119716 2013-08-12 20:09:16 -0700 Fix null dereference in HTMLAnchorElement::sendPings when frame is not attached to a page 2013-08-13 00:09:57 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED BlinkMergeCandidate, InRadar P2 Normal --- 1 rniwa rniwa ap commit-queue darin esprehn+autocc jonlee mjs thorton webkit-bug-importer oldest_to_newest 916503 0 rniwa 2013-08-12 20:09:16 -0700 Merge https://chromium.googlesource.com/chromium/blink/+/d5783da353ab783e9994b8fbecd91880be5192a1 916504 1 208588 rniwa 2013-08-12 20:10:49 -0700 Created attachment 208588 Fixes the bug 916525 2 208588 ap 2013-08-12 20:55:52 -0700 Comment on attachment 208588 Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=208588&action=review The Blink change is quite suspicious, and I'd like to understand it better. Do you know why the bug is hidden? > Source/WebCore/ChangeLog:10 > + No new tests since the test in the Blink change doesn't reproduce crash on WebKit. Does it reproduce the crash in Blink? The test does a ton of weird things, and I'm not sure how those result in a frameless document. Perhaps they perform a synchronous navigation? I suggest to look into making a new test. What if one creates a new frameless document (with document.implementation.createHTMLDocument or with a parser), adds an anchor element with a ping attribute, and calls click() on it? 916543 3 208588 darin 2013-08-12 22:23:57 -0700 Comment on attachment 208588 Fixes the bug I agree that we should make a new test, but I also think adding the null check is fine and I trust Ryosuke to make the test. 916546 4 208588 rniwa 2013-08-12 22:46:36 -0700 Comment on attachment 208588 Fixes the bug Let me try creating a test following ap's suggestion. 916547 5 208588 commit-queue 2013-08-12 22:47:25 -0700 Comment on attachment 208588 Fixes the bug Clearing flags on attachment: 208588 Committed r153975: <http://trac.webkit.org/changeset/153975> 916548 6 commit-queue 2013-08-12 22:47:28 -0700 All reviewed patches have been landed. Closing bug. 916550 7 darin 2013-08-12 22:52:06 -0700 Oops, the commit queue outraced you! Sorry!!! 916553 8 rniwa 2013-08-12 22:54:46 -0700 Huh, it seems like cq landed it anyway :( 916556 9 rniwa 2013-08-12 22:55:28 -0700 I DID come up with a test case so let me upload it here. 916568 10 208598 rniwa 2013-08-12 23:32:39 -0700 Created attachment 208598 Adds a test 916571 11 208599 rniwa 2013-08-12 23:34:58 -0700 Created attachment 208599 Adds a test with real -expected.txt 916574 12 rniwa 2013-08-12 23:37:41 -0700 Committed r153982: <http://trac.webkit.org/changeset/153982> 916575 13 webkit-bug-importer 2013-08-12 23:37:51 -0700 <rdar://problem/14721165> 916576 14 webkit-bug-importer 2013-08-12 23:37:55 -0700 <rdar://problem/14721167> 916590 15 rniwa 2013-08-13 00:09:57 -0700 Note that I've confirmed that the landed test case will cause a crash if we didn't have my patch. The reason I have to detach the frame in href is that HTMLAnchorElement::click has a check for the nullity of document()->frame() at the beginning. So I had to fool this code and detach the frame inside urlSelected. 208588 2013-08-12 20:10:49 -0700 2013-08-12 23:32:36 -0700 Fixes the bug fix119716 text/plain 1535 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE1Mzk3MSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSw1ICsxLDE5IEBACiAyMDEzLTA4LTEyICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgogCisgICAgICAgIEZpeCBOVUxMIGRlLXJlZmVybmNl IGluIEhUTUxBbmNob3JFbGVtZW50OjpzZW5kUGluZ3Mgd2hlbiBzZXR0aW5ncyBkb2Vzbid0IGV4 aXN0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTk3 MTYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBNZXJn ZSBodHRwczovL2Nocm9taXVtLmdvb2dsZXNvdXJjZS5jb20vY2hyb21pdW0vYmxpbmsvKy9kNTc4 M2RhMzUzYWI3ODNlOTk5NGI4ZmJlY2Q5MTg4MGJlNTE5MmExCisKKyAgICAgICAgTm8gbmV3IHRl c3RzIHNpbmNlIHRoZSB0ZXN0IGluIHRoZSBCbGluayBjaGFuZ2UgZG9lc24ndCByZXByb2R1Y2Ug Y3Jhc2ggb24gV2ViS2l0LgorCisgICAgICAgICogaHRtbC9IVE1MQW5jaG9yRWxlbWVudC5jcHA6 CisgICAgICAgIChXZWJDb3JlOjpIVE1MQW5jaG9yRWxlbWVudDo6c2VuZFBpbmdzKToKKworMjAx My0wOC0xMiAgUnlvc3VrZSBOaXdhICA8cm5pd2FAd2Via2l0Lm9yZz4KKwogICAgICAgICBFbmNh cHN1bGF0ZSBhY2Nlc3MgdG8gZG9jdW1lbnROYW1lZEl0ZW1NYXAgYW5kIHdpbmRvd05hbWVkSXRl bU1hcAogICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTE5 NzAxCiAKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTEFuY2hvckVsZW1lbnQuY3BwCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTEFuY2hvckVsZW1lbnQuY3BwCShy ZXZpc2lvbiAxNTM5NjgpCisrKyBTb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxBbmNob3JFbGVtZW50 LmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTEyLDcgKzUxMiw3IEBACiAKIHZvaWQgSFRNTEFuY2hv ckVsZW1lbnQ6OnNlbmRQaW5ncyhjb25zdCBLVVJMJiBkZXN0aW5hdGlvblVSTCkKIHsKLSAgICBp ZiAoIWhhc0F0dHJpYnV0ZShwaW5nQXR0cikgfHwgIWRvY3VtZW50KCktPnNldHRpbmdzKCktPmh5 cGVybGlua0F1ZGl0aW5nRW5hYmxlZCgpKQorICAgIGlmICghaGFzQXR0cmlidXRlKHBpbmdBdHRy KSB8fCAhZG9jdW1lbnQoKS0+c2V0dGluZ3MoKSB8fCAhZG9jdW1lbnQoKS0+c2V0dGluZ3MoKS0+ aHlwZXJsaW5rQXVkaXRpbmdFbmFibGVkKCkpCiAgICAgICAgIHJldHVybjsKIAogICAgIFNwYWNl U3BsaXRTdHJpbmcgcGluZ1VSTHMoZ2V0QXR0cmlidXRlKHBpbmdBdHRyKSwgZmFsc2UpOwo= 208598 2013-08-12 23:32:39 -0700 2013-08-12 23:34:56 -0700 Adds a test bug-119716-20130812233238.patch text/plain 2099 rniwa SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDE1Mzk4MSkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y a2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDEzLTA4LTEyICBSeW9zdWtlIE5pd2EgIDxy bml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIEZpeCBudWxsIGRlcmVmZXJlbmNlIGluIEhUTUxB bmNob3JFbGVtZW50OjpzZW5kUGluZ3Mgd2hlbiBmcmFtZSBpcyBub3QgYXR0YWNoZWQgdG8gYSBw YWdlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTk3 MTYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQg YSByZWdyZXNzaW9uIHRlc3QgZm9yIHIxNTM5NzUuCisKKyAgICAgICAgKiBmYXN0L2h0bWwvZGV0 YWNoLWZyYW1lLXdoaWxlLWNsaWNraW5nLW9uLWFuY2hvci13aXRoLXBpbmctZXhwZWN0ZWQudHh0 OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2h0bWwvZGV0YWNoLWZyYW1lLXdoaWxlLWNsaWNraW5n LW9uLWFuY2hvci13aXRoLXBpbmcuaHRtbDogQWRkZWQuCisKIDIwMTMtMDgtMTIgIFphbiBEb2Jl cnNlayAgPHpkb2JlcnNla0BpZ2FsaWEuY29tPgogCiAgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6 IHR5cGUoKSA9PSBQZXJjZW50IGluIFdlYkNvcmU6Okxlbmd0aDo6cGVyY2VudApJbmRleDogTGF5 b3V0VGVzdHMvZmFzdC9odG1sL2RldGFjaC1mcmFtZS13aGlsZS1jbGlja2luZy1vbi1hbmNob3It d2l0aC1waW5nLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09CkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0 L2h0bWwvZGV0YWNoLWZyYW1lLXdoaWxlLWNsaWNraW5nLW9uLWFuY2hvci13aXRoLXBpbmcuaHRt bAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2h0bWwvZGV0YWNoLWZyYW1lLXdoaWxl LWNsaWNraW5nLW9uLWFuY2hvci13aXRoLXBpbmcuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91 dFRlc3RzL2Zhc3QvaHRtbC9kZXRhY2gtZnJhbWUtd2hpbGUtY2xpY2tpbmctb24tYW5jaG9yLXdp dGgtcGluZy5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDI4IEBACis8IURPQ1RZUEUgaHRt bD4KKzxodG1sPgorPGJvZHk+Cis8cCBpZD0iZGVzY3JpcHRpb24iPlRoaXMgdGVzdHMgZGV0YWNo aW5nIGEgZnJhbWUgd2hpbGUgY2xpY2tpbmcgb24gYW4gYW5jaG9yIGVsZW1lbnQgd2l0aCBwaW5n IGF0dHJpYnV0ZSBpbiB0aGUgZnJhbWUuPGJyPgorV2ViS2l0IHNob3VsZCBub3QgY3Jhc2guPC9w PgorPHNjcmlwdD4KKworaWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgIHRlc3RSdW5uZXIuZHVt cEFzVGV4dCgpOworCit2YXIgaWZyYW1lID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnaWZyYW1l Jyk7Citkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGlmcmFtZSk7Cit2YXIgYW5jaG9yRWxlbWVu dCA9IGlmcmFtZS5jb250ZW50RG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnYScpOworYW5jaG9yRWxl bWVudC5zZXRBdHRyaWJ1dGUoJ2hyZWYnLCAnamF2YXNjcmlwdDpwYXJlbnQucmVtb3ZlKGV2ZW50 KTsnKTsKK2FuY2hvckVsZW1lbnQuc2V0QXR0cmlidXRlKCdwaW5nJywgJ2h0dHBzOi8vd2Via2l0 Lm9yZy8nKTsKK2lmcmFtZS5jb250ZW50RG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChhbmNob3JF bGVtZW50KTsKKworZnVuY3Rpb24gcmVtb3ZlKGV2ZW50KSB7CisgICAgaWZyYW1lLnBhcmVudE5v ZGUucmVtb3ZlQ2hpbGQoaWZyYW1lKTsKKyAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOworfQor CithbmNob3JFbGVtZW50LmNsaWNrKCk7Citkb2N1bWVudC53cml0ZSgnUEFTUy4gV2ViS2l0IGRp ZCBub3QgY3Jhc2guJyk7CisKKzwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgo= 208599 2013-08-12 23:34:58 -0700 2013-08-12 23:36:15 -0700 Adds a test with real -expected.txt bug-119716-20130812233457.patch text/plain 2472 rniwa SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDE1Mzk4MSkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y a2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDEzLTA4LTEyICBSeW9zdWtlIE5pd2EgIDxy bml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIEZpeCBudWxsIGRlcmVmZXJlbmNlIGluIEhUTUxB bmNob3JFbGVtZW50OjpzZW5kUGluZ3Mgd2hlbiBmcmFtZSBpcyBub3QgYXR0YWNoZWQgdG8gYSBw YWdlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTk3 MTYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQg YSByZWdyZXNzaW9uIHRlc3QgZm9yIHIxNTM5NzUuCisKKyAgICAgICAgKiBmYXN0L2h0bWwvZGV0 YWNoLWZyYW1lLXdoaWxlLWNsaWNraW5nLW9uLWFuY2hvci13aXRoLXBpbmctZXhwZWN0ZWQudHh0 OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2h0bWwvZGV0YWNoLWZyYW1lLXdoaWxlLWNsaWNraW5n LW9uLWFuY2hvci13aXRoLXBpbmcuaHRtbDogQWRkZWQuCisKIDIwMTMtMDgtMTIgIFphbiBEb2Jl cnNlayAgPHpkb2JlcnNla0BpZ2FsaWEuY29tPgogCiAgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6 IHR5cGUoKSA9PSBQZXJjZW50IGluIFdlYkNvcmU6Okxlbmd0aDo6cGVyY2VudApJbmRleDogTGF5 b3V0VGVzdHMvZmFzdC9odG1sL2RldGFjaC1mcmFtZS13aGlsZS1jbGlja2luZy1vbi1hbmNob3It d2l0aC1waW5nLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2h0 bWwvZGV0YWNoLWZyYW1lLXdoaWxlLWNsaWNraW5nLW9uLWFuY2hvci13aXRoLXBpbmctZXhwZWN0 ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9odG1sL2RldGFjaC1mcmFt ZS13aGlsZS1jbGlja2luZy1vbi1hbmNob3Itd2l0aC1waW5nLWV4cGVjdGVkLnR4dAkocmV2aXNp b24gMCkKQEAgLTAsMCArMSw0IEBACitUaGlzIHRlc3RzIGRldGFjaGluZyBhIGZyYW1lIHdoaWxl IGNsaWNraW5nIG9uIGFuIGFuY2hvciBlbGVtZW50IHdpdGggcGluZyBhdHRyaWJ1dGUgaW4gdGhl IGZyYW1lLgorV2ViS2l0IHNob3VsZCBub3QgY3Jhc2guCisKK1BBU1MuIFdlYktpdCBkaWQgbm90 IGNyYXNoLgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9odG1sL2RldGFjaC1mcmFtZS13aGlsZS1j bGlja2luZy1vbi1hbmNob3Itd2l0aC1waW5nLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVz dHMvZmFzdC9odG1sL2RldGFjaC1mcmFtZS13aGlsZS1jbGlja2luZy1vbi1hbmNob3Itd2l0aC1w aW5nLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2h0bWwvZGV0YWNoLWZy YW1lLXdoaWxlLWNsaWNraW5nLW9uLWFuY2hvci13aXRoLXBpbmcuaHRtbAkocmV2aXNpb24gMCkK QEAgLTAsMCArMSwyOCBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxib2R5PgorPHAgaWQ9 ImRlc2NyaXB0aW9uIj5UaGlzIHRlc3RzIGRldGFjaGluZyBhIGZyYW1lIHdoaWxlIGNsaWNraW5n IG9uIGFuIGFuY2hvciBlbGVtZW50IHdpdGggcGluZyBhdHRyaWJ1dGUgaW4gdGhlIGZyYW1lLjxi cj4KK1dlYktpdCBzaG91bGQgbm90IGNyYXNoLjwvcD4KKzxzY3JpcHQ+CisKK2lmICh3aW5kb3cu dGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKwordmFyIGlmcmFtZSA9 IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2lmcmFtZScpOworZG9jdW1lbnQuYm9keS5hcHBlbmRD aGlsZChpZnJhbWUpOwordmFyIGFuY2hvckVsZW1lbnQgPSBpZnJhbWUuY29udGVudERvY3VtZW50 LmNyZWF0ZUVsZW1lbnQoJ2EnKTsKK2FuY2hvckVsZW1lbnQuc2V0QXR0cmlidXRlKCdocmVmJywg J2phdmFzY3JpcHQ6cGFyZW50LnJlbW92ZShldmVudCk7Jyk7CithbmNob3JFbGVtZW50LnNldEF0 dHJpYnV0ZSgncGluZycsICdodHRwczovL3dlYmtpdC5vcmcvJyk7CitpZnJhbWUuY29udGVudERv Y3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYW5jaG9yRWxlbWVudCk7CisKK2Z1bmN0aW9uIHJlbW92 ZShldmVudCkgeworICAgIGlmcmFtZS5wYXJlbnROb2RlLnJlbW92ZUNoaWxkKGlmcmFtZSk7Cisg ICAgZXZlbnQucHJldmVudERlZmF1bHQoKTsKK30KKworYW5jaG9yRWxlbWVudC5jbGljaygpOwor ZG9jdW1lbnQud3JpdGUoJ1BBU1MuIFdlYktpdCBkaWQgbm90IGNyYXNoLicpOworCis8L3Njcmlw dD4KKzwvYm9keT4KKzwvaHRtbD4K