Bug 107115 – Web Inspector: Crash for console.log(<large array object>)

• Component: Web Inspector (Deprecated)
• Status: RESOLVED WONTFIX

[Andrey Adaikin]

The following test case crashes Chrome:

    var g = [];
    g[4294967294] = 4294967294;
    console.dir(g);

Patch to follow.

[Andrey Adaikin]

Created attachment 183163 [details]
Patch

[Andrey Adaikin]

Created attachment 183748 [details]
Patch

[Yury Semikhatsky]

Comment on attachment 183748 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=183748&action=review

> Source/WebCore/bindings/v8/ScriptValue.h:131
> +    bool isArray(unsigned* length = 0) const;

I'd rename it to arrayLength

> LayoutTests/inspector/console/console-big-array.html:56
> +    g[4294967294] = 4294967294;

Should this be fixed in the VM instead? It works fine for sparse arrays with smaller length.

[Yury Semikhatsky]

(In reply to comment #3)
> (From update of attachment 183748 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=183748&action=review
> 
> Should this be fixed in the VM instead? It works fine for sparse arrays with smaller length.

The following code just crashes Chromium tab:
<script>
var g = [];
g[4294967294] = 4294967294;
var str = g.toString();
</script>
so I don't think fixing it for inspector is enough.

[Andrey Adaikin]

Agreed. Filed a bug downstream: https://code.google.com/p/chromium/issues/detail?id=171231