Author

Pratham <67585967+git-bruh@users.noreply.github.com> 2026-05-04 16:10:59 +0530

Parents

a5a0053

Tree

52e274f

jsg: actually move out of `value` parameter in serializeJson (#6711)

The json field was not actually moved from when passed to serializeJson in worker-loader.c++, causing the dynamic worker script's ownContent to hold the V8Ref pointing to the parent isolate leading to a UaF in the v8::Locker::isLocked call in jsg::Data::destroy during destruction of Module, only if the parent isolate got GC'd before the dynamic isolate