diff --git a/src/inspector/v8-console-message.cc b/src/inspector/v8-console-message.cc index b1a24e81c90..de3bb1ee4ab 100644 --- a/src/inspector/v8-console-message.cc +++ b/src/inspector/v8-console-message.cc @@ -581,7 +581,11 @@ void V8ConsoleMessageStorage::addMessage( session->consoleAgent()->messageAdded(message.get()); session->runtimeAgent()->messageAdded(message.get()); }); - if (!inspector->hasConsoleMessageStorage(contextGroupId)) return; + // The forEachSession callback above may run page JavaScript via + // wrapArguments, which can call resetContextGroup() (frees `this`) and then + // ensureConsoleMessageStorage() (re-inserts a fresh storage under the same + // key). Guard against both deletion and replacement of `this`. + if (inspector->getConsoleMessageStorage(contextGroupId) != this) return; DCHECK(m_messages.size() <= maxConsoleMessageCount); if (m_messages.size() == maxConsoleMessageCount) { diff --git a/src/inspector/v8-inspector-impl.cc b/src/inspector/v8-inspector-impl.cc index b57097472e2..c8527e9db35 100644 --- a/src/inspector/v8-inspector-impl.cc +++ b/src/inspector/v8-inspector-impl.cc @@ -136,6 +136,13 @@ V8ConsoleMessageStorage* V8InspectorImpl::ensureConsoleMessageStorage( return storageIt->second.get(); } +V8ConsoleMessageStorage* V8InspectorImpl::getConsoleMessageStorage( + int contextGroupId) { + auto storageIt = m_consoleStorageMap.find(contextGroupId); + if (storageIt == m_consoleStorageMap.end()) return nullptr; + return storageIt->second.get(); +} + bool V8InspectorImpl::hasConsoleMessageStorage(int contextGroupId) { auto storageIt = m_consoleStorageMap.find(contextGroupId); return storageIt != m_consoleStorageMap.end(); diff --git a/src/inspector/v8-inspector-impl.h b/src/inspector/v8-inspector-impl.h index cf4e63cac6e..780812078a7 100644 --- a/src/inspector/v8-inspector-impl.h +++ b/src/inspector/v8-inspector-impl.h @@ -133,6 +133,7 @@ class V8InspectorImpl : public V8Inspector { void muteExceptions(int contextGroupId); void unmuteExceptions(int contextGroupId); V8ConsoleMessageStorage* ensureConsoleMessageStorage(int contextGroupId); + V8ConsoleMessageStorage* getConsoleMessageStorage(int contextGroupId); bool hasConsoleMessageStorage(int contextGroupId); void discardInspectedContext(int contextGroupId, int contextId); void disconnect(V8InspectorSessionImpl*);