130900 2014-03-28 10:04:36 -0700 Null pointer crash in String::append(UChar). 2014-03-28 10:59:27 -0700 1 1 1 Unclassified WebKit Web Template Framework 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 peavo webkit-unassigned benjamin bfulgham cmarcelo commit-queue msaboff oldest_to_newest 995361 0 peavo 2014-03-28 10:04:36 -0700 A couple of days ago, I was getting many null pointer crashes in String::append(UChar). This can happen if the string is empty (m_impl member == 0), and it is called with a character value less than or equal to 0xff. In the first line of the method, the is8Bit() method will then be called, which accesses the m_impl member, which is null, causing a crash. This can be fixed by first checking if the m_impl member is null, in the same way as in the method String::append(LChar). 995368 1 228061 peavo 2014-03-28 10:11:06 -0700 Created attachment 228061 Patch 995373 2 228061 msaboff 2014-03-28 10:22:08 -0700 Comment on attachment 228061 Patch r=me 995375 3 peavo 2014-03-28 10:29:11 -0700 (In reply to comment #2) > (From update of attachment 228061 [details]) > r=me Thanks! 995393 4 228061 commit-queue 2014-03-28 10:59:23 -0700 Comment on attachment 228061 Patch Clearing flags on attachment: 228061 Committed r166414: <http://trac.webkit.org/changeset/166414> 995394 5 commit-queue 2014-03-28 10:59:27 -0700 All reviewed patches have been landed. Closing bug. 228061 2014-03-28 10:11:06 -0700 2014-03-28 10:59:23 -0700 Patch bug-130900-20140328181027.patch text/plain 1458 peavo SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAxNjY0MTEpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDE0LTAzLTI4ICBwZWF2b0BvdXRsb29rLmNvbSAg PHBlYXZvQG91dGxvb2suY29tPgorCisgICAgICAgIE51bGwgcG9pbnRlciBjcmFzaCBpbiBTdHJp bmc6OmFwcGVuZChVQ2hhcikuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD0xMzA5MDAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICAqIHd0Zi90ZXh0L1dURlN0cmluZy5jcHA6CisgICAgICAgIChXVEY6OlN0cmlu Zzo6YXBwZW5kKTogQ2hlY2sgYW5kIGluaXRpYWxpemUgbV9pbXBsIG1lbWJlciBmaXJzdCwgdG8g YXZvaWQgbnVsbCBwb2ludGVyIGNyYXNoLgorCiAyMDE0LTAzLTI3ICBDb21taXQgUXVldWUgIDxj b21taXQtcXVldWVAd2Via2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLCByb2xsaW5nIG91 dCByMTY2MzYwLgpJbmRleDogU291cmNlL1dURi93dGYvdGV4dC9XVEZTdHJpbmcuY3BwCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIFNvdXJjZS9XVEYvd3RmL3RleHQvV1RGU3RyaW5nLmNwcAkocmV2aXNpb24gMTY2 NDA2KQorKysgU291cmNlL1dURi93dGYvdGV4dC9XVEZTdHJpbmcuY3BwCSh3b3JraW5nIGNvcHkp CkBAIC0xNDMsMTQgKzE0MywxNCBAQCB2b2lkIFN0cmluZzo6YXBwZW5kKFVDaGFyIGNoYXJhY3Rl cikKIHsKICAgICAvLyBGSVhNRTogVGhpcyBpcyBleHRyZW1lbHkgaW5lZmZpY2llbnQuIFNvIG11 Y2ggc28gdGhhdCB3ZSBtaWdodCB3YW50IHRvIHRha2UgdGhpcyBvdXQgb2YgU3RyaW5nJ3MgQVBJ LgogCi0gICAgaWYgKGNoYXJhY3RlciA8PSAweEZGICYmIGlzOEJpdCgpKSB7Ci0gICAgICAgIGFw cGVuZChzdGF0aWNfY2FzdDxMQ2hhcj4oY2hhcmFjdGVyKSk7Ci0gICAgICAgIHJldHVybjsKLSAg ICB9CiAgICAgaWYgKCFtX2ltcGwpIHsKICAgICAgICAgbV9pbXBsID0gU3RyaW5nSW1wbDo6Y3Jl YXRlKCZjaGFyYWN0ZXIsIDEpOwogICAgICAgICByZXR1cm47CiAgICAgfQorICAgIGlmIChjaGFy YWN0ZXIgPD0gMHhGRiAmJiBpczhCaXQoKSkgeworICAgICAgICBhcHBlbmQoc3RhdGljX2Nhc3Q8 TENoYXI+KGNoYXJhY3RlcikpOworICAgICAgICByZXR1cm47CisgICAgfQogICAgIGlmIChtX2lt cGwtPmxlbmd0aCgpID49IHN0ZDo6bnVtZXJpY19saW1pdHM8dW5zaWduZWQ+OjptYXgoKSkKICAg ICAgICAgQ1JBU0goKTsKICAgICBVQ2hhciogZGF0YTsK