Commit d99308ef authored by kozyatinskiy's avatar kozyatinskiy Committed by Commit bot

[inspector] fix use-after-free in ConsoleHelper::reportCall

InspectedContext can be destroyed inside of V8ConsoleMessage::createForConsoleAPI call.

BUG=chromium:646175
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2388463002
Cr-Commit-Position: refs/heads/master@{#39939}
parent 759581ea
......@@ -93,12 +93,13 @@ class ConsoleHelper {
const std::vector<v8::Local<v8::Value>>& arguments) {
InspectedContext* inspectedContext = ensureInspectedContext();
if (!inspectedContext) return;
int contextGroupId = inspectedContext->contextGroupId();
V8InspectorImpl* inspector = inspectedContext->inspector();
std::unique_ptr<V8ConsoleMessage> message =
V8ConsoleMessage::createForConsoleAPI(
inspector->client()->currentTimeMS(), type, arguments,
inspector->debugger()->captureStackTrace(false), inspectedContext);
inspector->ensureConsoleMessageStorage(inspectedContext->contextGroupId())
inspector->ensureConsoleMessageStorage(contextGroupId)
->addMessage(std::move(message));
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment