Changeset 225693 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Dec 8, 2017, 12:21:27 PM (7 years ago)

Author:

[email protected]

Message:

Web Inspector: CRASH at InspectorConsoleAgent::enable when iterating mutable list of buffered console messages
​https://bugs.webkit.org/show_bug.cgi?id=180590
<rdar://problem/35882767>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2017-12-08
Reviewed by Mark Lam.

• inspector/agents/InspectorConsoleAgent.cpp:

(Inspector::InspectorConsoleAgent::enable):
Swap the messages to a Vector that won't change during iteration.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• inspector/agents/InspectorConsoleAgent.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-12-08  Joseph Pecoraro  <[email protected]>
+
+        Web Inspector: CRASH at InspectorConsoleAgent::enable when iterating mutable list of buffered console messages
+        https://bugs.webkit.org/show_bug.cgi?id=180590
+        <rdar://problem/35882767>
+
+        Reviewed by Mark Lam.
+
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::enable):
+        Swap the messages to a Vector that won't change during iteration.
+
 2017-12-08  Michael Saboff  <[email protected]>
 

trunk/Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.cpp

@@ -84 +84 @@
     }
 
-    size_t messageCount = m_consoleMessages.size();
-    for (size_t i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToFrontend(*m_frontendDispatcher, m_injectedScriptManager, false);
+    Vector<std::unique_ptr<ConsoleMessage>> messages;
+    m_consoleMessages.swap(messages);
+
+    for (size_t i = 0; i < messages.size(); ++i)
+        messages[i]->addToFrontend(*m_frontendDispatcher, m_injectedScriptManager, false);
 }