107146 2013-01-17 11:14:49 -0800 IndexedDB: Prevent crash dereferencing null if script context has stopped 2013-01-18 11:22:02 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 107050 1 jsbell jsbell alecflett dgrogan tony webkit.review.bot oldest_to_newest 809528 0 jsbell 2013-01-17 11:14:49 -0800 IndexedDB: Prevent crash dereferencing null if script context has stopped 809540 1 183227 jsbell 2013-01-17 11:24:23 -0800 Created attachment 183227 Patch 809543 2 jsbell 2013-01-17 11:28:01 -0800 For more context, see: https://code.google.com/p/chromium/issues/detail?id=168503 https://bugs.webkit.org/show_bug.cgi?id=107050 Since the patch in 107050 didn't prevent the issue it's (probably) not a null context coming in during IDBRequest creation. Therefore the context must be getting cleared later, either by corruption or a call to stop(). Detect the latter and avoid the deference. If this works we can merge this to earlier branches and track down the root cause. 809558 3 183227 tony 2013-01-17 11:36:55 -0800 Comment on attachment 183227 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=183227&action=review OK > Source/WebCore/Modules/indexeddb/IDBRequest.cpp:443 > + // FIXME: This method not be called if stop() was previously called, but This method *should* not ... 809561 4 183227 tony 2013-01-17 11:38:15 -0800 Comment on attachment 183227 Patch Another tactic is to use CRASH() to assert conditions in releases. People have done this in the past to track down unknown crashers. 809566 5 183232 jsbell 2013-01-17 11:43:44 -0800 Created attachment 183232 Patch for landing 809568 6 jsbell 2013-01-17 11:44:59 -0800 (In reply to comment #3) > > Source/WebCore/Modules/indexeddb/IDBRequest.cpp:443 > > + // FIXME: This method not be called if stop() was previously called, but > > This method *should* not ... Fixed. (In reply to comment #4) > (From update of attachment 183227 [details]) > Another tactic is to use CRASH() to assert conditions in releases. People have done this in the past to track down unknown crashers. Good to know - may end up using that as this investigation continues. 809641 7 183232 webkit.review.bot 2013-01-17 12:39:22 -0800 Comment on attachment 183232 Patch for landing Clearing flags on attachment: 183232 Committed r140027: <http://trac.webkit.org/changeset/140027> 809642 8 webkit.review.bot 2013-01-17 12:39:25 -0800 All reviewed patches have been landed. Closing bug. 810868 9 jsbell 2013-01-18 11:22:02 -0800 Good news - this appears to have worked. Now we just need to figure out *why*. 183227 2013-01-17 11:24:23 -0800 2013-01-17 11:43:42 -0800 Patch bug-107146-20130117112123.patch text/plain 2403 jsbell U3VidmVyc2lvbiBSZXZpc2lvbjogMTM5OTUwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjZiYTQyMjQ5ZDU1MDlk NjNkOGU1YTI5N2M0ZTA4M2U4Y2NiNjBjYi4uZTRmMmE2MzYxYTYzNThkODJkY2ZlZTNhMTYxNmY5 ZTZiZWNhOTY5NSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDEzLTAxLTE3ICBKb3No dWEgQmVsbCAgPGpzYmVsbEBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgSW5kZXhlZERCOiBQcmV2 ZW50IGNyYXNoIGRlcmVmZXJlbmNpbmcgbnVsbCBpZiBzY3JpcHQgY29udGV4dCBoYXMgc3RvcHBl ZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTA3MTQ2 CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2UgaGF2 ZSBjcmFzaCByZXBvcnRzIGZyb20gQ2hyb21pdW0gdXNlcnMgKGJ1dCBubyBsb2NhbCByZXBybykg Zm9yIGEgY3Jhc2ggY29taW5nCisgICAgICAgIGZyb20gSURCUmVxdWVzdDo6ZGlzcGF0Y2hFdmVu dCgpIHRoYXQgbG9va3MgbGlrZSBpdCdzIGNhbGxpbmcgdG9WOENvbnRleHQoKSBhZnRlcgorICAg ICAgICB0aGUgc2NyaXB0IGV4ZWN1dGlvbiBjb250ZXh0IGhhcyBzdG9wcGVkLiBUaGUgZGlzcGF0 Y2ggc2hvdWxkbid0IGJlIG9jY3VycmluZworICAgICAgICBhbmQgd2UgQVNTRVJUIGFzIHN1Y2gs IGJ1dCBzb21ldGhpbmcgd2VpcmQgaXMgZ29pbmcgb24gZHVyaW5nIFdvcmtlciB0ZWFyIGRvd24u CisgICAgICAgIElmIHRoaXMgcGF0Y2ggcHJldmVudHMgdGhlIGNyYXNoIGl0IHdvdWxkIGluZGlj YXRlIHRoYXQgc3RvcCgpIGlzIGNhbGxlZCBiZWZvcmUKKyAgICAgICAgZGlzcGF0Y2hFdmVudCgp IHdoaWNoIHNob3VsZG4ndCBiZSBoYXBwZW5pbmcsIGFuZCB3b3VsZCBsZXQgdXMgY29udGludWUg Y2hhc2luZworICAgICAgICB0aGUgaXNzdWUuCisKKyAgICAgICAgTm8gbmV3IHRlc3RzIC0gdGhp cyBzaG91bGRuJ3QgYmUgaGFwcGVuaW5nLgorCisgICAgICAgICogTW9kdWxlcy9pbmRleGVkZGIv SURCUmVxdWVzdC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpJREJSZXF1ZXN0OjpkaXNwYXRjaEV2 ZW50KToKKwogMjAxMy0wMS0xNiAgQWRhbSBCYXJ0aCAgPGFiYXJ0aEB3ZWJraXQub3JnPgogCiAg ICAgICAgIEludHJvZHVjZSBCYWNrZ3JvdW5kSFRNTFBhcnNlciBmb3IgcGFyc2luZyBIVE1MIG9u IGEgYmFja2dyb3VuZCB0aHJlYWQKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMv aW5kZXhlZGRiL0lEQlJlcXVlc3QuY3BwIGIvU291cmNlL1dlYkNvcmUvTW9kdWxlcy9pbmRleGVk ZGIvSURCUmVxdWVzdC5jcHAKaW5kZXggNTBhOTk1ODhmNmJlMTg5Y2I5ZjU1ZDIzZTA5MjI2YmFj YjA0ZTZmMC4uNmRmMzY3OGE5Yzk0ZjlmNDNiZWQwYmM2N2ZjYTg0OGE5YmZiNTc5MSAxMDA2NDQK LS0tIGEvU291cmNlL1dlYkNvcmUvTW9kdWxlcy9pbmRleGVkZGIvSURCUmVxdWVzdC5jcHAKKysr IGIvU291cmNlL1dlYkNvcmUvTW9kdWxlcy9pbmRleGVkZGIvSURCUmVxdWVzdC5jcHAKQEAgLTQ0 MCw2ICs0NDAsMTMgQEAgYm9vbCBJREJSZXF1ZXN0OjpkaXNwYXRjaEV2ZW50KFBhc3NSZWZQdHI8 RXZlbnQ+IGV2ZW50KQogICAgIEFTU0VSVChldmVudC0+dGFyZ2V0KCkgPT0gdGhpcyk7CiAgICAg QVNTRVJUX1dJVEhfTUVTU0FHRShtX3JlYWR5U3RhdGUgPCBET05FLCAiV2hlbiBkaXNwYXRjaGlu ZyBldmVudCAlcywgbV9yZWFkeVN0YXRlIDwgRE9ORSglZCksIHdhcyAlZCIsIGV2ZW50LT50eXBl KCkuc3RyaW5nKCkudXRmOCgpLmRhdGEoKSwgRE9ORSwgbV9yZWFkeVN0YXRlKTsKIAorICAgIC8v IEZJWE1FOiBUaGlzIG1ldGhvZCBub3QgYmUgY2FsbGVkIGlmIHN0b3AoKSB3YXMgcHJldmlvdXNs eSBjYWxsZWQsIGJ1dAorICAgIC8vIHRoZXJlIGFyZSBjcmFzaCByZXBvcnRzIChubyBsb2NhbCBy ZXBybykgaW5kaWNhdGluZyBhIG51bGwgcG9pbnRlcgorICAgIC8vIGRlZmVyZW5jZSBpbiB0aGUg Zm9sbG93aW5nIERPTVJlcXVlc3RTdGF0ZTo6U2NvcGUgY29uc3RydWN0b3IuIElmIHRoaXMKKyAg ICAvLyByZXNvbHZlcyB0aGUgY3Jhc2hlcywgdHJhY2sgZG93biB0aGUgcm9vdCBjYXVzZSwgb3Ro ZXJ3aXNlIGJhY2sgdGhpcyBvdXQuCisgICAgaWYgKG1fY29udGV4dFN0b3BwZWQpCisgICAgICAg IHJldHVybiBmYWxzZTsKKwogICAgIERPTVJlcXVlc3RTdGF0ZTo6U2NvcGUgc2NvcGUobV9yZXF1 ZXN0U3RhdGUpOwogCiAgICAgaWYgKGV2ZW50LT50eXBlKCkgIT0gZXZlbnROYW1lcygpLmJsb2Nr ZWRFdmVudCkK 183232 2013-01-17 11:43:44 -0800 2013-01-17 12:39:22 -0800 Patch for landing bug-107146-20130117114044.patch text/plain 2406 jsbell U3VidmVyc2lvbiBSZXZpc2lvbjogMTM5OTUwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjZiYTQyMjQ5ZDU1MDlk NjNkOGU1YTI5N2M0ZTA4M2U4Y2NiNjBjYi4uZGY4NzhjMzg5Y2IwN2Y0ZGRkZWFkYmFlYWExM2M0 N2I0NDk1NDM5YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDEzLTAxLTE3ICBKb3No dWEgQmVsbCAgPGpzYmVsbEBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgSW5kZXhlZERCOiBQcmV2 ZW50IGNyYXNoIGRlcmVmZXJlbmNpbmcgbnVsbCBpZiBzY3JpcHQgY29udGV4dCBoYXMgc3RvcHBl ZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTA3MTQ2 CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgVG9ueSBDaGFuZy4KKworICAgICAgICBXZSBoYXZlIGNy YXNoIHJlcG9ydHMgZnJvbSBDaHJvbWl1bSB1c2VycyAoYnV0IG5vIGxvY2FsIHJlcHJvKSBmb3Ig YSBjcmFzaCBjb21pbmcKKyAgICAgICAgZnJvbSBJREJSZXF1ZXN0OjpkaXNwYXRjaEV2ZW50KCkg dGhhdCBsb29rcyBsaWtlIGl0J3MgY2FsbGluZyB0b1Y4Q29udGV4dCgpIGFmdGVyCisgICAgICAg IHRoZSBzY3JpcHQgZXhlY3V0aW9uIGNvbnRleHQgaGFzIHN0b3BwZWQuIFRoZSBkaXNwYXRjaCBz aG91bGRuJ3QgYmUgb2NjdXJyaW5nCisgICAgICAgIGFuZCB3ZSBBU1NFUlQgYXMgc3VjaCwgYnV0 IHNvbWV0aGluZyB3ZWlyZCBpcyBnb2luZyBvbiBkdXJpbmcgV29ya2VyIHRlYXIgZG93bi4KKyAg ICAgICAgSWYgdGhpcyBwYXRjaCBwcmV2ZW50cyB0aGUgY3Jhc2ggaXQgd291bGQgaW5kaWNhdGUg dGhhdCBzdG9wKCkgaXMgY2FsbGVkIGJlZm9yZQorICAgICAgICBkaXNwYXRjaEV2ZW50KCkgd2hp Y2ggc2hvdWxkbid0IGJlIGhhcHBlbmluZywgYW5kIHdvdWxkIGxldCB1cyBjb250aW51ZSBjaGFz aW5nCisgICAgICAgIHRoZSBpc3N1ZS4KKworICAgICAgICBObyBuZXcgdGVzdHMgLSB0aGlzIHNo b3VsZG4ndCBiZSBoYXBwZW5pbmcuCisKKyAgICAgICAgKiBNb2R1bGVzL2luZGV4ZWRkYi9JREJS ZXF1ZXN0LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OklEQlJlcXVlc3Q6OmRpc3BhdGNoRXZlbnQp OgorCiAyMDEzLTAxLTE2ICBBZGFtIEJhcnRoICA8YWJhcnRoQHdlYmtpdC5vcmc+CiAKICAgICAg ICAgSW50cm9kdWNlIEJhY2tncm91bmRIVE1MUGFyc2VyIGZvciBwYXJzaW5nIEhUTUwgb24gYSBi YWNrZ3JvdW5kIHRocmVhZApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvTW9kdWxlcy9pbmRl eGVkZGIvSURCUmVxdWVzdC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL2luZGV4ZWRkYi9J REJSZXF1ZXN0LmNwcAppbmRleCA1MGE5OTU4OGY2YmUxODljYjlmNTVkMjNlMDkyMjZiYWNiMDRl NmYwLi5lMDlmMjQxZjY5YzY0NTM4NDhmMWE3ODdhYmJiZWI4MzY3NzNmMTk2IDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL2luZGV4ZWRkYi9JREJSZXF1ZXN0LmNwcAorKysgYi9T b3VyY2UvV2ViQ29yZS9Nb2R1bGVzL2luZGV4ZWRkYi9JREJSZXF1ZXN0LmNwcApAQCAtNDQwLDYg KzQ0MCwxMyBAQCBib29sIElEQlJlcXVlc3Q6OmRpc3BhdGNoRXZlbnQoUGFzc1JlZlB0cjxFdmVu dD4gZXZlbnQpCiAgICAgQVNTRVJUKGV2ZW50LT50YXJnZXQoKSA9PSB0aGlzKTsKICAgICBBU1NF UlRfV0lUSF9NRVNTQUdFKG1fcmVhZHlTdGF0ZSA8IERPTkUsICJXaGVuIGRpc3BhdGNoaW5nIGV2 ZW50ICVzLCBtX3JlYWR5U3RhdGUgPCBET05FKCVkKSwgd2FzICVkIiwgZXZlbnQtPnR5cGUoKS5z dHJpbmcoKS51dGY4KCkuZGF0YSgpLCBET05FLCBtX3JlYWR5U3RhdGUpOwogCisgICAgLy8gRklY TUU6IFRoaXMgbWV0aG9kIHNob3VsZCBub3QgYmUgY2FsbGVkIGlmIHN0b3AoKSB3YXMgcHJldmlv dXNseSBjYWxsZWQsCisgICAgLy8gYnV0IHRoZXJlIGFyZSBjcmFzaCByZXBvcnRzIChubyBsb2Nh bCByZXBybykgaW5kaWNhdGluZyBhIG51bGwgcG9pbnRlcgorICAgIC8vIGRlZmVyZW5jZSBpbiB0 aGUgZm9sbG93aW5nIERPTVJlcXVlc3RTdGF0ZTo6U2NvcGUgY29uc3RydWN0b3IuIElmIHRoaXMK KyAgICAvLyByZXNvbHZlcyB0aGUgY3Jhc2hlcywgdHJhY2sgZG93biB0aGUgcm9vdCBjYXVzZSwg b3RoZXJ3aXNlIGJhY2sgdGhpcyBvdXQuCisgICAgaWYgKG1fY29udGV4dFN0b3BwZWQpCisgICAg ICAgIHJldHVybiBmYWxzZTsKKwogICAgIERPTVJlcXVlc3RTdGF0ZTo6U2NvcGUgc2NvcGUobV9y ZXF1ZXN0U3RhdGUpOwogCiAgICAgaWYgKGV2ZW50LT50eXBlKCkgIT0gZXZlbnROYW1lcygpLmJs b2NrZWRFdmVudCkK