Commit d8d1f6de authored by jochen@chromium.org's avatar jochen@chromium.org

Harden ScriptWrappable against ref count bugs

BUG=358854
R=haraken@chromium.org,dcarney@chromium.org

Review URL: https://codereview.chromium.org/220473013

git-svn-id: svn://svn.chromium.org/blink/trunk@170658 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent ce068664
...@@ -146,6 +146,9 @@ public: ...@@ -146,6 +146,9 @@ public:
protected: protected:
~ScriptWrappable() ~ScriptWrappable()
{ {
// We must not get deleted as long as we contain a wrapper. If this happens, we screwed up ref
// counting somewhere. Crash here instead of crashing during a later gc cycle.
RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!containsWrapper());
ASSERT(m_wrapperOrTypeInfo); // Assert initialization via init() even if not subsequently wrapped. ASSERT(m_wrapperOrTypeInfo); // Assert initialization via init() even if not subsequently wrapped.
m_wrapperOrTypeInfo = 0; // Break UAF attempts to wrap. m_wrapperOrTypeInfo = 0; // Break UAF attempts to wrap.
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment