GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — fix use-after-free in BridgeJS (#690) · matthewa26/JavaScriptKit@0c4c45a

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

Sources/JavaScriptKit
- BridgeJSIntrinsics.swift

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎Sources/JavaScriptKit/BridgeJSIntrinsics.swift‎`

Copy file name to clipboardExpand all lines: Sources/JavaScriptKit/BridgeJSIntrinsics.swift

+6-1Lines changed: 6 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -420,7 +420,12 @@ extension JSObject: _BridgedSwiftStackType {`
`420`	`420`	`}`
`421`	`421`
`422`	`422`	`@_spi(BridgeJS) public consuming func bridgeJSLowerReturn() -> Int32 {`
`423`		`- return _swift_js_retain(Int32(bitPattern: self.id))`
	`423`	`+ // withExtendedLifetime is required here to prevent a use-after-free.`
	`424`	+ // In a `consuming func`, Swift ARC may release `self` (and thus release
	`425`	+ // the underlying JS reference) as soon as it extracts `self.id`, which
	`426`	+ // happens before `_swift_js_retain` is called. `withExtendedLifetime` forces
	`427`	+ // `self` to stay alive until after `_swift_js_retain` returns.
	`428`	`+ return withExtendedLifetime(self) { _swift_js_retain(Int32(bitPattern: self.id)) }`
`424`	`429`	`}`
`425`	`430`
`426`	`431`	`@_spi(BridgeJS) public consuming func bridgeJSStackPush() {`

0 commit comments

Comments

0 (0)

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.