mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 04:17:35 +00:00
LibJS: Keep GeneratorObject's stored execution context's internals alive
This would previously crash with a heap UAF when storing the result of `yield 1` into `e` on the second `next` call: ```js function* a() { const e = yield 1; } b = a(); b.next(); gc(); b.next(); ```
This commit is contained in:
parent
6431dd7904
commit
2f3ebce7c8
1 changed files with 1 additions and 0 deletions
|
@ -50,6 +50,7 @@ void GeneratorObject::visit_edges(Cell::Visitor& visitor)
|
|||
Base::visit_edges(visitor);
|
||||
visitor.visit(m_generating_function);
|
||||
visitor.visit(m_previous_value);
|
||||
m_execution_context.visit_edges(visitor);
|
||||
}
|
||||
|
||||
// 27.5.3.2 GeneratorValidate ( generator, generatorBrand ), https://tc39.es/ecma262/#sec-generatorvalidate
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue