From 4bee377ce818d9f67ce70720b79ca230445672ef Mon Sep 17 00:00:00 2001 From: "koz@chromium.org" Date: Tue, 24 Apr 2012 07:24:47 +0000 Subject: Make functions being routed by NativeHandlers throw an exception if there is no ModuleSystem in the current context. BUG=124208 TEST=existing tests Review URL: http://codereview.chromium.org/10208001 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@133643 0039d316-1c4b-4281-b951-d872f2087c98 --- chrome/renderer/native_handler.cc | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'chrome/renderer/native_handler.cc') diff --git a/chrome/renderer/native_handler.cc b/chrome/renderer/native_handler.cc index a09486b..7076b32 100644 --- a/chrome/renderer/native_handler.cc +++ b/chrome/renderer/native_handler.cc @@ -6,6 +6,7 @@ #include "base/memory/linked_ptr.h" #include "base/logging.h" +#include "chrome/renderer/module_system.h" #include "v8/include/v8.h" NativeHandler::NativeHandler() @@ -23,6 +24,13 @@ v8::Handle NativeHandler::NewInstance() { // static v8::Handle NativeHandler::Router(const v8::Arguments& args) { + // It is possible for JS code to execute after ModuleSystem has been deleted + // in which case the native handlers will also have been deleted, making + // HandlerFunction below point to freed memory. + if (!ModuleSystem::IsPresentInCurrentContext()) { + return v8::ThrowException(v8::Exception::Error( + v8::String::New("ModuleSystem has been deleted"))); + } HandlerFunction* handler_function = static_cast( args.Data().As()->Value()); return handler_function->Run(args); -- cgit v1.1