ladybird/Libraries/LibJS
Andreas Kling fdd974b7ef LibJS: Fix UB downcast during GlobalObject construction
When constructing a GlobalObject, it has to pass itself as the global
object to its own Shape. Since this is done in the Object constructor,
and Object is a base class of GlobalObject, it's not yet valid to cast
"this" to a GlobalObject*.

Fix this by having Shape store the global object as an Object& and move
Shape::global_object() to GlobalObject.h where we can at least perform a
valid static_cast in the getter.

Found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29267
2021-01-05 12:02:59 +01:00
..
Heap Spreadsheet: Override visit_edges() and visit stored JS objects 2020-12-22 23:35:29 +01:00
Runtime LibJS: Fix UB downcast during GlobalObject construction 2021-01-05 12:02:59 +01:00
Tests Everywhere: Fix more typos 2020-12-31 01:47:41 +01:00
AST.cpp LibJS: Remove hand-rolled type information in JS AST in favor of RTTI 2021-01-01 19:34:07 +01:00
AST.h LibJS: Remove hand-rolled type information in JS AST in favor of RTTI 2021-01-01 19:34:07 +01:00
CMakeLists.txt LibJS: Use new format functions everywhere 2020-12-06 18:52:52 +01:00
Console.cpp LibJS: Use regular stack for VM call frames instead of Vector storage 2020-11-07 13:58:28 +01:00
Console.h LibJS: Move Console from Interpreter to GlobalObject 2020-09-29 21:15:06 +02:00
Forward.h Everywhere: Switch from (void) to [[maybe_unused]] (#4473) 2020-12-21 00:09:48 +01:00
Interpreter.cpp LibJS: Remove hand-rolled type information in JS AST in favor of RTTI 2021-01-01 19:34:07 +01:00
Interpreter.h LibJS: Track source positions all the way down to exceptions 2020-12-29 00:58:43 +01:00
Lexer.cpp LibJS: Don't treat '?.' followed by decimal digit as QuestionMarkPeriod 2020-12-14 22:25:46 +01:00
Lexer.h LibJS: Include source location hint in Parser::print_errors() 2020-12-06 18:52:52 +01:00
MarkupGenerator.cpp LibJS: Remove hand-rolled Object is_foo() helpers in favor of RTTI 2021-01-01 17:46:39 +01:00
MarkupGenerator.h Meta: Add a script check the presence of "#pragma once" in header files 2020-05-29 07:59:45 +02:00
Parser.cpp LibJS: Remove hand-rolled type information in JS AST in favor of RTTI 2021-01-01 19:34:07 +01:00
Parser.h LibJS: Don't save rule start positions along with the parser state 2020-12-29 17:39:42 +01:00
SourceRange.h LibJS: Track source positions all the way down to exceptions 2020-12-29 00:58:43 +01:00
Token.cpp LibJS: Use GenericLexer for Token::string_value() 2020-10-29 11:52:31 +01:00
Token.h LibJS: Add message string to Token 2020-10-26 21:38:34 +01:00