data...
js-perf-test Loading commit data...
memory Loading commit data...
message Loading commit data...
mjsunit Loading commit data...
mozilla Loading commit data...
preparser Loading commit data...
promises-aplus Loading commit data...
simdjs Loading commit data...
test262 Loading commit data...
test262-es6 Loading commit data...
unittests Loading commit data...
webkit Loading commit data...