Index: Source/bindings/v8/ScriptWrappable.h |
diff --git a/Source/bindings/v8/ScriptWrappable.h b/Source/bindings/v8/ScriptWrappable.h |
index 27f119908cbde3648b449c69879912fde1ac6e74..91ba8cdc3554eb29c4c6a71a27062eb6d8898872 100644 |
--- a/Source/bindings/v8/ScriptWrappable.h |
+++ b/Source/bindings/v8/ScriptWrappable.h |
@@ -146,6 +146,9 @@ public: |
protected: |
~ScriptWrappable() |
{ |
+ // We must not get deleted as long as we contain a wrapper. If this happens, we screwed up ref |
+ // counting somewhere. Crash here instead of crashing during a later gc cycle. |
+ RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!containsWrapper()); |
ASSERT(m_wrapperOrTypeInfo); // Assert initialization via init() even if not subsequently wrapped. |
m_wrapperOrTypeInfo = 0; // Break UAF attempts to wrap. |
} |