Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(134)

Unified Diff: Source/bindings/v8/ScriptWrappable.h

Issue 220473013: Harden ScriptWrappable against ref count bugs (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Created 6 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/bindings/v8/ScriptWrappable.h
diff --git a/Source/bindings/v8/ScriptWrappable.h b/Source/bindings/v8/ScriptWrappable.h
index 27f119908cbde3648b449c69879912fde1ac6e74..91ba8cdc3554eb29c4c6a71a27062eb6d8898872 100644
--- a/Source/bindings/v8/ScriptWrappable.h
+++ b/Source/bindings/v8/ScriptWrappable.h
@@ -146,6 +146,9 @@ public:
protected:
~ScriptWrappable()
{
+ // We must not get deleted as long as we contain a wrapper. If this happens, we screwed up ref
+ // counting somewhere. Crash here instead of crashing during a later gc cycle.
+ RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!containsWrapper());
ASSERT(m_wrapperOrTypeInfo); // Assert initialization via init() even if not subsequently wrapped.
m_wrapperOrTypeInfo = 0; // Break UAF attempts to wrap.
}
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698