249064 2022-12-09 19:50:13 -0800 Web Inspector: Fix use-after-move in Inspector::InspectorDebuggerAgent::didCreateNativeExecutable() 2022-12-12 14:18:17 -0800 1 1 1 Unclassified WebKit Web Inspector WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 ddkilzer ddkilzer inspector-bugzilla-changes pangle webkit-bug-importer oldest_to_newest 1918136 0 ddkilzer 2022-12-09 19:50:13 -0800 Fix use-after-move in Inspector::InspectorDebuggerAgent::didCreateNativeExecutable() in Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp. There are two places where `oldJITCodeRef` is used after being moved in a RELEASE_ASSERT() statement. ``` [...] switch (kind) { case JSC::CodeForCall: ASSERT(!replacedThunk->callThunk); replacedThunk->callThunk = WTFMove(oldJITCodeRef); ASSERT(!replacedThunk->callArityThunk); replacedThunk->callArityThunk = WTFMove(oldArityJITCodeRef); RELEASE_ASSERT(oldJITCodeRef.code() == createJITCodeRef(vm.jitStubs->ctiNativeCall(vm)).code()); // Use-after-move of `oldJITCodeRef`. break; case JSC::CodeForConstruct: ASSERT(!replacedThunk->constructThunk); replacedThunk->constructThunk = WTFMove(oldJITCodeRef); ASSERT(!replacedThunk->constructArityThunk); replacedThunk->constructArityThunk = WTFMove(oldArityJITCodeRef); RELEASE_ASSERT(oldJITCodeRef.code() == createJITCodeRef(vm.jitStubs->ctiNativeConstruct(vm)).code()); // Use-after-move of `oldJITCodeRef`. break; } [...] ``` 1918137 1 webkit-bug-importer 2022-12-09 19:50:30 -0800 <rdar://problem/103204166> 1918139 2 ddkilzer 2022-12-09 19:55:34 -0800 Pull request: https://github.com/WebKit/WebKit/pull/7430 1918606 3 ews-feeder 2022-12-12 14:18:15 -0800 Committed 257755@main (9dbd0014372a): <https://commits.webkit.org/257755@main> Reviewed commits have been landed. Closing PR #7430 and removing active labels.