| Index: chrome/renderer/native_handler.cc
|
| diff --git a/chrome/renderer/native_handler.cc b/chrome/renderer/native_handler.cc
|
| index a09486b604a1704f38ec8f096cb38754ecda6ced..7076b324d6853fa0adc7430ff21482bccbfe6bb6 100644
|
| --- a/chrome/renderer/native_handler.cc
|
| +++ b/chrome/renderer/native_handler.cc
|
| @@ -6,6 +6,7 @@
|
|
|
| #include "base/memory/linked_ptr.h"
|
| #include "base/logging.h"
|
| +#include "chrome/renderer/module_system.h"
|
| #include "v8/include/v8.h"
|
|
|
| NativeHandler::NativeHandler()
|
| @@ -23,6 +24,13 @@ v8::Handle<v8::Object> NativeHandler::NewInstance() {
|
|
|
| // static
|
| v8::Handle<v8::Value> NativeHandler::Router(const v8::Arguments& args) {
|
| + // It is possible for JS code to execute after ModuleSystem has been deleted
|
| + // in which case the native handlers will also have been deleted, making
|
| + // HandlerFunction below point to freed memory.
|
| + if (!ModuleSystem::IsPresentInCurrentContext()) {
|
| + return v8::ThrowException(v8::Exception::Error(
|
| + v8::String::New("ModuleSystem has been deleted")));
|
| + }
|
| HandlerFunction* handler_function = static_cast<HandlerFunction*>(
|
| args.Data().As<v8::External>()->Value());
|
| return handler_function->Run(args);
|
|
|