49362 2010-11-10 20:03:59 -0800 REGRESSION(71515): Web Inspector: Safari crash calling console.log when Log JavaScript Exceptions to Console is checked 2010-11-16 16:06:23 -0800 1 1 1 Unclassified WebKit Web Inspector (Deprecated) 528+ (Nightly build) Mac All RESOLVED FIXED InRadar P1 Normal --- 1 bweinstein yurys apavlov bugzilla bweinstein commit-queue joepeck keishi loislo mrowe pfeldman pmuellr rik smkolins timothy yurys oldest_to_newest 307701 0 bweinstein 2010-11-10 20:03:59 -0800 There is a crash in Safari when logging to the console when "Log JavaScript Exceptions to Console" is checked. 307707 1 mrowe 2010-11-10 20:25:57 -0800 There’s a lifetime issue here in Console::addMessage. The local variable lastCaller is a reference to a call frame owned by the callStack variable. The callStack variable is passed to InspectorController::addMessageToConsole which creates a ConsoleMessage with the ScriptCallStack instance. The ConsoleMessage constructor then clears the ScriptCallStack instance. This means that the lastCaller local variable is now a reference to deallocated memory. There’s a similar issue with the arguments object. It’s a PassOwnPtr and is passed to InspectorController::addMessageToConsole. That results in the arguments local being cleared out, ensuring a nil-dereference will occur when it is dereferenced later on in Console::addMessage. 308206 2 ap 2010-11-11 15:26:24 -0800 *** Bug 49392 has been marked as a duplicate of this bug. *** 308584 3 yurys 2010-11-12 08:55:57 -0800 Sorry for the lame question, but where can I find this "Log JavaScript Exceptions to Console" option? Should I install Safari Enhancer to see this option? 308611 4 bweinstein 2010-11-12 09:54:06 -0800 It's in Safari's Debug Menu on Mac. 1) Quit Safari 2) Open a terminal, and run: defaults write com.apple.Safari IncludeInternalDebugMenu 1 3) Relaunch Safari There will be a new menu at the top, the Debug Menu, and the Menu item should be there. 308774 5 timothy 2010-11-12 13:58:12 -0800 <rdar://problem/8655727> 308954 6 73817 yurys 2010-11-13 02:48:13 -0800 Created attachment 73817 Patch 308970 7 73817 commit-queue 2010-11-13 06:51:11 -0800 Comment on attachment 73817 Patch Clearing flags on attachment: 73817 Committed r71966: <http://trac.webkit.org/changeset/71966> 308971 8 commit-queue 2010-11-13 06:51:16 -0800 All reviewed patches have been landed. Closing bug. 310004 9 ap 2010-11-16 16:06:23 -0800 *** Bug 49598 has been marked as a duplicate of this bug. *** 73817 2010-11-13 02:48:13 -0800 2010-11-13 06:51:11 -0800 Patch bug-49362-20101113134811.patch text/plain 2667 yurys ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg MzJhYWE0MWZlMDJkOTA4MzJjNmNmMDgyNDRhZjI3OTAzMWE2NmI1NC4uODBkM2Y4NDllMTY4ZGJl MWQyNGIzODI4YjI5NjRjZjU1YTBlYzYyMSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cK KysrIGIvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNCBAQAorMjAxMC0xMS0xMyAgWXVy eSBTZW1pa2hhdHNreSAgPHl1cnlzQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBSRUdSRVNTSU9OKDcxNTE1KTogV2ViIEluc3Bl Y3RvcjogU2FmYXJpIGNyYXNoIGNhbGxpbmcgY29uc29sZS5sb2cgd2hlbiBMb2cgSmF2YVNjcmlw dCBFeGNlcHRpb25zIHRvIENvbnNvbGUgaXMgY2hlY2tlZAorICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDkzNjIKKworICAgICAgICAqIHBhZ2UvQ29uc29s ZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpDb25zb2xlOjphZGRNZXNzYWdlKTogYXZvaWQgYWNj ZXNzaW5nIFNjcmlwdEFyZ3VtZW50cyBhbmQgU2NyaXB0Q2FsbFN0YWNrIGFmdGVyIHRoZWlyIG93 bmVyc2hpcAorICAgICAgICBoYXMgYmVlbiBwYXNzZWQgdG8gdGhlIGluc3BlY3Rvci4KKwogMjAx MC0xMS0xMiAgUGF2ZWwgRmVsZG1hbiAgPHBmZWxkbWFuQGNocm9taXVtLm9yZz4KIAogICAgICAg ICBSZXZpZXdlZCBieSBZdXJ5IFNlbWlraGF0c2t5LgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9wYWdl L0NvbnNvbGUuY3BwIGIvV2ViQ29yZS9wYWdlL0NvbnNvbGUuY3BwCmluZGV4IDE0ODFlYmRhNGZm YWQxMTZhMWQ5MmE1OTEwZmFmMjdkODY1NDY2MzUuLjM0ZGI1MzhkYzdhMzEzYThmMDUyYmI3YTcy NzZkOTY0OGM3YjBlNzIgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvcGFnZS9Db25zb2xlLmNwcAorKysg Yi9XZWJDb3JlL3BhZ2UvQ29uc29sZS5jcHAKQEAgLTE3Myw2ICsxNzMsMTggQEAgdm9pZCBDb25z b2xlOjphZGRNZXNzYWdlKE1lc3NhZ2VUeXBlIHR5cGUsIE1lc3NhZ2VMZXZlbCBsZXZlbCwgUGFz c093blB0cjxTY3JpcHQKICAgICBpZiAoIWFjY2VwdE5vQXJndW1lbnRzICYmICFhcmd1bWVudHMt PmFyZ3VtZW50Q291bnQoKSkKICAgICAgICAgcmV0dXJuOwogCisgICAgaWYgKENvbnNvbGU6OnNo b3VsZFByaW50RXhjZXB0aW9ucygpKSB7CisgICAgICAgIHByaW50U291cmNlVVJMQW5kTGluZShs YXN0Q2FsbGVyLnNvdXJjZVVSTCgpLCAwKTsKKyAgICAgICAgcHJpbnRNZXNzYWdlU291cmNlQW5k TGV2ZWxQcmVmaXgoSlNNZXNzYWdlU291cmNlLCBsZXZlbCk7CisKKyAgICAgICAgZm9yICh1bnNp Z25lZCBpID0gMDsgaSA8IGFyZ3VtZW50cy0+YXJndW1lbnRDb3VudCgpOyArK2kpIHsKKyAgICAg ICAgICAgIFN0cmluZyBhcmdBc1N0cmluZzsKKyAgICAgICAgICAgIGlmIChhcmd1bWVudHMtPmFy Z3VtZW50QXQoaSkuZ2V0U3RyaW5nKGFyZ3VtZW50cy0+Z2xvYmFsU3RhdGUoKSwgYXJnQXNTdHJp bmcpKQorICAgICAgICAgICAgICAgIHByaW50ZigiICVzIiwgYXJnQXNTdHJpbmcudXRmOCgpLmRh dGEoKSk7CisgICAgICAgIH0KKyAgICAgICAgcHJpbnRmKCJcbiIpOworICAgIH0KKwogICAgIFN0 cmluZyBtZXNzYWdlOwogICAgIGlmIChhcmd1bWVudHMtPmdldEZpcnN0QXJndW1lbnRBc1N0cmlu ZyhtZXNzYWdlKSkKICAgICAgICAgcGFnZS0+Y2hyb21lKCktPmNsaWVudCgpLT5hZGRNZXNzYWdl VG9Db25zb2xlKEpTTWVzc2FnZVNvdXJjZSwgdHlwZSwgbGV2ZWwsIG1lc3NhZ2UsIGxhc3RDYWxs ZXIubGluZU51bWJlcigpLCBsYXN0Q2FsbGVyLnNvdXJjZVVSTCgpKTsKQEAgLTE4MCwxOSArMTky LDYgQEAgdm9pZCBDb25zb2xlOjphZGRNZXNzYWdlKE1lc3NhZ2VUeXBlIHR5cGUsIE1lc3NhZ2VM ZXZlbCBsZXZlbCwgUGFzc093blB0cjxTY3JpcHQKICNpZiBFTkFCTEUoSU5TUEVDVE9SKQogICAg IHBhZ2UtPmluc3BlY3RvckNvbnRyb2xsZXIoKS0+YWRkTWVzc2FnZVRvQ29uc29sZShKU01lc3Nh Z2VTb3VyY2UsIHR5cGUsIGxldmVsLCBtZXNzYWdlLCBhcmd1bWVudHMsIGNhbGxTdGFjayk7CiAj ZW5kaWYKLQotICAgIGlmICghQ29uc29sZTo6c2hvdWxkUHJpbnRFeGNlcHRpb25zKCkpCi0gICAg ICAgIHJldHVybjsKLQotICAgIHByaW50U291cmNlVVJMQW5kTGluZShsYXN0Q2FsbGVyLnNvdXJj ZVVSTCgpLCAwKTsKLSAgICBwcmludE1lc3NhZ2VTb3VyY2VBbmRMZXZlbFByZWZpeChKU01lc3Nh Z2VTb3VyY2UsIGxldmVsKTsKLQotICAgIGZvciAodW5zaWduZWQgaSA9IDA7IGkgPCBhcmd1bWVu dHMtPmFyZ3VtZW50Q291bnQoKTsgKytpKSB7Ci0gICAgICAgIFN0cmluZyBhcmdBc1N0cmluZzsK LSAgICAgICAgaWYgKGFyZ3VtZW50cy0+YXJndW1lbnRBdChpKS5nZXRTdHJpbmcoYXJndW1lbnRz LT5nbG9iYWxTdGF0ZSgpLCBhcmdBc1N0cmluZykpCi0gICAgICAgICAgICBwcmludGYoIiAlcyIs IGFyZ0FzU3RyaW5nLnV0ZjgoKS5kYXRhKCkpOwotICAgIH0KLSAgICBwcmludGYoIlxuIik7CiB9 CiAKIHZvaWQgQ29uc29sZTo6ZGVidWcoUGFzc093blB0cjxTY3JpcHRBcmd1bWVudHM+IGFyZ3Vt ZW50cywgUGFzc093blB0cjxTY3JpcHRDYWxsU3RhY2s+IGNhbGxTdGFjaykK