Bug 99686 – Web Inspector: [JSC] Crash in inspector when using strict mode

• Status: RESOLVED
• Resolution: INVALID
• Component: Web Inspector (Deprecated)

Created attachment 169347 [details]
Test page. Open the inspector and reload to hit the debugger statement.

The web inspector's JavaScript debugger would crash when inspecting code set in strict mode.

In the attached test page, I have a "debugger" statement in the body onload event handler, which has "use strict" at the beginning (you may need to reload the page after opening the inspector). When the debugger statement has caused the debugger to pause, go to "Watch Expressions" and add a new expression "this" (which technically should be mapped to nothing under strict mode). Right after adding it the inspector should crash, and it sometimes crashes the whole Safari browser too.

Just more information. The process that crashed is called "WebKit2WebProcess.exe". After I dismiss the dialog usually it works fine, but sometimes I would get a pure virtual call error and the whole browser would crash.

[Vsevolod Vlasov]

Sounds like JSC specific.

[Yury Semikhatsky]

Should be the same issue as described in https://bugs.webkit.org/show_bug.cgi?id=83267

(In reply to comment #3)
> Should be the same issue as described in https://bugs.webkit.org/show_bug.cgi?id=83267

It's not same issue. That bug is about wrapping code run in the console window (not the watch window) in a "with" statement causing an exception to be thrown. This is about putting "this" in the watch window causing the whole process to crash.

I wrote some details on the cause on that bug, will try to find more about this one.

I've found the problem in the code. Basically in DebuggerCallFrame.cpp, there's a line that is like this:

JSValue result = globalData.interpreter->execute(eval, m_callFrame, thisObject(), m_callFrame->scope());

The problem is thisObject() will return 0 in strict mode, and it then gets cast to a JSValue which is a bogus empty value. Seems like the interpreter requires the this object passed in to be a real JS value or it will break in multiple places.

A fix would be to do this instead:

JSObject* thisObj = thisObject();
JSValue result = globalData.interpreter->execute(eval, m_callFrame, thisObj ? JSValue(thisObj) : jsUndefined(), m_callFrame->scopeChain());

This way the this pointer gets bound to undefined which is the correct behavior in strict mode. This is similar to what JSJavaScriptCallFrame::thisObject(ExecState*) does

[Geoffrey Garen]

I agree.

[Radar WebKit Bug Importer]

<rdar://problem/12529052>

[Brian Burg]

Closing as invalid, as this bug pertains to the old inspector UI and/or its tests.
Please file a new bug (https://www.webkit.org/new-inspector-bug) if the bug/feature/issue is still relevant to WebKit trunk.