Commit d99308ef authored by kozyatinskiy's avatar kozyatinskiy Committed by Commit bot

[inspector] fix use-after-free in ConsoleHelper::reportCall

InspectedContext can be destroyed inside of V8ConsoleMessage::createForConsoleAPI call.

BUG=chromium:646175
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2388463002
Cr-Commit-Position: refs/heads/master@{#39939}
parent 759581ea
...@@ -93,12 +93,13 @@ class ConsoleHelper { ...@@ -93,12 +93,13 @@ class ConsoleHelper {
const std::vector<v8::Local<v8::Value>>& arguments) { const std::vector<v8::Local<v8::Value>>& arguments) {
InspectedContext* inspectedContext = ensureInspectedContext(); InspectedContext* inspectedContext = ensureInspectedContext();
if (!inspectedContext) return; if (!inspectedContext) return;
int contextGroupId = inspectedContext->contextGroupId();
V8InspectorImpl* inspector = inspectedContext->inspector(); V8InspectorImpl* inspector = inspectedContext->inspector();
std::unique_ptr<V8ConsoleMessage> message = std::unique_ptr<V8ConsoleMessage> message =
V8ConsoleMessage::createForConsoleAPI( V8ConsoleMessage::createForConsoleAPI(
inspector->client()->currentTimeMS(), type, arguments, inspector->client()->currentTimeMS(), type, arguments,
inspector->debugger()->captureStackTrace(false), inspectedContext); inspector->debugger()->captureStackTrace(false), inspectedContext);
inspector->ensureConsoleMessageStorage(inspectedContext->contextGroupId()) inspector->ensureConsoleMessageStorage(contextGroupId)
->addMessage(std::move(message)); ->addMessage(std::move(message));
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment