Tests that V8ConsoleMessageStorage::addMessage does not UAF when the context group is reset and re-populated during wrapArguments.
consoleAPICalled: reinsert
consoleAPICalled: E: outer
=================================================================
==2175==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ba1bede8558 at pc 0x5fd5a5c7736f bp 0x7b211b758f10 sp 0x7b211b758f08
READ of size 8 at 0x7ba1bede8558 thread T18 (Task Runner)
    #0 0x5fd5a5c7736e in v8_inspector::V8ConsoleMessageStorage::addMessage(std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessage>>) gen/third_party/libc++/src/include/deque:779:85
    #1 0x5fd5a5c85003 in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType, v8::MemorySpan<v8::Local<v8::Value> const>) v8/src/inspector/v8-console.cc:146:30
    #2 0x5fd5a5c8059e in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType) v8/src/inspector/v8-console.cc:81:5
    #3 0x5fd5a5c80e23 in v8_inspector::V8Console::Log(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&) v8/src/inspector/v8-console.cc:250:8
    #4 0x5fd5a2e8c556 in v8::internal::(anonymous namespace)::ConsoleCall(v8::internal::Isolate*, v8::internal::BuiltinArguments const&, void (v8::debug::ConsoleDelegate::*)(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&)) v8/src/builtins/builtins-console.cc:170:3
    #5 0x5fd5a2e89fc4 in v8::internal::Builtin_ConsoleLog(int, unsigned long*, v8::internal::Isolate*) v8/src/builtins/builtins-console.cc:209:36
    #6 0x5fd5a85453f5 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit crtstuff.c
    #7 0x5fd5a8493956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #8 0x5fd5a84906db in Builtins_JSEntryTrampoline crtstuff.c
    #9 0x5fd5a849042a in Builtins_JSEntry crtstuff.c
    #10 0x5fd5a312d521 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #11 0x5fd5a312fe82 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:575:10
    #12 0x5fd5a301aa53 in v8::internal::DebugEvaluate::Global(v8::internal::Isolate*, v8::internal::Handle<v8::internal::String>, v8::debug::EvaluateGlobalMode, v8::internal::REPLMode) v8/src/debug/debug-evaluate.cc:71:38
    #13 0x5fd5a3032ea5 in v8::debug::EvaluateGlobal(v8::Isolate*, v8::Local<v8::String>, v8::debug::EvaluateGlobalMode, bool) v8/src/debug/debug-interface.cc:1287:50
    #14 0x5fd5a5d3d985 in v8_inspector::V8RuntimeAgentImpl::evaluate(v8_inspector::String16 const&, std::__Cr::optional<v8_inspector::String16>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<int>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<double>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<v8_inspector::String16>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::SerializationOptions, std::__Cr::default_delete<v8_inspector::protocol::Runtime::SerializationOptions>>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::Backend::EvaluateCallback, std::__Cr::default_delete<v8_inspector::protocol::Runtime::Backend::EvaluateCallback>>) v8/src/inspector/v8-runtime-agent-impl.cc:416:24
    #15 0x5fd5a5c22f65 in v8_inspector::protocol::Runtime::DomainDispatcherImpl::evaluate(v8_crdtp::Dispatchable const&) gen/v8/src/inspector/protocol/Runtime.cpp:1032:16
    #16 0x5fd5a5d91640 in v8_crdtp::UberDispatcher::DispatchResult::Run() gen/third_party/libc++/src/include/__functional/function.h:502:12
    #17 0x5fd5a5d2b12f in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView) v8/src/inspector/v8-inspector-session-impl.cc:397:39
    #18 0x5fd5a2d4f8bb in v8::internal::InspectorIsolateData::SendMessage(int, v8_inspector::StringView const&) v8/test/inspector/isolate-data.cc:232:31
    #19 0x5fd5a2d44a83 in v8::internal::SendMessageToBackendTask::Run(v8::internal::InspectorIsolateData*) v8/test/inspector/tasks.h:38:11
    #20 0x5fd5a2d5b98c in v8::internal::TaskRunner::RunMessageLoop(bool) v8/test/inspector/task-runner.cc:80:11
    #21 0x5fd5a2d5b5dd in v8::internal::TaskRunner::Run() v8/test/inspector/task-runner.cc:66:3
    #22 0x5fd5a872e09d in v8::base::ThreadEntry(void*) v8/src/base/platform/platform-posix.cc:1307:11
    #23 0x5fd5a2cfcf16 in asan_thread_start(void*) asan_interceptors.cpp

0x7ba1bede8558 is located 56 bytes inside of 88-byte region [0x7ba1bede8520,0x7ba1bede8578)
freed by thread T18 (Task Runner) here:
    #0 0x5fd5a2d391a2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/inspector-test+0x14f21a2) (BuildId: b2fa6f82b191d8dc)
    #1 0x5fd5a5d23da4 in std::__Cr::__hash_table<std::__Cr::__hash_value_type<int, std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessageStorage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessageStorage>>>, std::__Cr::__unordered_map_hasher<int, std::__Cr::pair<int const, std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessageStorage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessageStorage>>>, std::__Cr::hash<int>, std::__Cr::equal_to<int>>, std::__Cr::__unordered_map_equal<int, std::__Cr::pair<int const, std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessageStorage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessageStorage>>>, std::__Cr::equal_to<int>, std::__Cr::hash<int>>, std::__Cr::allocator<std::__Cr::pair<int const, std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessageStorage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessageStorage>>>>>::erase(std::__Cr::__hash_const_iterator<std::__Cr::__hash_node<std::__Cr::__hash_value_type<int, std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessageStorage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessageStorage>>>, void*>*>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5fd5a5d16a57 in v8_inspector::V8InspectorImpl::resetContextGroup(int) gen/third_party/libc++/src/include/__hash_table:1931:3
    #3 0x5fd5a84956d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #4 0x5fd5a8493956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #5 0x5fd5a84906db in Builtins_JSEntryTrampoline crtstuff.c
    #6 0x5fd5a849042a in Builtins_JSEntry crtstuff.c
    #7 0x5fd5a312d521 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #8 0x5fd5a312be61 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:565:10
    #9 0x5fd5a3eb1fa4 in v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) v8/src/objects/objects.cc:1727:22
    #10 0x5fd5a3eafbb7 in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool) v8/src/objects/objects.cc:1345:16
    #11 0x5fd5a4307689 in v8::internal::Runtime::GetObjectProperty(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, bool*) v8/src/runtime/runtime-object.cc:42:38
    #12 0x5fd5a2d8a651 in v8::Object::Get(v8::Local<v8::Context>, v8::Local<v8::Value>) v8/src/api/api.cc:4800:7
    #13 0x5fd5a5d783ba in v8_inspector::(anonymous namespace)::getErrorProperty(v8::Local<v8::Context>, v8::Local<v8::Object>, v8::Local<v8::String>) v8/src/inspector/value-mirror.cc
    #14 0x5fd5a5d65bed in v8_inspector::(anonymous namespace)::descriptionForError(v8::Local<v8::Context>, v8::Local<v8::Object>) v8/src/inspector/value-mirror.cc:313:9
    #15 0x5fd5a5d62218 in v8_inspector::ValueMirror::create(v8::Local<v8::Context>, v8::Local<v8::Value>) v8/src/inspector/value-mirror.cc:1874:43
    #16 0x5fd5a5c409fd in v8_inspector::InjectedScript::wrapObject(v8::Local<v8::Value>, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:617:41
    #17 0x5fd5a5d2a3ac in v8_inspector::V8InspectorSessionImpl::wrapObject(v8::Local<v8::Context>, v8::Local<v8::Value>, v8_inspector::String16 const&, bool) v8/src/inspector/v8-inspector-session-impl.cc:324:19
    #18 0x5fd5a5c70d4a in v8_inspector::V8ConsoleMessage::wrapArguments(v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:300:20
    #19 0x5fd5a5c71d72 in v8_inspector::V8ConsoleMessage::reportToFrontend(v8_inspector::protocol::Runtime::Frontend*, v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:366:21
    #20 0x5fd5a5d4ddfe in v8_inspector::V8RuntimeAgentImpl::messageAdded(v8_inspector::V8ConsoleMessage*) v8/src/inspector/v8-runtime-agent-impl.cc:1206:12
    #21 0x5fd5a5d1576f in v8_inspector::V8InspectorImpl::forEachSession(int, std::__Cr::function<void (v8_inspector::V8InspectorSessionImpl*)> const&) gen/third_party/libc++/src/include/__functional/function.h:502:12
    #22 0x5fd5a5c76b42 in v8_inspector::V8ConsoleMessageStorage::addMessage(std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessage>>) v8/src/inspector/v8-console-message.cc:578:14
    #23 0x5fd5a5c85003 in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType, v8::MemorySpan<v8::Local<v8::Value> const>) v8/src/inspector/v8-console.cc:146:30
    #24 0x5fd5a5c8059e in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType) v8/src/inspector/v8-console.cc:81:5
    #25 0x5fd5a5c80e23 in v8_inspector::V8Console::Log(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&) v8/src/inspector/v8-console.cc:250:8
    #26 0x5fd5a2e8c556 in v8::internal::(anonymous namespace)::ConsoleCall(v8::internal::Isolate*, v8::internal::BuiltinArguments const&, void (v8::debug::ConsoleDelegate::*)(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&)) v8/src/builtins/builtins-console.cc:170:3
    #27 0x5fd5a2e89fc4 in v8::internal::Builtin_ConsoleLog(int, unsigned long*, v8::internal::Isolate*) v8/src/builtins/builtins-console.cc:209:36
    #28 0x5fd5a85453f5 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit crtstuff.c
    #29 0x5fd5a8493956 in Builtins_InterpreterEntryTrampoline crtstuff.c

previously allocated by thread T18 (Task Runner) here:
    #0 0x5fd5a2d3859d in operator new(unsigned long) (/chromium/chromium/src/out/asan/inspector-test+0x14f159d) (BuildId: b2fa6f82b191d8dc)
    #1 0x5fd5a5d1181a in v8_inspector::V8InspectorImpl::ensureConsoleMessageStorage(int) v8/src/inspector/v8-inspector-impl.cc:134:29
    #2 0x5fd5a5d4bf8f in v8_inspector::V8RuntimeAgentImpl::enable() v8/src/inspector/v8-runtime-agent-impl.cc:1113:20
    #3 0x5fd5a5c2264c in v8_inspector::protocol::Runtime::DomainDispatcherImpl::enable(v8_crdtp::Dispatchable const&) gen/v8/src/inspector/protocol/Runtime.cpp:943:44
    #4 0x5fd5a5d91640 in v8_crdtp::UberDispatcher::DispatchResult::Run() gen/third_party/libc++/src/include/__functional/function.h:502:12
    #5 0x5fd5a5d2b12f in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView) v8/src/inspector/v8-inspector-session-impl.cc:397:39
    #6 0x5fd5a2d4f8bb in v8::internal::InspectorIsolateData::SendMessage(int, v8_inspector::StringView const&) v8/test/inspector/isolate-data.cc:232:31
    #7 0x5fd5a2d44a83 in v8::internal::SendMessageToBackendTask::Run(v8::internal::InspectorIsolateData*) v8/test/inspector/tasks.h:38:11
    #8 0x5fd5a2d5b98c in v8::internal::TaskRunner::RunMessageLoop(bool) v8/test/inspector/task-runner.cc:80:11
    #9 0x5fd5a2d5b5dd in v8::internal::TaskRunner::Run() v8/test/inspector/task-runner.cc:66:3
    #10 0x5fd5a872e09d in v8::base::ThreadEntry(void*) v8/src/base/platform/platform-posix.cc:1307:11
    #11 0x5fd5a2cfcf16 in asan_thread_start(void*) asan_interceptors.cpp

Thread T18 (Task Runner) created by T0 here:
    #0 0x5fd5a2ce2d91 in pthread_create (/chromium/chromium/src/out/asan/inspector-test+0x149bd91) (BuildId: b2fa6f82b191d8dc)
    #1 0x5fd5a872dedb in v8::base::Thread::Start() v8/src/base/platform/platform-posix.cc:1339:14
    #2 0x5fd5a2d5af05 in v8::internal::TaskRunner::TaskRunner(std::__Cr::vector<std::__Cr::unique_ptr<v8::internal::InspectorIsolateData::SetupGlobalTask, std::__Cr::default_delete<v8::internal::InspectorIsolateData::SetupGlobalTask>>, std::__Cr::allocator<std::__Cr::unique_ptr<v8::internal::InspectorIsolateData::SetupGlobalTask, std::__Cr::default_delete<v8::internal::InspectorIsolateData::SetupGlobalTask>>>>, v8::internal::CatchExceptions, v8::base::Semaphore*, v8::StartupData*, v8::internal::WithInspector) v8/test/inspector/task-runner.cc:57:9
    #3 0x5fd5a2d3a6e3 in main v8/test/inspector/inspector-test.cc:917:16
    #4 0x7f21bfabe249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/deque:779:85 in v8_inspector::V8ConsoleMessageStorage::addMessage(std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessage>>)
Shadow bytes around the buggy address:
  0x7ba1bede8280: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7ba1bede8300: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7ba1bede8380: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7ba1bede8400: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7ba1bede8480: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
=>0x7ba1bede8500: fa fa fa fa fd fd fd fd fd fd fd[fd]fd fd fd fa
  0x7ba1bede8580: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7ba1bede8600: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x7ba1bede8680: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7ba1bede8700: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7ba1bede8780: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2175==ABORTING