| Index: Source/bindings/v8/ScriptWrappable.h
|
| diff --git a/Source/bindings/v8/ScriptWrappable.h b/Source/bindings/v8/ScriptWrappable.h
|
| index 27f119908cbde3648b449c69879912fde1ac6e74..91ba8cdc3554eb29c4c6a71a27062eb6d8898872 100644
|
| --- a/Source/bindings/v8/ScriptWrappable.h
|
| +++ b/Source/bindings/v8/ScriptWrappable.h
|
| @@ -146,6 +146,9 @@ public:
|
| protected:
|
| ~ScriptWrappable()
|
| {
|
| + // We must not get deleted as long as we contain a wrapper. If this happens, we screwed up ref
|
| + // counting somewhere. Crash here instead of crashing during a later gc cycle.
|
| + RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!containsWrapper());
|
| ASSERT(m_wrapperOrTypeInfo); // Assert initialization via init() even if not subsequently wrapped.
|
| m_wrapperOrTypeInfo = 0; // Break UAF attempts to wrap.
|
| }
|
|
|