Files
ladybird/Userland/Libraries/LibJS/Runtime/GlobalObject.cpp
Andreas Kling 7df3b95126 LibJS: GlobalObject must mark builtin prototypes
Failing to mark them leads to use-after-free since the GlobalObject
cached prototypes are used for new NumberObject, StringObject, etc.

Found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30319
2021-02-05 14:53:16 +01:00

11 KiB