[js] Avoid potential crash if GC cell is no longer valid.

This commit is contained in:
Moonchild 2024-11-23 13:54:29 +01:00 committed by roytam1
commit 6c6ab6de1a

View file

@ -7138,7 +7138,7 @@ JS_PUBLIC_API(bool)
js::gc::detail::CellIsMarkedGrayIfKnown(const Cell* cell)
{
MOZ_ASSERT(cell);
if (!cell->isTenured())
if (!cell || !cell->isTenured())
return false;
// We ignore the gray marking state of cells and return false in two cases: