Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(134)

Issue 1211433003: Fix cluster-fuzz regression with Workers and recursive serialization (Closed)

Created:
5 years, 5 months ago by binji
Modified:
5 years, 5 months ago
CC:
v8-dev
Base URL:
https://chromium.googlesource.com/v8/v8.git@master
Target Ref:
refs/pending/heads/master
Project:
v8
Visibility:
Public.

Description

Fix cluster-fuzz regression with Workers and recursive serialization Shell::SerializeValue was using a HandleScope, but was also storing Handles in an ObjectList. The ObjectList handles would persist after the function had returned, but will have already been destroyed by the HandleScope, so there is a use-after-free. This change removes the HandleScope in Shell::SerializeValue and relies on the caller's HandleScope. BUG=chromium:503968 R=jochen@chromium.org LOG=n Committed: https://crrev.com/5023335b4d0d48df880480a5baf6ca601912afe8 Cr-Commit-Position: refs/heads/master@{#29265}

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+15 lines, -1 line) Patch
M src/d8.cc View 1 chunk +0 lines, -1 line 0 comments Download
A test/mjsunit/regress/regress-crbug-503968.js View 1 chunk +15 lines, -0 lines 0 comments Download

Messages

Total messages: 6 (1 generated)
binji
5 years, 5 months ago (2015-06-24 17:52:16 UTC) #1
jochen (gone - plz use gerrit)
lgtm
5 years, 5 months ago (2015-06-24 17:53:53 UTC) #2
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1211433003/1
5 years, 5 months ago (2015-06-24 18:29:30 UTC) #4
commit-bot: I haz the power
Committed patchset #1 (id:1)
5 years, 5 months ago (2015-06-24 18:31:49 UTC) #5
commit-bot: I haz the power
5 years, 5 months ago (2015-06-24 18:32:00 UTC) #6
Message was sent while issue was closed.
Patchset 1 (id:??) landed as
https://crrev.com/5023335b4d0d48df880480a5baf6ca601912afe8
Cr-Commit-Position: refs/heads/master@{#29265}

Powered by Google App Engine
This is Rietveld 408576698