39d2ab58ce
It indexes a FixedArray out of bounds, accessing an arbitrary object which happens to be in that location. Now the object can also be an in-place weak ref, which will cause a crash when trying to use it. BUG=v8:5651 Change-Id: I73e4169e573ecb23e383970d7db336be08f5903c Reviewed-on: https://chromium-review.googlesource.com/1148055 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#54632} |
||
---|---|---|
.. | ||
bugs/harmony | ||
debug | ||
protocol | ||
regress | ||
wrapper | ||
BUILD.gn | ||
debugger.status | ||
test-api.js | ||
testcfg.py |