133064 2014-05-18 22:38:23 -0700 [Mac] Crash during scroll when latched 2014-05-18 22:51:03 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham ap bfulgham simon.fraser thorton webkit-bug-importer oldest_to_newest 1010148 0 bfulgham 2014-05-18 22:38:23 -0700 It's possible to be latched to a DOM element, then attempt a new scroll event where the hit test for the mouse event returns NULL for the target element. When this happens, the NULL element is dereferenced without a NULL check resulting in a crash. This patch corrects this mistake. 1010149 1 bfulgham 2014-05-18 22:39:00 -0700 <rdar://problem/16761067> 1010150 2 231676 bfulgham 2014-05-18 22:47:11 -0700 Created attachment 231676 Patch 1010151 3 bfulgham 2014-05-18 22:49:32 -0700 Wow, Simon. That was fast! 1010152 4 bfulgham 2014-05-18 22:51:03 -0700 Committed r169037: <http://trac.webkit.org/changeset/169037> 231676 2014-05-18 22:47:11 -0700 2014-05-18 22:48:42 -0700 Patch bug-133064-20140518224648.patch text/plain 1388 bfulgham SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE2OTAzNikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE0LTA1LTE4ICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIENyYXNoIGR1cmluZyBzY3Jv bGwgd2hlbiBsYXRjaGVkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xMzMwNjQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICAqIHBhZ2UvbWFjL0V2ZW50SGFuZGxlck1hYy5tbToKKyAgICAgICAgKFdlYkNvcmU6 OkV2ZW50SGFuZGxlcjo6cGxhdGZvcm1QcmVwYXJlRm9yV2hlZWxFdmVudHMpOiBQcmV2ZW50IGRl cmVmZXJlbmNlIG9mIE5VTEwKKyAgICAgICAgd2hlZWxFdmVudFRhcmdldCBhcmd1bWVudC4KKwog MjAxNC0wNS0xOCAgU3ZldGxhbmEgUmVkY2hlbmtvICA8cmVkY2hlbmtvQHlhbmRleC10ZWFtLnJ1 PgogCiAgICAgICAgIElucHV0IDo6c2VsZWN0aW9uIHBzZXVkbyBjbGFzcyBkb2VzIG5vdCB3b3Jr IGxlYWRpbmcgdG8gaGlkZGVuIHNlbGVjdGlvbgpJbmRleDogU291cmNlL1dlYkNvcmUvcGFnZS9t YWMvRXZlbnRIYW5kbGVyTWFjLm1tCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BhZ2Uv bWFjL0V2ZW50SGFuZGxlck1hYy5tbQkocmV2aXNpb24gMTY4ODQ4KQorKysgU291cmNlL1dlYkNv cmUvcGFnZS9tYWMvRXZlbnRIYW5kbGVyTWFjLm1tCSh3b3JraW5nIGNvcHkpCkBAIC04MDQsNyAr ODA0LDcgQEAgdm9pZCBFdmVudEhhbmRsZXI6OnBsYXRmb3JtUHJlcGFyZUZvcldoZQogICAgIH0K ICAgICAKICAgICBpZiAod2hlZWxFdmVudC5zaG91bGRDb25zaWRlckxhdGNoaW5nKCkpIHsKLSAg ICAgICAgaWYgKHNjcm9sbGFibGVBcmVhKQorICAgICAgICBpZiAoc2Nyb2xsYWJsZUFyZWEgJiYg c2Nyb2xsYWJsZUNvbnRhaW5lcikKICAgICAgICAgICAgIG1fc3RhcnRlZEdlc3R1cmVBdFNjcm9s bExpbWl0ID0gc2Nyb2xsZWRUb0VkZ2VJbkRvbWluYW50RGlyZWN0aW9uKCpzY3JvbGxhYmxlQ29u dGFpbmVyLCAqc2Nyb2xsYWJsZUFyZWEsIHdoZWVsRXZlbnQuZGVsdGFYKCksIHdoZWVsRXZlbnQu ZGVsdGFZKCkpOwogICAgICAgICBlbHNlCiAgICAgICAgICAgICBtX3N0YXJ0ZWRHZXN0dXJlQXRT Y3JvbGxMaW1pdCA9IGZhbHNlOwo=