[d8] zero realm_count_ on RealmScope teardown
Promises can sometimes be resolved after the RealmScope has been destroyed, such as when a Wasm compile job finishes after the script main has finished. If the Promise.then function refers to Realm.current, we were getting a use-after free error when it would search for the list of realms. This change also zeros out realm_count_ in addition to deleting the realms_ so that RealmFind will not reference freed memory. Bug: chromium:761710 Change-Id: I2d42997f363b284ccc5f4b225d3f59e0361e68d6 Reviewed-on: https://chromium-review.googlesource.com/671923Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#48073}
Showing
Please
register
or
sign in
to comment