124769 2013-11-22 05:42:27 -0800 Null-pointer dereference in WebCore::CSSValue::isPrimitiveValue 2014-01-20 08:24:30 -0800 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 116980 1 rhodovan.u-szeged svillar betravis cfleizach commit-queue dino esprehn+autocc glenn gyuyoung.kim hyatt kling koivisto krit macpherson menard svillar oldest_to_newest 953514 0 217674 rhodovan.u-szeged 2013-11-22 05:42:27 -0800 Created attachment 217674 Test case You can make WebKit crash through CSSParser with the following style tag: <style> * { border-image-source:radial-gradient(ellipse at left left); } </style> Backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff0f5a7ca in WebCore::CSSValue::isPrimitiveValue (this=0x0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/CSSValue.h:66 66 bool isPrimitiveValue() const { return m_classType == PrimitiveClass; } (gdb) bt #0 0x00007ffff0f5a7ca in WebCore::CSSValue::isPrimitiveValue (this=0x0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/CSSValue.h:66 #1 0x00007ffff0fe04cc in WebCore::CSSParser::parseRadialGradient (this=0x7fffffffad50, valueList=0x1208d50, gradient=..., repeating=WebCore::NonRepeating) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/CSSParser.cpp:8310 #2 0x00007ffff0fe0d5c in WebCore::CSSParser::parseGeneratedImage (this=0x7fffffffad50, valueList=0x1208d50, value=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/CSSParser.cpp:8418 #3 0x00007ffff0fc7a85 in WebCore::CSSParser::parseValue (this=0x7fffffffad50, propId=WebCore::CSSPropertyBorderImageSource, important=false) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/CSSParser.cpp:2204 #4 0x00007ffff237a82f in cssyyparse (parser=0x7fffffffad50) at /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/CSSGrammar.y:1076 #5 0x00007ffff0fc24dd in WebCore::CSSParser::parseSheet (this=0x7fffffffad50, sheet=0x1198de0, string=..., startLineNumber=0, ruleSourceDataResult=0x0, logErrors=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/CSSParser.cpp:468 #6 0x00007ffff10e991f in WebCore::StyleSheetContents::parseStringAtLine (this=0x1198de0, sheetText=..., startLineNumber=0, createdByParser=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/StyleSheetContents.cpp:326 #7 0x00007ffff11aa01e in WebCore::InlineStyleSheetOwner::createSheet (this=0x944fc8, element=..., text=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/InlineStyleSheetOwner.cpp:147 #8 0x00007ffff11a9abe in WebCore::InlineStyleSheetOwner::createSheetFromTextContents (this=0x944fc8, element=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/InlineStyleSheetOwner.cpp:97 #9 0x00007ffff11a9a7b in WebCore::InlineStyleSheetOwner::finishParsingChildren (this=0x944fc8, element=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/InlineStyleSheetOwner.cpp:91 #10 0x00007ffff139056f in WebCore::HTMLStyleElement::finishParsingChildren (this=0x944f60) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/HTMLStyleElement.cpp:90 #11 0x00007ffff1427d22 in WebCore::HTMLElementStack::popCommon (this=0x108b338) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLElementStack.cpp:578 #12 0x00007ffff1426640 in WebCore::HTMLElementStack::pop (this=0x108b338) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLElementStack.cpp:214 #13 0x00007ffff144fbd0 in WebCore::HTMLTreeBuilder::processEndTag (this=0x108b300, token=0x7fffffffc200) ---Type <return> to continue, or q <return> to quit--- at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2195 #14 0x00007ffff1445faa in WebCore::HTMLTreeBuilder::processToken (this=0x108b300, token=0x7fffffffc200) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:381 #15 0x00007ffff1445dbc in WebCore::HTMLTreeBuilder::constructTree (this=0x108b300, token=0x7fffffffc200) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:349 #16 0x00007ffff1421208 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken (this=0x108b000, rawToken=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:586 #17 0x00007ffff1420e73 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x108b000, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:543 #18 0x00007ffff1420663 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x108b000, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:227 #19 0x00007ffff1421749 in WebCore::HTMLDocumentParser::append (this=0x108b000, inputSource=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:733 #20 0x00007ffff11248ee in WebCore::DecodedDataDocumentParser::flush (this=0x108b000, writer=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #21 0x00007ffff159abe5 in WebCore::DocumentWriter::end (this=0x117a260) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentWriter.cpp:242 #22 0x00007ffff1587cea in WebCore::DocumentLoader::finishedLoading (this=0x117a1c0, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:408 #23 0x00007ffff1587a58 in WebCore::DocumentLoader::notifyFinished (this=0x117a1c0, resource=0x11903e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:345 #24 0x00007ffff162181e in WebCore::CachedResource::checkNotify (this=0x11903e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:369 #25 0x00007ffff16218f8 in WebCore::CachedResource::finishLoading (this=0x11903e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:385 #26 0x00007ffff161e3fa in WebCore::CachedRawResource::finishLoading (this=0x11903e0, data=0x9236c0) ---Type <return> to continue, or q <return> to quit--- at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedRawResource.cpp:94 #27 0x00007ffff15dbc53 in WebCore::SubresourceLoader::didFinishLoading (this=0x1190950, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/SubresourceLoader.cpp:279 #28 0x00007ffff15d7f29 in WebCore::ResourceLoader::didFinishLoading (this=0x1190950, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/ResourceLoader.cpp:487 #29 0x00007ffff22dc0f2 in WebCore::readCallback (asyncResult=0x11959b0, data=0x1188d60) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1328 #30 0x00007fffe8521bc9 in async_ready_callback_wrapper (source_object=0x69e580, res=0x11959b0, user_data=0x1188d60) at ginputstream.c:530 #31 0x00007fffe8543ccb in g_task_return_now (task=0x11959b0) at gtask.c:1105 #32 complete_in_idle_cb (task=<optimized out>) at gtask.c:1114 #33 0x00007fffedc31473 in g_main_dispatch (context=0x11954a0) at gmain.c:3054 #34 g_main_context_dispatch (context=0x11954a0) at gmain.c:3630 #35 0x00007ffff7575aee in _ecore_glib_select__locked (ecore_timeout=0x11954a0, efds=<optimized out>, wfds=<optimized out>, rfds=<optimized out>, ecore_fds=1, ctx=<optimized out>) at ecore_glib.c:171 #36 _ecore_glib_select (ecore_fds=1, rfds=<optimized out>, wfds=<optimized out>, efds=<optimized out>, ecore_timeout=0x11954a0) at ecore_glib.c:205 #37 0x00007ffff756fcb9 in _ecore_main_select (timeout=<optimized out>) at ecore_main.c:1466 #38 0x00007ffff7570789 in _ecore_main_loop_iterate_internal (once_only=0) at ecore_main.c:1860 #39 0x00007ffff7570b47 in ecore_main_loop_begin () at ecore_main.c:956 #40 0x0000000000406dfa in main (argc=2, argv=0x7fffffffde68) at /home/reni/Data/REPOS/webkit_sec/Tools/EWebLauncher/main.c:1044 953616 1 217700 svillar 2013-11-22 10:40:50 -0800 Created attachment 217700 Patch 959201 2 rhodovan.u-szeged 2013-12-12 08:51:05 -0800 Seems legit. 969849 3 svillar 2014-01-20 08:24:30 -0800 Committed r162344: <http://trac.webkit.org/changeset/162344> 217674 2013-11-22 05:42:27 -0800 2013-11-22 05:42:27 -0800 Test case lastCrash.html text/html 83 rhodovan.u-szeged PHN0eWxlPgoqIHsKCWJvcmRlci1pbWFnZS1zb3VyY2U6cmFkaWFsLWdyYWRpZW50KGVsbGlwc2Ug IGF0IGxlZnQgbGVmdCk7Cn0KPC9zdHlsZT4= 217700 2013-11-22 10:40:50 -0800 2014-01-20 06:07:42 -0800 Patch bug-124769-20131122194049.patch text/plain 3993 svillar U3VidmVyc2lvbiBSZXZpc2lvbjogMTU5Njg1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDRjOTI4NTE1ODUwNDli Y2NlMzg3MzY0NzE1YTBlMjNhNTJiYTVjZS4uYmIwYzMyNzAwY2U5MDU3ZTJjZGI5OTVhNWZiOTlk MTkyYzlhMGQ5OSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDEzLTExLTIyICBTZXJn aW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgorCisgICAgICAgIE51bGwtcG9p bnRlciBkZXJlZmVyZW5jZSBpbiBXZWJDb3JlOjpDU1NWYWx1ZTo6aXNQcmltaXRpdmVWYWx1ZQor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTI0NzY5CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdDogZmFz dC9ncmFkaWVudHMvY3Jhc2gtb24tbm8tcG9zaXRpb24tc2VwYXJhdG9yLmh0bWwKKworICAgICAg ICBUaGUgZnVuY3Rpb24gcGFyc2VGaWxsUG9zaXRpb24oKSBtYXkgbm90IHJldHVybiB2YWxpZCB2 YWx1ZXMgZm9yCisgICAgICAgIGNlbnRlclggYW5kIGNlbnRlclkgaWYgdGhlIGlucHV0IGRhdGEg aXMgbWFsZm9ybWVkLiBXZSBuZWVkIHRvCisgICAgICAgIGNoZWNrIHRoYXQgd2UgZ2V0IGEgdmFs aWQgcGFpciBvZiBwb3NpdGlvbnMgYmVmb3JlIGNoZWNraW5nIHRoYXQKKyAgICAgICAgdGhleSdy ZSBhY3R1YWxseSB2YWxpZCBwcmltaXRpdmUgdmFsdWVzIGluIHRoZSBhc3NlcnRpb25zLgorCisg ICAgICAgICogY3NzL0NTU1BhcnNlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpDU1NQYXJzZXI6 OnBhcnNlUmFkaWFsR3JhZGllbnQpOgorCiAyMDEzLTExLTE4ICBTZXJnaW8gVmlsbGFyIFNlbmlu ICA8c3ZpbGxhckBpZ2FsaWEuY29tPgogCiAgICAgICAgIFtDU1MgR3JpZCBMYXlvdXRdIEltcHJv dmUgY29udGVudC1zaXplZCB0cmFjayBsYXlvdXQKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3Jl L2Nzcy9DU1NQYXJzZXIuY3BwIGIvU291cmNlL1dlYkNvcmUvY3NzL0NTU1BhcnNlci5jcHAKaW5k ZXggNGJhODZlZTcwYjM3NjU1ODU3ZDg4ZTVjNTU3OTI1ODI0MzcyM2QyMS4uYzIwOGU2MDMzOGYy ODZmOGRmNTEzMWMxMDNlMzZhOGYxYWY2YTk1ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUv Y3NzL0NTU1BhcnNlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvY3NzL0NTU1BhcnNlci5jcHAK QEAgLTgzMDcsMTQgKzgzMDcsMTUgQEAgYm9vbCBDU1NQYXJzZXI6OnBhcnNlUmFkaWFsR3JhZGll bnQoQ1NTUGFyc2VyVmFsdWVMaXN0KiB2YWx1ZUxpc3QsIFJlZlB0cjxDU1NWYWwKICAgICAgICAg ICAgIHJldHVybiBmYWxzZTsKIAogICAgICAgICBwYXJzZUZpbGxQb3NpdGlvbihhcmdzLCBjZW50 ZXJYLCBjZW50ZXJZKTsKLSAgICAgICAgQVNTRVJUKGNlbnRlclgtPmlzUHJpbWl0aXZlVmFsdWUo KSk7Ci0gICAgICAgIEFTU0VSVChjZW50ZXJZLT5pc1ByaW1pdGl2ZVZhbHVlKCkpOwogICAgICAg ICBpZiAoIShjZW50ZXJYICYmIGNlbnRlclkpKQogICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwog CiAgICAgICAgIGEgPSBhcmdzLT5jdXJyZW50KCk7CiAgICAgICAgIGlmICghYSkKICAgICAgICAg ICAgIHJldHVybiBmYWxzZTsKKworICAgICAgICBBU1NFUlQoY2VudGVyWC0+aXNQcmltaXRpdmVW YWx1ZSgpKTsKKyAgICAgICAgQVNTRVJUKGNlbnRlclktPmlzUHJpbWl0aXZlVmFsdWUoKSk7CiAg ICAgICAgIHJlc3VsdC0+c2V0Rmlyc3RYKHRvQ1NTUHJpbWl0aXZlVmFsdWUoY2VudGVyWC5nZXQo KSkpOwogICAgICAgICByZXN1bHQtPnNldEZpcnN0WSh0b0NTU1ByaW1pdGl2ZVZhbHVlKGNlbnRl clkuZ2V0KCkpKTsKICAgICAgICAgLy8gUmlnaHQgbm93LCBDU1MgcmFkaWFsIGdyYWRpZW50cyBo YXZlIHRoZSBzYW1lIHN0YXJ0IGFuZCBlbmQgY2VudGVycy4KZGlmZiAtLWdpdCBhL0xheW91dFRl c3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCA1MTMyMmUzZmY3YWQ2 ZmUzMWZmZjJhYzQ3YjBjMDkzMGI2NTNlZmU5Li43YTVmYWIwODk3MmVmZjE5Zjk2ODlkNjJhM2E3 MTRhZmQ5ZmIwOGQxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTMtMTEtMjIgIFNlcmdpbyBW aWxsYXIgU2VuaW4gIDxzdmlsbGFyQGlnYWxpYS5jb20+CisKKyAgICAgICAgTnVsbC1wb2ludGVy IGRlcmVmZXJlbmNlIGluIFdlYkNvcmU6OkNTU1ZhbHVlOjppc1ByaW1pdGl2ZVZhbHVlCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMjQ3NjkKKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDaGVja3MgdGhhdCBp bnZhbGlkIHBvc2l0aW9uIGRlY2xhcmF0aW9ucyAobGlrZSBza2lwaW5nIHRoZSBjb21tYQorICAg ICAgICBzZXBhcmF0b3IpIGRvIG5vdCBtYWtlIHRoZSBlbmdpbmUgY3Jhc2guCisKKyAgICAgICAg KiBmYXN0L2dyYWRpZW50cy9jcmFzaC1vbi1uby1wb3NpdGlvbi1zZXBhcmF0b3ItZXhwZWN0ZWQu dHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2dyYWRpZW50cy9jcmFzaC1vbi1uby1wb3NpdGlv bi1zZXBhcmF0b3IuaHRtbDogQWRkZWQuCisKIDIwMTMtMTEtMTggIFNlcmdpbyBWaWxsYXIgU2Vu aW4gIDxzdmlsbGFyQGlnYWxpYS5jb20+CiAKICAgICAgICAgW0NTUyBHcmlkIExheW91dF0gSW1w cm92ZSBjb250ZW50LXNpemVkIHRyYWNrIGxheW91dApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMv ZmFzdC9ncmFkaWVudHMvY3Jhc2gtb24tbm8tcG9zaXRpb24tc2VwYXJhdG9yLWV4cGVjdGVkLnR4 dCBiL0xheW91dFRlc3RzL2Zhc3QvZ3JhZGllbnRzL2NyYXNoLW9uLW5vLXBvc2l0aW9uLXNlcGFy YXRvci1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uYzZiZDNhNzQ2NDkwMTQyYThmMDY0Mzc2YjU1 MDliMmExNTJiODhiOAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZ3JhZGll bnRzL2NyYXNoLW9uLW5vLXBvc2l0aW9uLXNlcGFyYXRvci1leHBlY3RlZC50eHQKQEAgLTAsMCAr MSwzIEBACitMaW5lYXIgZ3JhZGllbnQgd2l0aCBubyBjb21tYSBiZXR3ZWVuIHBvc2l0aW9ucy4g Tm8gY3Jhc2ggbWVhbnMgU1VDQ0VTUy4KKworCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0 L2dyYWRpZW50cy9jcmFzaC1vbi1uby1wb3NpdGlvbi1zZXBhcmF0b3IuaHRtbCBiL0xheW91dFRl c3RzL2Zhc3QvZ3JhZGllbnRzL2NyYXNoLW9uLW5vLXBvc2l0aW9uLXNlcGFyYXRvci5odG1sCm5l dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAuLjI5MDM5NWU3MDhiYTVlOWRiNjFmNjZlMTZmYTY0YmM5ZGNmOGExOTYKLS0tIC9k ZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2dyYWRpZW50cy9jcmFzaC1vbi1uby1wb3Np dGlvbi1zZXBhcmF0b3IuaHRtbApAQCAtMCwwICsxLDEzIEBACis8IURPQ1RZUEUgaHRtbD4KKzxo dG1sPgorPGhlYWQ+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICB3aW5kb3cu dGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5PgorPGgx PkxpbmVhciBncmFkaWVudCB3aXRoIG5vIGNvbW1hIGJldHdlZW4gcG9zaXRpb25zLiBObyBjcmFz aCBtZWFucyBTVUNDRVNTLjwvaDE+Cis8YnV0dG9uIHN0eWxlPSJib3JkZXItaW1hZ2Utc291cmNl OiByYWRpYWwtZ3JhZGllbnQoZWxsaXBzZSBhdCBsZWZ0IGxlZnQpIj4KKzwvYm9keT4KKzwvaHRt bD4K