Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-02 15:15:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 764165 - Poison freed IonCode buffers. r=dvander

Browse Source
This commit is contained in:
Sean Stangl 2012-06-12 14:29:07 -07:00
parent 7291c64ec1
commit 79dc0b9626
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/ion/Ion.cpp
View File

@ -343,6 +343,12 @@ void
IonCode::finalize(FreeOp *fop)
{
JS_ASSERT(!fop->onBackgroundThread());
// Buffer can be freed at any time hereafter. Catch use-after-free bugs.
JS_POISON(code_, JS_FREE_PATTERN, bufferSize_);
// Code buffers are stored inside JSC pools.
// Pools are refcounted. Releasing the pool may free it.
if (pool_)
pool_->release();
}