diff options
| author | Moonchild <moonchild@palemoon.org> | 2020-08-03 09:41:42 +0000 |
|---|---|---|
| committer | Moonchild <moonchild@palemoon.org> | 2020-08-06 18:31:58 +0000 |
| commit | e1e535c1c6372f95b4a14b6a00b6d6e7be400c3b (patch) | |
| tree | 1e0cda7c9382d4f3fa8da42eb3ea5cf219572b0f /js/src | |
| parent | 9b6252893876995ae4c1f278fc8d1cbdfb72e94d (diff) | |
| download | UXP-e1e535c1c6372f95b4a14b6a00b6d6e7be400c3b.tar UXP-e1e535c1c6372f95b4a14b6a00b6d6e7be400c3b.tar.gz UXP-e1e535c1c6372f95b4a14b6a00b6d6e7be400c3b.tar.lz UXP-e1e535c1c6372f95b4a14b6a00b6d6e7be400c3b.tar.xz UXP-e1e535c1c6372f95b4a14b6a00b6d6e7be400c3b.zip | |
[js] Try to catch bad pointers for GC and bail if not valid.
Diffstat (limited to 'js/src')
| -rw-r--r-- | js/src/gc/Marking.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp index 43e325394..b4db0297a 100644 --- a/js/src/gc/Marking.cpp +++ b/js/src/gc/Marking.cpp @@ -2267,6 +2267,8 @@ void js::gc::StoreBuffer::SlotsEdge::trace(TenuringTracer& mover) const { NativeObject* obj = object(); + if(!IsCellPointerValid(obj)) + return; // Beware JSObject::swap exchanging a native object for a non-native one. if (!obj->isNative()) @@ -2336,6 +2338,8 @@ js::gc::StoreBuffer::traceWholeCells(TenuringTracer& mover) { for (ArenaCellSet* cells = bufferWholeCell; cells; cells = cells->next) { Arena* arena = cells->arena; + if(!IsCellPointerValid(arena)) + continue; MOZ_ASSERT(arena->bufferedCells == cells); arena->bufferedCells = &ArenaCellSet::Empty; @@ -2364,6 +2368,7 @@ js::gc::StoreBuffer::CellPtrEdge::trace(TenuringTracer& mover) const { if (!*edge) return; + // XXX: We should check if the cell pointer is valid here too MOZ_ASSERT((*edge)->getTraceKind() == JS::TraceKind::Object); mover.traverse(reinterpret_cast<JSObject**>(edge)); |