From 6c6ab6de1a8b5516400ced613af09db8320fd34b Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sat, 23 Nov 2024 13:54:29 +0100 Subject: [PATCH] [js] Avoid potential crash if GC cell is no longer valid. --- js/src/jsgc.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp index c849bacc8c..9421225827 100644 --- a/js/src/jsgc.cpp +++ b/js/src/jsgc.cpp @@ -7138,7 +7138,7 @@ JS_PUBLIC_API(bool) js::gc::detail::CellIsMarkedGrayIfKnown(const Cell* cell) { MOZ_ASSERT(cell); - if (!cell->isTenured()) + if (!cell || !cell->isTenured()) return false; // We ignore the gray marking state of cells and return false in two cases: