109449 2013-02-11 09:11:57 -0800 ASSERTION FAILED: cellObject->isTableCell(), UNKNOWN in WebCore::AccessibilityTable::cellForColumnAndRow 2014-02-07 11:23:11 -0800 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) Unspecified Unspecified NEW InRadar P2 Normal --- 107699 1 inferno webkit-unassigned cfleizach commit-queue dmazzoni samuel_white webkit-bug-importer webkit.review.bot oldest_to_newest 829771 0 inferno 2013-02-11 09:11:57 -0800 Detailed report: https://cluster-fuzz.appspot.com/testcase?key=164768871 Fuzzer: Inferno_twister https://code.google.com/p/chromium/issues/detail?id=175303 Crash Type: UNKNOWN Crash Address: 0x0000bbadbeef Crash State: - crash stack - WebCore::AccessibilityTable::cellForColumnAndRow WebCore::AccessibilityTableColumn::addChildren WebCore::AccessibilityObject::children Regressed: https://cluster-fuzz.appspot.com/revisions?range=180459:181046 Minimized Testcase (0.47 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv94Hrj46qYWS0BoIqsv_6DoqbLeEuWK1V1YEovpVEq4EoWMudGbXvniBP6wdkYX0jl0edcDXCLgqTIuiXFwG2Q4XEI_HfAUz9EsZhNwTb9LmVJ5mO9ANCafqPcn-ZSKMEvQoRl3qIUJbTcCn3yrbF8CbkXO2_HT15waWgM6BiBlsTwOR5Ws <script> function buildAccessibilityTree(accessibilityObject) { var count = accessibilityObject.childrenCount; for (var i = 0; i < count; ++i) buildAccessibilityTree(accessibilityObject.childAtIndex(i)); } </script> >><table> <thead> <tbody style='rotation-code: "\"}\""; visibility: hidden; '><td><script> if (window.accessibilityController) { buildAccessibilityTree(accessibilityController.focusedElement); } </script> > 830589 1 187778 dmazzoni 2013-02-11 23:13:45 -0800 Created attachment 187778 Patch 830973 2 inferno 2013-02-12 08:38:35 -0800 Please note that you need to explicitly add these to security bugs for cq to work. commit-queue@webkit.org,webkit.review.bot@gmail.com. I am adding them now. 830975 3 187778 webkit.review.bot 2013-02-12 08:43:32 -0800 Comment on attachment 187778 Patch Rejecting attachment 187778 from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=gce-cq-03', 'apply-attachment', '--no-update', '--non-interactive', 187778, '--port=chromium-xvfb']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Last 500 characters of output: ILED -- saving rejects to file Source/WebCore/accessibility/AccessibilityTable.cpp.rej patching file LayoutTests/ChangeLog Hunk #1 succeeded at 1 with fuzz 3. patching file LayoutTests/accessibility/table-with-invisible-body-causes-crash-expected.txt patching file LayoutTests/accessibility/table-with-invisible-body-causes-crash.html Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Chris Fleizach']" exit_code: 1 cwd: /mnt/git/webkit-commit-queue Full output: http://queues.webkit.org/results/16483261 831272 4 inferno 2013-02-12 14:37:32 -0800 I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert. 831320 5 cfleizach 2013-02-12 15:14:12 -0800 (In reply to comment #4) > I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert. I think the object coming back is the right kind of class, but it returns false for isTableCell because its ignored. That might be wrong I don't have code in front of me. 831330 6 cfleizach 2013-02-12 15:20:31 -0800 (In reply to comment #5) > (In reply to comment #4) > > I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert. > > I think the object coming back is the right kind of class, but it returns false for isTableCell because its ignored. That might be wrong I don't have code in front of me. Yea that looks right, but I agree we could have another check in there just to feel safer 831332 7 inferno 2013-02-12 15:22:15 -0800 (In reply to comment #5) > (In reply to comment #4) > > I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert. > > I think the object coming back is the right kind of class, but it returns false for isTableCell because its ignored. That might be wrong I don't have code in front of me. We need confirmation on this. Since that determines whether it is a security bug or not :) 831334 8 cfleizach 2013-02-12 15:23:43 -0800 (In reply to comment #7) > (In reply to comment #5) > > (In reply to comment #4) > > > I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert. > > > > I think the object coming back is the right kind of class, but it returns false for isTableCell because its ignored. That might be wrong I don't have code in front of me. > > We need confirmation on this. Since that determines whether it is a security bug or not :) Yea not a security bug in this specific case. the object is still the right class. 831345 9 inferno 2013-02-12 15:28:32 -0800 (In reply to comment #8) > (In reply to comment #7) > > (In reply to comment #5) > > > (In reply to comment #4) > > > > I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert. > > > > > > I think the object coming back is the right kind of class, but it returns false for isTableCell because its ignored. That might be wrong I don't have code in front of me. > > > > We need confirmation on this. Since that determines whether it is a security bug or not :) > > Yea not a security bug in this specific case. the object is still the right class. Thanks a lot. fixed flags. In normal rendering land, we don't have this kind of confusion. You might want to fix more of these kind of asserts in accessibility where accessibilityIsIgnored makes sure but also not hide a bad cast bug. 831346 10 cfleizach 2013-02-12 15:29:04 -0800 (In reply to comment #9) > (In reply to comment #8) > > (In reply to comment #7) > > > (In reply to comment #5) > > > > (In reply to comment #4) > > > > > I don't understand this code change. We were thinking about this as a security vuln since return static_cast<AccessibilityTableCell*>(cellObject); could cause a bad cast if object is not of type AccessibilityTableCell. Your patch is just changing an assert. > > > > > > > > I think the object coming back is the right kind of class, but it returns false for isTableCell because its ignored. That might be wrong I don't have code in front of me. > > > > > > We need confirmation on this. Since that determines whether it is a security bug or not :) > > > > Yea not a security bug in this specific case. the object is still the right class. > > Thanks a lot. fixed flags. In normal rendering land, we don't have this kind of confusion. You might want to fix more of these kind of asserts in accessibility where accessibilityIsIgnored makes sure but also not hide a bad cast bug. Yea i agree, this section could be handled more cleanly 977932 11 webkit-bug-importer 2014-02-07 11:23:11 -0800 <rdar://problem/16013955> 187778 2013-02-11 23:13:45 -0800 2013-02-12 08:43:32 -0800 Patch bug-109449-20130212021015.patch text/plain 4157 dmazzoni U3VidmVyc2lvbiBSZXZpc2lvbjogMTQxNTc3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWU4NzljZDNhOGY4M2Vl MGRmZTM5OGJhMDc0ZTIwYzM3ODQyNDFlNC4uMzZkZWJiNjgyNzc5ODI3M2JjZDZkYzY1N2QxZjA2 OTRmNzM2ZjU0NiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDEzLTAyLTExICBEb21p bmljIE1henpvbmkgIDxkbWF6em9uaUBnb29nbGUuY29tPgorCisgICAgICAgIEFTU0VSVElPTiBG QUlMRUQ6IGNlbGxPYmplY3QtPmlzVGFibGVDZWxsKCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEwOTQ0OQorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBhc3NlcnRpb24gc28gdGhhdCBpdCBkb2Vzbid0 IGFzc2VydCBpbiBhIGxlZ2l0aW1hdGUgY2FzZSB3aGVuCisgICAgICAgIHRoZSBlbmQgcmVzdWx0 IGRvZXMgbm90IHJldHVybiB0cnVlIGZvciBpc1RhYmxlQ2VsbCgpLgorCisgICAgICAgIFRlc3Q6 IGFjY2Vzc2liaWxpdHkvdGFibGUtd2l0aC1pbnZpc2libGUtYm9keS1jYXVzZXMtY3Jhc2guaHRt bAorCisgICAgICAgICogYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5VGFibGUuY3BwOgorICAg ICAgICAoV2ViQ29yZTo6QWNjZXNzaWJpbGl0eVRhYmxlOjpjZWxsRm9yQ29sdW1uQW5kUm93KToK KwogMjAxMy0wMi0wMSAgS2VudGFybyBIYXJhICA8aGFyYWtlbkBjaHJvbWl1bS5vcmc+CiAKICAg ICAgICAgVW5yZXZpZXdlZCwgcm9sbGluZyBvdXQgcjE0MTU0OC4KZGlmZiAtLWdpdCBhL1NvdXJj ZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eVRhYmxlLmNwcCBiL1NvdXJjZS9X ZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eVRhYmxlLmNwcAppbmRleCA3YWY4OTYz OWZiMDkzNTQ1NzlhMTc5YzViMDMwN2MyNDJkMjMzMjAwLi4yNmI4YTEzYjg5OTc2YzgyMTQ5NjNj NzEzZTM3MjVhY2ZmNjg0NzI0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmls aXR5L0FjY2Vzc2liaWxpdHlUYWJsZS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJp bGl0eS9BY2Nlc3NpYmlsaXR5VGFibGUuY3BwCkBAIC01NzksNyArNTc5LDcgQEAgQWNjZXNzaWJp bGl0eVRhYmxlQ2VsbCogQWNjZXNzaWJpbGl0eVRhYmxlOjpjZWxsRm9yQ29sdW1uQW5kUm93KHVu c2lnbmVkIGNvbHVtbiwKICAgICAgICAgcmV0dXJuIDA7CiAgICAgCiAgICAgQWNjZXNzaWJpbGl0 eU9iamVjdCogY2VsbE9iamVjdCA9IGF4T2JqZWN0Q2FjaGUoKS0+Z2V0T3JDcmVhdGUoY2VsbCk7 Ci0gICAgQVNTRVJUKGNlbGxPYmplY3QtPmlzVGFibGVDZWxsKCkpOworICAgIEFTU0VSVChjZWxs T2JqZWN0LT5pc1RhYmxlQ2VsbCgpIHx8IGNlbGxPYmplY3QtPmFjY2Vzc2liaWxpdHlJc0lnbm9y ZWQoKSk7CiAgICAgCiAgICAgcmV0dXJuIHN0YXRpY19jYXN0PEFjY2Vzc2liaWxpdHlUYWJsZUNl bGwqPihjZWxsT2JqZWN0KTsKIH0KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBi L0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCAzMDY1MDgyNzIwZmI0YzZkMTY0MzNlZTA4YWU3 ZmEwZTFiNGVjZGIwLi41Y2ZlZmU2YjhiMDYwZTBlN2Q0M2EwMjNlNWJlZGM4YjUwNzc2MjBmIDEw MDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdl TG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTMtMDItMTEgIERvbWluaWMgTWF6em9uaSAgPGRtYXp6 b25pQGdvb2dsZS5jb20+CisKKyAgICAgICAgQVNTRVJUSU9OIEZBSUxFRDogY2VsbE9iamVjdC0+ aXNUYWJsZUNlbGwoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTA5NDQ5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgQWRkIHRlc3QgdG8gZW5zdXJlIGFuIGFzc2VydGlvbiBpc24ndCB0cmlnZ2VyZWQgd2hl bgorICAgICAgICBidWlsZGluZyB0aGUgYWNjZXNzaWJpbGl0eSB0cmVlIG9mIGEgdGFibGUgd2l0 aCBhbiBpbnZpc2libGUKKyAgICAgICAgYm9keS4KKworICAgICAgICAqIGFjY2Vzc2liaWxpdHkv dGFibGUtd2l0aC1pbnZpc2libGUtYm9keS1jYXVzZXMtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRl ZC4KKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L3RhYmxlLXdpdGgtaW52aXNpYmxlLWJvZHktY2F1 c2VzLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDEzLTAyLTAxICDDgWTDoW0gS2FsbGFpICA8a2Fk YW1AaW5mLnUtc3plZ2VkLmh1PgogCiAgICAgICAgIFtRdF0gVW5yZXZpZXdlZCBnYXJkZW5pbmcu IFNraXBwZWQgc29tZSBmYWlsaW5nIHRlc3RzLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvYWNj ZXNzaWJpbGl0eS90YWJsZS13aXRoLWludmlzaWJsZS1ib2R5LWNhdXNlcy1jcmFzaC1leHBlY3Rl ZC50eHQgYi9MYXlvdXRUZXN0cy9hY2Nlc3NpYmlsaXR5L3RhYmxlLXdpdGgtaW52aXNpYmxlLWJv ZHktY2F1c2VzLWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi43MzZlNjgxYmEzOWUzZjNm MjdhMjZhNzdkMjEyMTFiMTk2MTJjZGFmCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMv YWNjZXNzaWJpbGl0eS90YWJsZS13aXRoLWludmlzaWJsZS1ib2R5LWNhdXNlcy1jcmFzaC1leHBl Y3RlZC50eHQKQEAgLTAsMCArMSw5IEBACitUaGlzIHRlc3QgbWFrZXMgc3VyZSB0aGF0IGFuIGFz c2VydGlvbiBpc24ndCBmaXJlZCB3aGVuIGJ1aWxkaW5nIHRoZSBhY2Nlc3NpYmlsaXR5IHRyZWUg Zm9yIGEgdGFibGUgd2l0aCBhbiBpbnZpc2libGUgYm9keS4KKworT24gc3VjY2VzcywgeW91IHdp bGwgc2VlIGEgc2VyaWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93ZWQgYnkgIlRFU1QgQ09N UExFVEUiLgorCisKK1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01Q TEVURQorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9hY2Nlc3NpYmlsaXR5L3RhYmxlLXdpdGgt aW52aXNpYmxlLWJvZHktY2F1c2VzLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9hY2Nlc3NpYmls aXR5L3RhYmxlLXdpdGgtaW52aXNpYmxlLWJvZHktY2F1c2VzLWNyYXNoLmh0bWwKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MC4uYjViNjQ0MWM2NzI1YjRiY2ZhZjhmOWFjNDFmMDRjYzRlN2FhMGIxMQotLS0gL2Rldi9udWxs CisrKyBiL0xheW91dFRlc3RzL2FjY2Vzc2liaWxpdHkvdGFibGUtd2l0aC1pbnZpc2libGUtYm9k eS1jYXVzZXMtY3Jhc2guaHRtbApAQCAtMCwwICsxLDI1IEBACis8IURPQ1RZUEUgSFRNTD4KKzxo dG1sPgorPGJvZHk+Cis8c2NyaXB0IHNyYz0iLi4vZmFzdC9qcy9yZXNvdXJjZXMvanMtdGVzdC1w cmUuanMiPjwvc2NyaXB0PgorCis8dGFibGU+CisgICAgPHRoZWFkPjwvdGhlYWQ+CisgICAgPHRi b2R5IHN0eWxlPSJ2aXNpYmlsaXR5OmhpZGRlbiI+CisgICAgICAgIDx0ZD48L3RkPgorICAgIDwv dGJvZHk+Cis8L3RhYmxlPgorCis8ZGl2IGlkPSJjb25zb2xlIj48L2Rpdj4KKzxzY3JpcHQ+Citk ZXNjcmlwdGlvbigiVGhpcyB0ZXN0IG1ha2VzIHN1cmUgdGhhdCBhbiBhc3NlcnRpb24gaXNuJ3Qg ZmlyZWQgd2hlbiBidWlsZGluZyB0aGUgYWNjZXNzaWJpbGl0eSB0cmVlIGZvciBhIHRhYmxlIHdp dGggYW4gaW52aXNpYmxlIGJvZHkuIik7CisKK2lmICh3aW5kb3cudGVzdFJ1bm5lciAmJiB3aW5k b3cuYWNjZXNzaWJpbGl0eUNvbnRyb2xsZXIpIHsKKyAgICB3aW5kb3cudGVzdFJ1bm5lci5kdW1w QXNUZXh0KCk7CisgICAgYWNjZXNzaWJpbGl0eUNvbnRyb2xsZXIuYWNjZXNzaWJsZUVsZW1lbnRC eUlkKCdkdW1teScpOworfQorPC9zY3JpcHQ+CisKKzxzY3JpcHQgc3JjPSIuLi9mYXN0L2pzL3Jl c291cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgo=