4 Commits

Author	SHA1	Message	Date
Luke Wilde	25e343464d	LibJS: Cache length identifier for GetLengthWithThis ... We cached the length identifier for GetLength, but not GetLengthWithThis. This caused an `has_value()` verification failure when accessing super.length. Found by Fuzzilli.	2025-04-07 14:40:48 +02:00
Andreas Kling	fe1962d7fa	LibJS: Make SetCompletionType bytecode instruction actually set type ... This recovers 38 tests in test262 that regressed in a0bb31f7a0.	2025-04-05 15:00:05 +02:00
Jess	f5a6704219	LibJS: Fix UAF in ECMAScriptFunctionObject::internal_construct ... Currently, we create `this_argument` with `ordinary_create_from_constructor`, then we use `arguments_list` to build the callee_context. The issue is we don't properly model the side-effects of `ordinary_create_from_constructor`, if `new_target` is a proxy object then when we `get` the prototype, arbitrary javascript can run. This javascript could perform a function call with enough arguments to reallocate the interpreters m_argument_values_buffer vector. This is dangerous and leads to a use-after-free, as our stack frame maintains a pointer to m_argument_values_buffer (`arguments_list`).	2025-03-19 10:31:00 +01:00
Timothy Flynn	93712b24bf	Everywhere: Hoist the Libraries folder to the top-level	2024-11-10 12:50:45 +01:00