120300 2013-08-26 05:25:52 -0700 AX:Null pointer may be dereferenced. 2022-02-27 23:17:22 -0800 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 0 l.gajowy l.gajowy aboxhall apinheiro cfleizach commit-queue dmazzoni g.czajkowski jdiggs k.czech mario webkit-bug-importer oldest_to_newest 920977 0 l.gajowy 2013-08-26 05:25:52 -0700 In function getOrCreate(Widget *widget) from AXObjectCache.cpp: null pointer 'newObj' that comes from line 325 may be dereferenced in method getAXID() and below this method. 920978 1 webkit-bug-importer 2013-08-26 05:26:24 -0700 <rdar://problem/14833466> 921123 2 cfleizach 2013-08-26 12:22:40 -0700 that would indicate that we're passing in a new Widget type. Certainly that should be protected and ASSERTED, but I don't think that is actually happening anywhere 921479 3 209761 l.gajowy 2013-08-27 06:18:11 -0700 Created attachment 209761 Patch 921553 4 209761 cfleizach 2013-08-27 08:57:30 -0700 Comment on attachment 209761 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=209761&action=review > Source/WebCore/accessibility/AXObjectCache.cpp:334 > + // Will crash later when widget type is other than FrameView or ScrollBar. This comment should read something like -- "Catch the case if an (unsupported) widget type is used. Only FrameView and ScrollBar are supported now." > Source/WebCore/accessibility/AXObjectCache.cpp:335 > + ASSERT(newObj); we should also do a if (!newObject) return; here the ASSERT will catch this problem in DEBUG, but not in release 921848 5 209849 l.gajowy 2013-08-27 23:31:21 -0700 Created attachment 209849 Patch #2 921849 6 209849 cfleizach 2013-08-27 23:34:03 -0700 Comment on attachment 209849 Patch #2 View in context: https://bugs.webkit.org/attachment.cgi?id=209849&action=review > Source/WebCore/accessibility/AXObjectCache.cpp:334 > + // Catch the case if an (unsupported) widget type is used. Only FrameView and ScrollBar are supported now. But we should still have the ASSERT. We want both assert and (!newObj) check. That way if it happens in DEBUG we'll know right away, but if it happens in release, no one will crash Thanks 921852 7 209850 l.gajowy 2013-08-27 23:44:27 -0700 Created attachment 209850 Patch #3 Sorry, I misread your review the last time. No it is the way you explained it. 921853 8 209850 cfleizach 2013-08-27 23:45:34 -0700 Comment on attachment 209850 Patch #3 thanks. looks good. let's make sure the EWS bots are good before committing 921857 9 209850 buildbot 2013-08-28 00:23:46 -0700 Comment on attachment 209850 Patch #3 Attachment 209850 did not pass win-ews (win): Output: http://webkit-queues.appspot.com/results/1605174 922142 10 209850 cfleizach 2013-08-28 12:15:13 -0700 Comment on attachment 209850 Patch #3 Windows build bot seems busted, so moving forward with this 922155 11 209850 commit-queue 2013-08-28 12:40:10 -0700 Comment on attachment 209850 Patch #3 Clearing flags on attachment: 209850 Committed r154767: <http://trac.webkit.org/changeset/154767> 922156 12 commit-queue 2013-08-28 12:40:12 -0700 All reviewed patches have been landed. Closing bug. 209761 2013-08-27 06:18:11 -0700 2022-02-27 23:17:13 -0800 Patch 0001-new-assertion-in-getOrCreate.patch text/plain 1797 l.gajowy RnJvbSA5N2NkODEyZWQxOWU2Y2YzNWRkZDA2NmRlNjM1MTRiY2VmYjQ2OWVlIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBMdWthc3ogR2Fqb3d5IDxsLmdham93eUBzYW1zdW5nLmNvbT4K RGF0ZTogVHVlLCAyNyBBdWcgMjAxMyAxNTowODo1NSArMDIwMApTdWJqZWN0OiBbUEFUQ0hdIG5l dyBhc3NlcnRpb24gaW4gZ2V0T3JDcmVhdGUKCkNoYW5nZS1JZDogSTdmMjFhMDJhN2UzYzljZWI2 NDQ1Y2RhMjM2NTZmZTBhM2Y5MDljZTQKLS0tCiBTb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgICAg ICAgICAgICAgICAgICAgICAgIHwgICAxMiArKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL2Fj Y2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHAgfCAgICA1ICsrKystCiAyIGZpbGVzIGNoYW5n ZWQsIDE2IGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKCmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNDVlNWNi NC4uMTZmZGRiNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDEzLTA4LTI3ICBMdWth c3ogR2Fqb3d5ICA8bC5nYWpvd3lAc2Ftc3VuZy5jb20+CisKKyAgICAgICAgQVg6TnVsbCBwb2lu dGVyIG1heSBiZSBkZXJlZmVyZW5jZWQuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xMjAzMDAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBBZGRlZCBhbiBhc3NlcnRpb24gaW4gb3JkZXIgdG8gYXZvaWQgZGVy ZWZlcmVjaW5nIG51bGwgcG9pbnRlci4KKworICAgICAgICAqIGFjY2Vzc2liaWxpdHkvQVhPYmpl Y3RDYWNoZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpBWE9iamVjdENhY2hlOjpnZXRPckNyZWF0 ZSk6CisKIDIwMTMtMDgtMjcgIEFsbGFuIFNhbmRmZWxkIEplbnNlbiAgPGFsbGFuLmplbnNlbkBk aWdpYS5jb20+CiAKICAgICAgICAgRm9udCdzIGZhc3QgY29kZSBwYXRoIGRvZXNuJ3QgaGFuZGxl IHBhcnRpYWwgcnVucyBjb3JyZWN0bHkgd2hlbiBrZXJuaW5nIG9yIGxpZ2F0dXJlcyBhcmUgZW5h YmxlZApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BWE9iamVjdENh Y2hlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHAK aW5kZXggZTQ1ZmZlMS4uN2EyMjJhMSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNz aWJpbGl0eS9BWE9iamVjdENhY2hlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmls aXR5L0FYT2JqZWN0Q2FjaGUuY3BwCkBAIC0zMzAsNyArMzMwLDEwIEBAIEFjY2Vzc2liaWxpdHlP YmplY3QqIEFYT2JqZWN0Q2FjaGU6OmdldE9yQ3JlYXRlKFdpZGdldCogd2lkZ2V0KQogCiAgICAg Ly8gV2lsbCBjcmFzaCBsYXRlciBpZiB3ZSBoYXZlIHR3byBvYmplY3RzIGZvciB0aGUgc2FtZSB3 aWRnZXQuCiAgICAgQVNTRVJUKCFnZXQod2lkZ2V0KSk7Ci0gICAgICAgIAorCisgICAgLy8gV2ls bCBjcmFzaCBsYXRlciB3aGVuIHdpZGdldCB0eXBlIGlzIG90aGVyIHRoYW4gRnJhbWVWaWV3IG9y IFNjcm9sbEJhci4KKyAgICBBU1NFUlQobmV3T2JqKTsKKwogICAgIGdldEFYSUQobmV3T2JqLmdl dCgpKTsKICAgICAKICAgICBtX3dpZGdldE9iamVjdE1hcHBpbmcuc2V0KHdpZGdldCwgbmV3T2Jq LT5heE9iamVjdElEKCkpOwotLSAKMS43LjkuNQoK 209849 2013-08-27 23:31:21 -0700 2022-02-27 23:17:22 -0800 Patch #2 0001-new-assertion-in-getOrCreate.patch text/plain 1863 l.gajowy RnJvbSA2NmZlMWZkMzA2MTgyNDdkMGUxY2ZjNmJmMTVkMjkwYjE3MDZmYWNhIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBMdWthc3ogR2Fqb3d5IDxsLmdham93eUBzYW1zdW5nLmNvbT4K RGF0ZTogVHVlLCAyNyBBdWcgMjAxMyAxNTowODo1NSArMDIwMApTdWJqZWN0OiBbUEFUQ0hdIG5l dyBhc3NlcnRpb24gaW4gZ2V0T3JDcmVhdGUKCkNoYW5nZS1JZDogSTdmMjFhMDJhN2UzYzljZWI2 NDQ1Y2RhMjM2NTZmZTBhM2Y5MDljZTQKLS0tCiBTb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgICAg ICAgICAgICAgICAgICAgICAgIHwgICAxMiArKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL2Fj Y2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHAgfCAgICA2ICsrKysrLQogMiBmaWxlcyBjaGFu Z2VkLCAxNyBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvU291cmNl L1dlYkNvcmUvQ2hhbmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IDQ1ZTVj YjQuLjdjYTYyZjUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9T b3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAxMy0wOC0yNyAgTHVr YXN6IEdham93eSAgPGwuZ2Fqb3d5QHNhbXN1bmcuY29tPgorCisgICAgICAgIEFYOk51bGwgcG9p bnRlciBtYXkgYmUgZGVyZWZlcmVuY2VkLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTIwMzAwCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgQWRkZWQgYSBjaGVjayBpZiBuZXdPYmogaXMgbm90IG51bGwgaW4g b3JkZXIgdG8gYXZvaWQgZGVyZWZlcmVjaW5nIG51bGwgcG9pbnRlci4KKworICAgICAgICAqIGFj Y2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpBWE9iamVj dENhY2hlOjpnZXRPckNyZWF0ZSk6CisKIDIwMTMtMDgtMjcgIEFsbGFuIFNhbmRmZWxkIEplbnNl biAgPGFsbGFuLmplbnNlbkBkaWdpYS5jb20+CiAKICAgICAgICAgRm9udCdzIGZhc3QgY29kZSBw YXRoIGRvZXNuJ3QgaGFuZGxlIHBhcnRpYWwgcnVucyBjb3JyZWN0bHkgd2hlbiBrZXJuaW5nIG9y IGxpZ2F0dXJlcyBhcmUgZW5hYmxlZApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNz aWJpbGl0eS9BWE9iamVjdENhY2hlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkv QVhPYmplY3RDYWNoZS5jcHAKaW5kZXggZTQ1ZmZlMS4uOWNiOTk5YSAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BWE9iamVjdENhY2hlLmNwcAorKysgYi9Tb3VyY2Uv V2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FYT2JqZWN0Q2FjaGUuY3BwCkBAIC0zMzAsNyArMzMwLDEx IEBAIEFjY2Vzc2liaWxpdHlPYmplY3QqIEFYT2JqZWN0Q2FjaGU6OmdldE9yQ3JlYXRlKFdpZGdl dCogd2lkZ2V0KQogCiAgICAgLy8gV2lsbCBjcmFzaCBsYXRlciBpZiB3ZSBoYXZlIHR3byBvYmpl Y3RzIGZvciB0aGUgc2FtZSB3aWRnZXQuCiAgICAgQVNTRVJUKCFnZXQod2lkZ2V0KSk7Ci0gICAg ICAgIAorCisgICAgLy8gQ2F0Y2ggdGhlIGNhc2UgaWYgYW4gKHVuc3VwcG9ydGVkKSB3aWRnZXQg dHlwZSBpcyB1c2VkLiBPbmx5IEZyYW1lVmlldyBhbmQgU2Nyb2xsQmFyIGFyZSBzdXBwb3J0ZWQg bm93LgorICAgIGlmICghbmV3T2JqKQorICAgICAgICByZXR1cm4gMDsKKwogICAgIGdldEFYSUQo bmV3T2JqLmdldCgpKTsKICAgICAKICAgICBtX3dpZGdldE9iamVjdE1hcHBpbmcuc2V0KHdpZGdl dCwgbmV3T2JqLT5heE9iamVjdElEKCkpOwotLSAKMS43LjkuNQoK 209850 2013-08-27 23:44:27 -0700 2013-08-28 12:40:10 -0700 Patch #3 0001-new-assertion-in-getOrCreate.patch text/plain 1899 l.gajowy RnJvbSAyMzRhZWJjZTBlM2FkMmYxZjUzYzRjNDVhZDczZDBhMzBmOTMzOWE4IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBMdWthc3ogR2Fqb3d5IDxsLmdham93eUBzYW1zdW5nLmNvbT4K RGF0ZTogVHVlLCAyNyBBdWcgMjAxMyAxNTowODo1NSArMDIwMApTdWJqZWN0OiBbUEFUQ0hdIG5l dyBhc3NlcnRpb24gaW4gZ2V0T3JDcmVhdGUKCkNoYW5nZS1JZDogSTdmMjFhMDJhN2UzYzljZWI2 NDQ1Y2RhMjM2NTZmZTBhM2Y5MDljZTQKLS0tCiBTb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgICAg ICAgICAgICAgICAgICAgICAgIHwgICAxMiArKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL2Fj Y2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHAgfCAgICA3ICsrKysrKy0KIDIgZmlsZXMgY2hh bmdlZCwgMTggaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQoKZGlmZiAtLWdpdCBhL1NvdXJj ZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA0NWU1 Y2I0Li44MWE4OTk0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIv U291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTMtMDgtMjcgIEx1 a2FzeiBHYWpvd3kgIDxsLmdham93eUBzYW1zdW5nLmNvbT4KKworICAgICAgICBBWDpOdWxsIHBv aW50ZXIgbWF5IGJlIGRlcmVmZXJlbmNlZC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTEyMDMwMAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEFkZGVkIGEgY2hlY2sgaWYgbmV3T2JqIGlzIG5vdCBudWxsIGFu ZCBhbiBhc3NlcnQgaW4gb3JkZXIgdG8gYXZvaWQgZGVyZWZlcmVjaW5nIG51bGwgcG9pbnRlci4K KworICAgICAgICAqIGFjY2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHA6CisgICAgICAgIChX ZWJDb3JlOjpBWE9iamVjdENhY2hlOjpnZXRPckNyZWF0ZSk6CisKIDIwMTMtMDgtMjcgIEFsbGFu IFNhbmRmZWxkIEplbnNlbiAgPGFsbGFuLmplbnNlbkBkaWdpYS5jb20+CiAKICAgICAgICAgRm9u dCdzIGZhc3QgY29kZSBwYXRoIGRvZXNuJ3QgaGFuZGxlIHBhcnRpYWwgcnVucyBjb3JyZWN0bHkg d2hlbiBrZXJuaW5nIG9yIGxpZ2F0dXJlcyBhcmUgZW5hYmxlZApkaWZmIC0tZ2l0IGEvU291cmNl L1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BWE9iamVjdENhY2hlLmNwcCBiL1NvdXJjZS9XZWJDb3Jl L2FjY2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHAKaW5kZXggZTQ1ZmZlMS4uZTBhMzQyNSAx MDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BWE9iamVjdENhY2hlLmNw cAorKysgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FYT2JqZWN0Q2FjaGUuY3BwCkBA IC0zMzAsNyArMzMwLDEyIEBAIEFjY2Vzc2liaWxpdHlPYmplY3QqIEFYT2JqZWN0Q2FjaGU6Omdl dE9yQ3JlYXRlKFdpZGdldCogd2lkZ2V0KQogCiAgICAgLy8gV2lsbCBjcmFzaCBsYXRlciBpZiB3 ZSBoYXZlIHR3byBvYmplY3RzIGZvciB0aGUgc2FtZSB3aWRnZXQuCiAgICAgQVNTRVJUKCFnZXQo d2lkZ2V0KSk7Ci0gICAgICAgIAorCisgICAgLy8gQ2F0Y2ggdGhlIGNhc2UgaWYgYW4gKHVuc3Vw cG9ydGVkKSB3aWRnZXQgdHlwZSBpcyB1c2VkLiBPbmx5IEZyYW1lVmlldyBhbmQgU2Nyb2xsQmFy IGFyZSBzdXBwb3J0ZWQgbm93LgorICAgIEFTU0VSVChuZXdPYmopOworICAgIGlmICghbmV3T2Jq KQorICAgICAgICByZXR1cm4gMDsKKwogICAgIGdldEFYSUQobmV3T2JqLmdldCgpKTsKICAgICAK ICAgICBtX3dpZGdldE9iamVjdE1hcHBpbmcuc2V0KHdpZGdldCwgbmV3T2JqLT5heE9iamVjdElE KCkpOwotLSAKMS43LjkuNQoK