138399 2014-11-04 18:46:41 -0800 WebContent crash in WebPage::selectWithGesture() 2014-11-05 12:55:15 -0800 1 1 1 Unclassified WebKit WebKit Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 jhoneycutt jhoneycutt benjamin enrica oldest_to_newest 1046342 0 jhoneycutt 2014-11-04 18:46:41 -0800 There is a difficult-to-reproduce null dereference crash that can occur when WebPage::selectWithGesture() receives a “TapAndAHalf” gesture with state “Changed” when having never received a “TapAndAHalf” gesture with state “Began”. To reproduce: 1. Go to data:text/html,<input> 2. Continuously tap, and tap-press into the text field while simultaneously typing <rdar://problem/18550631> 1046343 1 240995 jhoneycutt 2014-11-04 18:49:12 -0800 Created attachment 240995 Patch 1046573 2 jhoneycutt 2014-11-05 12:55:15 -0800 Committed r175636: <http://trac.webkit.org/changeset/175636> 240995 2014-11-04 18:49:12 -0800 2014-11-05 08:50:34 -0800 Patch bug-138399-20141104184922.patch text/plain 1940 jhoneycutt U3VidmVyc2lvbiBSZXZpc2lvbjogMTc1Mzk4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXggNjZjMDU1YmEwYTk1NThh OGYxYzI5MzI3YzgxNGM0ZDlmYjY1ZjA5Ny4uMTU0MGQzYTNjNTY0N2ZmNTFkNTJkNWE3MjZiZTk4 NjE3MzJhNGY5MSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDE0LTExLTA0ICBKb24g SG9uZXljdXR0ICA8amhvbmV5Y3V0dEBhcHBsZS5jb20+CisKKyAgICAgICAgV2ViQ29udGVudCBj cmFzaCBpbiBXZWJQYWdlOjpzZWxlY3RXaXRoR2VzdHVyZSgpCisKKyAgICAgICAgPGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzgzOTk+CisgICAgICAgIDxyZGFyOi8v cHJvYmxlbS8xODU1MDYzMT4KKworICAgICAgICBUaGlzIGNyYXNoIG9jY3VycyB3aGVuIHRoZSB3 ZWIgcHJvY2VzcyByZWNlaXZlcyBhICJUYXBBbmRBSGFsZiIgZ2VzdHVyZQorICAgICAgICB3aXRo IHRoZSAiQ2hhbmdlZCIgc3RhdGUgd2l0aG91dCBoYXZpbmcgcmVjZWl2ZWQgYSAiVGFwQW5kQUhh bGYiCisgICAgICAgIGdlc3R1cmUgd2l0aCB0aGUgIkJlZ2FuIiBzdGF0ZS4KKworICAgICAgICBO byB0ZXN0IHBvc3NpYmxlLgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgICogV2ViUHJvY2Vzcy9XZWJQYWdlL2lvcy9XZWJQYWdlSU9TLm1tOgorICAgICAg ICAoV2ViS2l0OjpXZWJQYWdlOjpzZWxlY3RXaXRoR2VzdHVyZSk6CisgICAgICAgIE51bGwgY2hl Y2sgbV9jdXJyZW50V29yZFJhbmdlIGJlZm9yZSBkZXJlZmVyZW5jaW5nIGl0LgorCiAyMDE0LTEw LTMwICBEYW5hIEJ1cmthcnQgIDxkYnVya2FydEBhcHBsZS5jb20+CiAKICAgICAgICAgV29ya2Fy b3VuZCBmb3IgPHJkYXI6Ly9wcm9ibGVtLzE4ODMwNjM5PgpkaWZmIC0tZ2l0IGEvU291cmNlL1dl YktpdDIvV2ViUHJvY2Vzcy9XZWJQYWdlL2lvcy9XZWJQYWdlSU9TLm1tIGIvU291cmNlL1dlYktp dDIvV2ViUHJvY2Vzcy9XZWJQYWdlL2lvcy9XZWJQYWdlSU9TLm1tCmluZGV4IDc1NTcxY2I5YTYx NTE1MjQyMWI0ZmRlZGIzMjA5ZjNhYTc1NGYzMmQuLjhlZDA4ZGU3Y2U5ZGRjYzMzZDNmYmU0Yjhk MTM3MGVhMTk3YTk4YmYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2Vi UGFnZS9pb3MvV2ViUGFnZUlPUy5tbQorKysgYi9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1dl YlBhZ2UvaW9zL1dlYlBhZ2VJT1MubW0KQEAgLTg5Myw2ICs4OTMsOCBAQCB2b2lkIFdlYlBhZ2U6 OnNlbGVjdFdpdGhHZXN0dXJlKGNvbnN0IEludFBvaW50JiBwb2ludCwgdWludDMyX3QgZ3JhbnVs YXJpdHksIHVpbgogICAgICAgICAgICAgbV9jdXJyZW50V29yZFJhbmdlID0gUmFuZ2U6OmNyZWF0 ZSgqZnJhbWUuZG9jdW1lbnQoKSwgcmFuZ2UtPnN0YXJ0UG9zaXRpb24oKSwgcmFuZ2UtPmVuZFBv c2l0aW9uKCkpOwogICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgIGNhc2UgR2VzdHVyZVJlY29n bml6ZXJTdGF0ZTo6Q2hhbmdlZDoKKyAgICAgICAgICAgIGlmICghbV9jdXJyZW50V29yZFJhbmdl KQorICAgICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgcmFuZ2UgPSBSYW5nZTo6Y3Jl YXRlKCpmcmFtZS5kb2N1bWVudCgpLCBtX2N1cnJlbnRXb3JkUmFuZ2UtPnN0YXJ0UG9zaXRpb24o KSwgbV9jdXJyZW50V29yZFJhbmdlLT5lbmRQb3NpdGlvbigpKTsKICAgICAgICAgICAgIGlmIChw b3NpdGlvbiA8IHJhbmdlLT5zdGFydFBvc2l0aW9uKCkpCiAgICAgICAgICAgICAgICAgcmFuZ2Ut PnNldFN0YXJ0KHBvc2l0aW9uLmRlZXBFcXVpdmFsZW50KCksIEFTU0VSVF9OT19FWENFUFRJT04p Owo=