dc3eb44971
The V8InspectorSessionImpl constructor accepts a state, as either text or CBOR encoded, and generally ignores all invalid inputs, except for the case where it's a valid value, but not a dictionary value, in which case it'll leak the value and crash upon casting to a `DictionaryValue`. This is purely an issue with the test driver, so no security impact on Chromium in the wild. Fixed: chromium:1281031 Change-Id: I7b4d0aea83370499b1274d3fa214a14dc098d2f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3361838 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78490} |
||
---|---|---|
.. | ||
regress-crbug-980018-expected.txt | ||
regress-crbug-980018.js | ||
regress-crbug-1080638-expected.txt | ||
regress-crbug-1080638.js | ||
regress-crbug-1081162-expected.txt | ||
regress-crbug-1081162.js | ||
regress-crbug-1147552-expected.txt | ||
regress-crbug-1147552.js | ||
regress-crbug-1183664-expected.txt | ||
regress-crbug-1183664.js | ||
regress-crbug-1195927-expected.txt | ||
regress-crbug-1195927.js | ||
regress-crbug-1197392-expected.txt | ||
regress-crbug-1197392.js | ||
regress-crbug-1199919-expected.txt | ||
regress-crbug-1199919.js | ||
regress-crbug-1207867-expected.txt | ||
regress-crbug-1207867.js | ||
regress-crbug-1222065-expected.txt | ||
regress-crbug-1222065.js | ||
regress-crbug-1233401-expected.txt | ||
regress-crbug-1233401.js | ||
regress-crbug-1253277-expected.txt | ||
regress-crbug-1253277.js | ||
regress-crbug-1274529-expected.txt | ||
regress-crbug-1274529.js | ||
regress-crbug-1281031-expected.txt | ||
regress-crbug-1281031.js | ||
regress-crbug-1283049-expected.txt | ||
regress-crbug-1283049.js |