wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 23:38:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

[js] Try to catch bad pointers for GC and bail if not valid.

Browse source
This commit is contained in:
Moonchild 2020-08-03 09:41:42 +00:00 • committed by Roy Tam
commit b52bc1586d
2 changed files with 42 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
js/src/gc/Marking.cpp
View file

@ -2267,6 +2267,8 @@ void
js::gc::StoreBuffer::SlotsEdge::trace(TenuringTracer& mover) const
{
NativeObject* obj = object();
if(!IsCellPointerValid(obj))
return;
// Beware JSObject::swap exchanging a native object for a non-native one.
if (!obj->isNative())
@ -2336,6 +2338,8 @@ js::gc::StoreBuffer::traceWholeCells(TenuringTracer& mover)
{
for (ArenaCellSet* cells = bufferWholeCell; cells; cells = cells->next) {
Arena* arena = cells->arena;
if(!IsCellPointerValid(arena))
continue;
MOZ_ASSERT(arena->bufferedCells == cells);
arena->bufferedCells = &ArenaCellSet::Empty;
@ -2364,6 +2368,7 @@ js::gc::StoreBuffer::CellPtrEdge::trace(TenuringTracer& mover) const
{
if (!*edge)
return;
// XXX: We should check if the cell pointer is valid here too
MOZ_ASSERT((*edge)->getTraceKind() == JS::TraceKind::Object);
mover.traverse(reinterpret_cast<JSObject**>(edge));