eliott/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird synced 2026-04-27 10:07:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

LibJS: Do not invoke Cell::vm in constructors before Cell is constructed

Browse Source 
In a subclass of Cell, we cannot use Cell::vm() before the base Cell
object itself is constructed. Use the Realm's VM instead.

This was caught by UBSAN with vptr sanitation enabled.
This commit is contained in:
Timothy Flynn
2022-09-14 19:10:27 -04:00
committed by Andreas Kling
parent 3efe611dbf
commit 85e313077a
Notes: sideshowbarker 2024-07-17 14:33:07 +09:00 
Author: https://github.com/trflynn89
Commit: https://github.com/SerenityOS/serenity/commit/85e313077a
Pull-request: https://github.com/SerenityOS/serenity/pull/15247
Reviewed-by: https://github.com/bgianfo ✅
46 changed files with 97 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Userland/Libraries/LibJS/Runtime/AsyncGeneratorFunctionConstructor.cpp
View File

@@ -13,7 +13,7 @@
namespace JS {
AsyncGeneratorFunctionConstructor::AsyncGeneratorFunctionConstructor(Realm& realm)
: NativeFunction(vm().names.AsyncGeneratorFunction.as_string(), *realm.intrinsics().function_prototype())
: NativeFunction(realm.vm().names.AsyncGeneratorFunction.as_string(), *realm.intrinsics().function_prototype())
{
}