• Eric Holk's avatar
    [d8] zero realm_count_ on RealmScope teardown · e6defddc
    Eric Holk authored
    Promises can sometimes be resolved after the RealmScope has been destroyed, such
    as when a Wasm compile job finishes after the script main has finished. If the
    Promise.then function refers to Realm.current, we were getting a use-after free
    error when it would search for the list of realms. This change also zeros out
    realm_count_ in addition to deleting the realms_ so that RealmFind will not
    reference freed memory.
    
    Bug: chromium:761710
    Change-Id: I2d42997f363b284ccc5f4b225d3f59e0361e68d6
    Reviewed-on: https://chromium-review.googlesource.com/671923Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Eric Holk <eholk@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#48073}
    e6defddc
d8.cc 112 KB