mirror of
https://github.com/pjh456/OxideJS.git
synced 2026-10-26 11:41:13 +08:00
fix: 生成器状态盒深拷贝消除 sweep/promote 共享所有权 UAF,full_reset 补释放 session 堆数据
GeneratorState 状态盒此前由 epoch 原对象独占释放,promote 与 sweep 克隆 浅拷贝 native_data 共享同一盒,旧对象 drop 即悬垂。新增 clone 深拷贝 (参照 async_generator),promote/sweep 两处接入,恢复执行读新盒; full_reset 在 session arena 重置前遍历 session 对象释放堆数据, 配合深拷贝形成单所有权。补 sweep/promote/full_reset 三回归与 生成器捕获闭包跨 GC 回归。
This commit is contained in:
@@ -434,6 +434,8 @@ impl SessionGc {
|
||||
crate::async_func::clone_async_native_with_rewrite(old_ref, new_ref, |value| value);
|
||||
} else if old_ref.is_async_generator_obj() {
|
||||
crate::async_generator::clone_async_generator_native_with_rewrite(old_ref, new_ref, |value| value);
|
||||
} else if old_ref.is_generator_obj() {
|
||||
crate::generator::clone_generator_native_with_rewrite(old_ref, new_ref, |value| value);
|
||||
}
|
||||
forwarding.insert(old_ptr, new_ptr);
|
||||
freed_bytes += Self::drop_session_object_heap_data(old_ptr);
|
||||
|
||||
Reference in New Issue
Block a user