Changeset 239525 in webkit

Timestamp:

Dec 21, 2018, 3:49:26 PM (6 years ago)

Author:

Joseph Pecoraro

Message:

Web Inspector: Crashes seen under Inspector::ScriptCallFrame::~ScriptCallFrame
​https://bugs.webkit.org/show_bug.cgi?id=180373
<rdar://problem/33894170>

Rubber-stamped by Devin Rousso.

• inspector/AsyncStackTrace.cpp:

(Inspector::AsyncStackTrace::truncate):
The lastUnlockedAncestor->remove() may release the only reference to it's
parent which we intend to use later but don't hold a RefPtr to. Keep the
parent alive explicitly by protecting it.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• inspector/AsyncStackTrace.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-12-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Crashes seen under Inspector::ScriptCallFrame::~ScriptCallFrame
+        https://bugs.webkit.org/show_bug.cgi?id=180373
+        <rdar://problem/33894170>
+
+        Rubber-stamped by Devin Rousso.
+
+        * inspector/AsyncStackTrace.cpp:
+        (Inspector::AsyncStackTrace::truncate):
+        The `lastUnlockedAncestor->remove()` may release the only reference to it's
+        parent which we intend to use later but don't hold a RefPtr to. Keep the
+        parent alive explicitly by protecting it.
+
 2018-12-20  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/JavaScriptCore/inspector/AsyncStackTrace.cpp

@@ -168 +168 @@
     // The subtree being truncated must be removed from it's parent before
     // updating its parent pointer chain.
-    auto* sourceNode = lastUnlockedAncestor->m_parent.get();
+    RefPtr<AsyncStackTrace> sourceNode = lastUnlockedAncestor->m_parent;
     lastUnlockedAncestor->remove();
 
@@ -176 +176 @@
         previousNode = previousNode->m_parent.get();
 
-        if (sourceNode == newStackTraceRoot)
+        if (sourceNode.get() == newStackTraceRoot)
             break;
 
-        sourceNode = sourceNode->m_parent.get();
+        sourceNode = sourceNode->m_parent;
     }