There is a crash in Safari when logging to the console when "Log JavaScript Exceptions to Console" is checked.
There’s a lifetime issue here in Console::addMessage. The local variable lastCaller is a reference to a call frame owned by the callStack variable. The callStack variable is passed to InspectorController::addMessageToConsole which creates a ConsoleMessage with the ScriptCallStack instance. The ConsoleMessage constructor then clears the ScriptCallStack instance. This means that the lastCaller local variable is now a reference to deallocated memory. There’s a similar issue with the arguments object. It’s a PassOwnPtr and is passed to InspectorController::addMessageToConsole. That results in the arguments local being cleared out, ensuring a nil-dereference will occur when it is dereferenced later on in Console::addMessage.
*** Bug 49392 has been marked as a duplicate of this bug. ***
Sorry for the lame question, but where can I find this "Log JavaScript Exceptions to Console" option? Should I install Safari Enhancer to see this option?
It's in Safari's Debug Menu on Mac. 1) Quit Safari 2) Open a terminal, and run: defaults write com.apple.Safari IncludeInternalDebugMenu 1 3) Relaunch Safari There will be a new menu at the top, the Debug Menu, and the Menu item should be there.
<rdar://problem/8655727>
Created attachment 73817 [details] Patch
Comment on attachment 73817 [details] Patch Clearing flags on attachment: 73817 Committed r71966: <http://trac.webkit.org/changeset/71966>
All reviewed patches have been landed. Closing bug.
*** Bug 49598 has been marked as a duplicate of this bug. ***