138141 2014-10-28 11:39:22 -0700 ASSERT(!m_deletionHasBegun) in RefCounted.h should be ASSERT_WITH_SECURITY_IMPLICATION 2014-10-30 14:35:03 -0700 1 1 1 Unclassified WebKit Web Template Framework 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ayao jeffrey+webkit ap benjamin cmarcelo commit-queue jeffrey+webkit oldest_to_newest 1044564 0 ayao 2014-10-28 11:39:22 -0700 rdar://18798463 ASSERT(!m_deletionHasBegun) in RefCounted.h should be ASSERT_WITH_SECURITY_IMPLICATION There are several assertions in RefCounted.h like ASSERT(!m_deletionHasBegun); These assertions indicate that a use after free will occur. Marking them as ASSERT_WITH_SECURITY_IMPLICATION will help find more security bugs with fuzzing. I’d also propose changing #ifdef NDEBUG #define CHECK_REF_COUNTED_LIFECYCLE 0 #else #define CHECK_REF_COUNTED_LIFECYCLE 1 #endif to #ifdef NDEBUG && ! defined(ADDRESS_SANITIZER) so that release ASAN builds can get the benefit of the checking. 1044921 1 240641 jeffrey+webkit 2014-10-29 17:25:31 -0700 Created attachment 240641 Patch 1045130 2 240641 commit-queue 2014-10-30 14:35:00 -0700 Comment on attachment 240641 Patch Clearing flags on attachment: 240641 Committed r175382: <http://trac.webkit.org/changeset/175382> 1045131 3 commit-queue 2014-10-30 14:35:03 -0700 All reviewed patches have been landed. Closing bug. 240641 2014-10-29 17:25:31 -0700 2014-10-30 14:35:00 -0700 Patch bug-138141-20141029172539.patch text/plain 2258 jeffrey+webkit U3VidmVyc2lvbiBSZXZpc2lvbjogMTc1MzU4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IDY1ZGU2NTdkNTQ0Y2Y3MDdjZGE3NDU4 ZjQ5YjI4ZjQ4MWUyM2YyNGIuLmYzZDE2ODE0M2YzODE3OTQ1M2Q4NDRhYTYyNDU4ZjAxZGQ4NWJh MzMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTQtMTAtMjkgIEplZmZyZXkgUGZhdSAgPGpwZmF1 QGFwcGxlLmNvbT4KKworICAgICAgICBBU1NFUlQoIW1fZGVsZXRpb25IYXNCZWd1bikgaW4gUmVm Q291bnRlZC5oIHNob3VsZCBiZSBBU1NFUlRfV0lUSF9TRUNVUklUWV9JTVBMSUNBVElPTgorICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM4MTQxCisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB3dGYvUmVmQ291 bnRlZC5oOgorICAgICAgICAoV1RGOjpSZWZDb3VudGVkQmFzZTo6cmVmKToKKyAgICAgICAgKFdU Rjo6UmVmQ291bnRlZEJhc2U6OnJlbGF4QWRvcHRpb25SZXF1aXJlbWVudCk6CisgICAgICAgIChX VEY6OlJlZkNvdW50ZWRCYXNlOjpkZXJlZkJhc2UpOgorICAgICAgICAoV1RGOjphZG9wdGVkKToK KwogMjAxNC0xMC0yOCAgTWlsYW4gQ3JoYSAgPG1jcmhhQHJlZGhhdC5jb20+CiAKICAgICAgICAg VXNlIGNvbnN0YW50cyBmcm9tIHd0Zi9NYXRoRXh0cmFzLmgKZGlmZiAtLWdpdCBhL1NvdXJjZS9X VEYvd3RmL1JlZkNvdW50ZWQuaCBiL1NvdXJjZS9XVEYvd3RmL1JlZkNvdW50ZWQuaAppbmRleCAz YTE1YWNkZWVkMTU3NDgwNDM5NTFmYTcxYzJkMTY5NmI4ODc3ZDY0Li42MTFiYTVmZWU0Zjk5OGI0 ODdhYjJjMjY0NzBhZDIwNzQ2YjRiYjZhIDEwMDY0NAotLS0gYS9Tb3VyY2UvV1RGL3d0Zi9SZWZD b3VudGVkLmgKKysrIGIvU291cmNlL1dURi93dGYvUmVmQ291bnRlZC5oCkBAIC0yNyw3ICsyNyw3 IEBACiAKIG5hbWVzcGFjZSBXVEYgewogCi0jaWZkZWYgTkRFQlVHCisjaWYgZGVmaW5lZChOREVC VUcpICYmICFkZWZpbmVkKEFERFJFU1NfU0FOSVRJWkVSKQogI2RlZmluZSBDSEVDS19SRUZfQ09V TlRFRF9MSUZFQ1lDTEUgMAogI2Vsc2UKICNkZWZpbmUgQ0hFQ0tfUkVGX0NPVU5URURfTElGRUNZ Q0xFIDEKQEAgLTQxLDcgKzQxLDcgQEAgcHVibGljOgogICAgIHZvaWQgcmVmKCkKICAgICB7CiAj aWYgQ0hFQ0tfUkVGX0NPVU5URURfTElGRUNZQ0xFCi0gICAgICAgIEFTU0VSVCghbV9kZWxldGlv bkhhc0JlZ3VuKTsKKyAgICAgICAgQVNTRVJUX1dJVEhfU0VDVVJJVFlfSU1QTElDQVRJT04oIW1f ZGVsZXRpb25IYXNCZWd1bik7CiAgICAgICAgIEFTU0VSVCghbV9hZG9wdGlvbklzUmVxdWlyZWQp OwogI2VuZGlmCiAgICAgICAgICsrbV9yZWZDb3VudDsKQEAgLTYzLDcgKzYzLDcgQEAgcHVibGlj OgogICAgIHZvaWQgcmVsYXhBZG9wdGlvblJlcXVpcmVtZW50KCkKICAgICB7CiAjaWYgQ0hFQ0tf UkVGX0NPVU5URURfTElGRUNZQ0xFCi0gICAgICAgIEFTU0VSVCghbV9kZWxldGlvbkhhc0JlZ3Vu KTsKKyAgICAgICAgQVNTRVJUX1dJVEhfU0VDVVJJVFlfSU1QTElDQVRJT04oIW1fZGVsZXRpb25I YXNCZWd1bik7CiAgICAgICAgIEFTU0VSVChtX2Fkb3B0aW9uSXNSZXF1aXJlZCk7CiAgICAgICAg IG1fYWRvcHRpb25Jc1JlcXVpcmVkID0gZmFsc2U7CiAjZW5kaWYKQEAgLTkxLDcgKzkxLDcgQEAg cHJvdGVjdGVkOgogICAgIGJvb2wgZGVyZWZCYXNlKCkKICAgICB7CiAjaWYgQ0hFQ0tfUkVGX0NP VU5URURfTElGRUNZQ0xFCi0gICAgICAgIEFTU0VSVCghbV9kZWxldGlvbkhhc0JlZ3VuKTsKKyAg ICAgICAgQVNTRVJUX1dJVEhfU0VDVVJJVFlfSU1QTElDQVRJT04oIW1fZGVsZXRpb25IYXNCZWd1 bik7CiAgICAgICAgIEFTU0VSVCghbV9hZG9wdGlvbklzUmVxdWlyZWQpOwogI2VuZGlmCiAKQEAg LTEzMiw3ICsxMzIsNyBAQCBpbmxpbmUgdm9pZCBhZG9wdGVkKFJlZkNvdW50ZWRCYXNlKiBvYmpl Y3QpCiB7CiAgICAgaWYgKCFvYmplY3QpCiAgICAgICAgIHJldHVybjsKLSAgICBBU1NFUlQoIW9i amVjdC0+bV9kZWxldGlvbkhhc0JlZ3VuKTsKKyAgICBBU1NFUlRfV0lUSF9TRUNVUklUWV9JTVBM SUNBVElPTighb2JqZWN0LT5tX2RlbGV0aW9uSGFzQmVndW4pOwogICAgIG9iamVjdC0+bV9hZG9w dGlvbklzUmVxdWlyZWQgPSBmYWxzZTsKIH0KICNlbmRpZgo=