From 972ab6d437272edb268f2bf1a515027192b14b58 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Mon, 3 Aug 2020 09:41:42 +0000
Subject: [js] Try to catch bad pointers for GC and bail if not valid.

---
 js/src/gc/Marking.cpp | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'js/src/gc')

diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 43e325394..b4db0297a 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2267,6 +2267,8 @@ void
 js::gc::StoreBuffer::SlotsEdge::trace(TenuringTracer& mover) const
 {
     NativeObject* obj = object();
+    if(!IsCellPointerValid(obj))
+        return;
 
     // Beware JSObject::swap exchanging a native object for a non-native one.
     if (!obj->isNative())
@@ -2336,6 +2338,8 @@ js::gc::StoreBuffer::traceWholeCells(TenuringTracer& mover)
 {
     for (ArenaCellSet* cells = bufferWholeCell; cells; cells = cells->next) {
         Arena* arena = cells->arena;
+        if(!IsCellPointerValid(arena))
+            continue;
 
         MOZ_ASSERT(arena->bufferedCells == cells);
         arena->bufferedCells = &ArenaCellSet::Empty;
@@ -2364,6 +2368,7 @@ js::gc::StoreBuffer::CellPtrEdge::trace(TenuringTracer& mover) const
 {
     if (!*edge)
         return;
+    // XXX: We should check if the cell pointer is valid here too
 
     MOZ_ASSERT((*edge)->getTraceKind() == JS::TraceKind::Object);
     mover.traverse(reinterpret_cast<JSObject**>(edge));
-- 
cgit v1.2.3