wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 764165 - Poison freed IonCode buffers. r=dvander

Browse Source
This commit is contained in:
Sean Stangl 2012-06-12 14:29:07 -07:00
parent 23314d5daa
commit 4fa2da6b26
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/ion/Ion.cpp
View File

@ -343,6 +343,12 @@ void
IonCode::finalize(FreeOp *fop)
{
JS_ASSERT(!fop->onBackgroundThread());
// Buffer can be freed at any time hereafter. Catch use-after-free bugs.
JS_POISON(code_, JS_FREE_PATTERN, bufferSize_);
// Code buffers are stored inside JSC pools.
// Pools are refcounted. Releasing the pool may free it.
if (pool_)
pool_->release();
}