LibJS: Don't consider cells in the lazy freelist in conservative scan

Cells after the lazy freelist bump index are guaranteed to not be
valid cell pointers, so ignore them during the conservative scan.
This commit is contained in:
Andreas Kling 2021-05-17 19:57:40 +02:00
parent aa857bcdeb
commit 751ad19c86
Notes: sideshowbarker 2024-07-18 17:55:55 +09:00

View file

@ -60,7 +60,8 @@ public:
if (pointer < reinterpret_cast<FlatPtr>(m_storage))
return nullptr;
size_t cell_index = (pointer - reinterpret_cast<FlatPtr>(m_storage)) / m_cell_size;
if (cell_index >= cell_count())
auto end = has_lazy_freelist() ? m_next_lazy_freelist_index : cell_count();
if (cell_index >= end)
return nullptr;
return cell(cell_index);
}