summaryrefslogtreecommitdiffstats
path: root/js/src/gc
diff options
context:
space:
mode:
authorMoonchild <moonchild@palemoon.org>2020-08-03 09:41:42 +0000
committerMoonchild <moonchild@palemoon.org>2020-08-07 21:28:14 +0000
commit972ab6d437272edb268f2bf1a515027192b14b58 (patch)
tree386f1aca4d78f64af970d0a217f5cf9ebe0b1e5a /js/src/gc
parent83ae5bd01967dc8eceba5b4c16ff380ac3679406 (diff)
downloadUXP-972ab6d437272edb268f2bf1a515027192b14b58.tar
UXP-972ab6d437272edb268f2bf1a515027192b14b58.tar.gz
UXP-972ab6d437272edb268f2bf1a515027192b14b58.tar.lz
UXP-972ab6d437272edb268f2bf1a515027192b14b58.tar.xz
UXP-972ab6d437272edb268f2bf1a515027192b14b58.zip
[js] Try to catch bad pointers for GC and bail if not valid.
Diffstat (limited to 'js/src/gc')
-rw-r--r--js/src/gc/Marking.cpp5
1 files changed, 5 insertions, 0 deletions
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 43e325394..b4db0297a 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2267,6 +2267,8 @@ void
js::gc::StoreBuffer::SlotsEdge::trace(TenuringTracer& mover) const
{
NativeObject* obj = object();
+ if(!IsCellPointerValid(obj))
+ return;
// Beware JSObject::swap exchanging a native object for a non-native one.
if (!obj->isNative())
@@ -2336,6 +2338,8 @@ js::gc::StoreBuffer::traceWholeCells(TenuringTracer& mover)
{
for (ArenaCellSet* cells = bufferWholeCell; cells; cells = cells->next) {
Arena* arena = cells->arena;
+ if(!IsCellPointerValid(arena))
+ continue;
MOZ_ASSERT(arena->bufferedCells == cells);
arena->bufferedCells = &ArenaCellSet::Empty;
@@ -2364,6 +2368,7 @@ js::gc::StoreBuffer::CellPtrEdge::trace(TenuringTracer& mover) const
{
if (!*edge)
return;
+ // XXX: We should check if the cell pointer is valid here too
MOZ_ASSERT((*edge)->getTraceKind() == JS::TraceKind::Object);
mover.traverse(reinterpret_cast<JSObject**>(edge));