AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

cppgc: young-gen: Filter out SMIs when visiting traced nodes

Browse Source 
Traced nodes can contain SMIs, e.g. when base::ScriptValue is
constructed. The CL filters them out when visiting V8->C++ references,
as otherwise it crashes later assuming HeapObject.

Bug: chromium:1029379
Change-Id: Idaafc92d4dc1bd14c7d1a07e2177202a8af336a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3555769
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79719}
This commit is contained in:
Anton Bikineev 2022-03-28 18:34:58 +02:00 committed by V8 LUCI CQ
parent e70ccb2f7f
commit e4ac08c514
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/heap/cppgc-js/cpp-heap.cc
View File

@ -75,7 +75,9 @@ class V8ToCppGCReferencesVisitor final
const internal::JSObject js_object =
*reinterpret_cast<const internal::JSObject* const&>(value);
if (!js_object.ptr() || !js_object.MayHaveEmbedderFields()) return;
if (!js_object.ptr() || js_object.IsSmi() ||
!js_object.MayHaveEmbedderFields())
return;
internal::LocalEmbedderHeapTracer::WrapperInfo info;
if (!internal::LocalEmbedderHeapTracer::ExtractWrappableInfo(