DescriptionFix cluster-fuzz regression with Workers and recursive serialization
Shell::SerializeValue was using a HandleScope, but was also storing Handles in
an ObjectList. The ObjectList handles would persist after the function had
returned, but will have already been destroyed by the HandleScope, so there is
a use-after-free.
This change removes the HandleScope in Shell::SerializeValue and relies on the
caller's HandleScope.
BUG=chromium:503968
R=jochen@chromium.org
LOG=n
Committed: https://crrev.com/5023335b4d0d48df880480a5baf6ca601912afe8
Cr-Commit-Position: refs/heads/master@{#29265}
Patch Set 1 #Messages
Total messages: 6 (1 generated)
|