mirror of
https://github.com/RGBCube/serenity
synced 2025-05-30 18:38:12 +00:00
LibJS: Fix UB downcast during GlobalObject construction
When constructing a GlobalObject, it has to pass itself as the global object to its own Shape. Since this is done in the Object constructor, and Object is a base class of GlobalObject, it's not yet valid to cast "this" to a GlobalObject*. Fix this by having Shape store the global object as an Object& and move Shape::global_object() to GlobalObject.h where we can at least perform a valid static_cast in the getter. Found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29267
This commit is contained in:
parent
279d2eee04
commit
fdd974b7ef
4 changed files with 10 additions and 5 deletions
|
@ -90,7 +90,7 @@ Object* Object::create_empty(GlobalObject& global_object)
|
|||
Object::Object(GlobalObjectTag)
|
||||
{
|
||||
// This is the global object
|
||||
m_shape = heap().allocate_without_global_object<Shape>(static_cast<GlobalObject&>(*this));
|
||||
m_shape = heap().allocate_without_global_object<Shape>(*this);
|
||||
}
|
||||
|
||||
Object::Object(ConstructWithoutPrototypeTag, GlobalObject& global_object)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue