139165 2014-12-01 17:32:23 -0800 Crash (integer overflow) beneath ByteCodeParser::handleGetById typing in search field on weather.com 2014-12-02 13:50:04 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 139195 1 msaboff msaboff kling oldest_to_newest 1051686 0 msaboff 2014-12-01 17:32:23 -0800 1. go to weather.com 2. in search type "Whistler" 3. wait for autocomplete of the site * RESULTS Crash Process: com.apple.WebKit.WebContent [663] Path: /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent Identifier: com.apple.WebKit.WebContent Version: 10601 (10601.1.9) Build Info: WebKit2-7601001008001000~3 Code Type: X86-64 (Native) Parent Process: ??? [1] Responsible: Safari [559] User ID: 501 Date/Time: 2014-11-12 22:14:57.550 -0800 OS Version: Mac OS X 10.10.3 (14D31a) Report Version: 11 Anonymous UUID: 14FD5266-B6CC-9BD8-7A5C-722B5CF5D3DE Time Awake Since Boot: 1900 seconds Crashed Thread: 14 DFG Worklist Worker Thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef ... Thread 14 Crashed:: DFG Worklist Worker Thread 0 com.apple.JavaScriptCore 0x00007fff93049c9e WTFCrash + 62 1 com.apple.JavaScriptCore 0x00007fff9305ee39 WTF::CrashOnOverflow::overflowed() + 9 2 com.apple.JavaScriptCore 0x00007fff92f42e3c JSC::DFG::ByteCodeParser::handleGetById(int, unsigned int, JSC::DFG::Node*, unsigned int, JSC::GetByIdStatus const&) + 1708 3 com.apple.JavaScriptCore 0x00007fff92f3dd42 JSC::DFG::ByteCodeParser::parseBlock(unsigned int) + 2290 4 com.apple.JavaScriptCore 0x00007fff92f3c12b JSC::DFG::ByteCodeParser::parseCodeBlock() + 1579 5 com.apple.JavaScriptCore 0x00007fff92f3b959 JSC::DFG::ByteCodeParser::parse() + 681 6 com.apple.JavaScriptCore 0x00007fff930c6361 JSC::DFG::parse(JSC::DFG::Graph&) + 433 7 com.apple.JavaScriptCore 0x00007fff9315e1e3 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 259 8 com.apple.JavaScriptCore 0x00007fff9315de7d JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) + 493 9 com.apple.JavaScriptCore 0x00007fff9319d272 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) + 546 10 com.apple.JavaScriptCore 0x00007fff92e77623 WTF::threadEntryPoint(void*) + 179 11 com.apple.JavaScriptCore 0x00007fff92e7754f WTF::wtfThreadEntryPoint(void*) + 15 12 libsystem_pthread.dylib 0x00007fff9bd74268 _pthread_body + 131 13 libsystem_pthread.dylib 0x00007fff9bd741e5 _pthread_start + 176 14 libsystem_pthread.dylib 0x00007fff9bd7241d thread_start + 13 <rdar://problem/18966258> 1051690 1 242369 msaboff 2014-12-01 17:41:27 -0800 Created attachment 242369 Patch 1051713 2 msaboff 2014-12-01 18:49:47 -0800 Committed r176624: <http://trac.webkit.org/changeset/176624> 1051944 3 kling 2014-12-02 12:56:56 -0800 Bummer that we didn't get a test for this. Also, isn't this an out-of-bounds vector access rather than an integer overflow? 1051952 4 msaboff 2014-12-02 13:50:04 -0800 (In reply to comment #3) > Bummer that we didn't get a test for this. Also, isn't this an out-of-bounds > vector access rather than an integer overflow? Filed <https://bugs.webkit.org/show_bug.cgi?id=139195> for adding a test case. It was an out-of-bounds Vector access crash, accessing element 0 of an empty vector. 242369 2014-12-01 17:41:27 -0800 2014-12-01 17:51:24 -0800 Patch 139165.patch text/plain 2144 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc2NjE3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDE0LTEyLTAxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIChpbnRlZ2VyIG92ZXJmbG93KSBiZW5lYXRoIEJ5dGVDb2RlUGFyc2VyOjpoYW5k bGVHZXRCeUlkIHR5cGluZyBpbiBzZWFyY2ggZmllbGQgb24gd2VhdGhlci5jb20KKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzOTE2NQorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIElmIHdlIGRvbid0IGhhdmUg YW55IGdldEJ5SWQgb3IgcHV0QnlJZCB2YXJpYW50cywgZW1pdCBub24tY2FjaGVkIHZlcnNpb25z IG9mIHRoZXNlIG9wZXJhdGlvbnMuCisKKyAgICAgICAgKiBkZmcvREZHQnl0ZUNvZGVQYXJzZXIu Y3BwOgorICAgICAgICAoSlNDOjpERkc6OkJ5dGVDb2RlUGFyc2VyOjpoYW5kbGVHZXRCeUlkKToK KyAgICAgICAgKEpTQzo6REZHOjpCeXRlQ29kZVBhcnNlcjo6aGFuZGxlUHV0QnlJZCk6CisKIDIw MTQtMTItMDEgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBsZS5jb20+CiAKICAgICAgICAg U2V2ZXJhbCBKYXZhU2NyaXB0Q29yZSBkYXRlIHRlc3RzIGFyZSBmbGFreSwgYmVjYXVzZSB0aGV5 IGV4cGVjdCB0aW1lIHRvIGJlIGZyb3plbiBkdXJpbmcgZXhlY3V0aW9uCkluZGV4OiBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcAo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBT b3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcAkocmV2aXNpb24g MTc2NTk2KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdCeXRlQ29kZVBhcnNlci5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTIwMTgsNyArMjAxOCw3IEBAIHZvaWQgQnl0ZUNvZGVQYXJz ZXI6OmhhbmRsZUdldEJ5SWQoCiB7CiAgICAgTm9kZVR5cGUgZ2V0QnlJZCA9IGdldEJ5SWRTdGF0 dXMubWFrZXNDYWxscygpID8gR2V0QnlJZEZsdXNoIDogR2V0QnlJZDsKICAgICAKLSAgICBpZiAo IWdldEJ5SWRTdGF0dXMuaXNTaW1wbGUoKSB8fCAhT3B0aW9uczo6ZW5hYmxlQWNjZXNzSW5saW5p bmcoKSkgeworICAgIGlmICghZ2V0QnlJZFN0YXR1cy5pc1NpbXBsZSgpIHx8ICFnZXRCeUlkU3Rh dHVzLm51bVZhcmlhbnRzKCkgfHwgIU9wdGlvbnM6OmVuYWJsZUFjY2Vzc0lubGluaW5nKCkpIHsK ICAgICAgICAgc2V0KFZpcnR1YWxSZWdpc3RlcihkZXN0aW5hdGlvbk9wZXJhbmQpLAogICAgICAg ICAgICAgYWRkVG9HcmFwaChnZXRCeUlkLCBPcEluZm8oaWRlbnRpZmllck51bWJlciksIE9wSW5m byhwcmVkaWN0aW9uKSwgYmFzZSkpOwogICAgICAgICByZXR1cm47CkBAIC0yMTMzLDcgKzIxMzMs NyBAQCB2b2lkIEJ5dGVDb2RlUGFyc2VyOjpoYW5kbGVQdXRCeUlkKAogICAgIE5vZGUqIGJhc2Us IHVuc2lnbmVkIGlkZW50aWZpZXJOdW1iZXIsIE5vZGUqIHZhbHVlLAogICAgIGNvbnN0IFB1dEJ5 SWRTdGF0dXMmIHB1dEJ5SWRTdGF0dXMsIGJvb2wgaXNEaXJlY3QpCiB7Ci0gICAgaWYgKCFwdXRC eUlkU3RhdHVzLmlzU2ltcGxlKCkgfHwgIU9wdGlvbnM6OmVuYWJsZUFjY2Vzc0lubGluaW5nKCkp IHsKKyAgICBpZiAoIXB1dEJ5SWRTdGF0dXMuaXNTaW1wbGUoKSB8fCAhcHV0QnlJZFN0YXR1cy5u dW1WYXJpYW50cygpIHx8ICFPcHRpb25zOjplbmFibGVBY2Nlc3NJbmxpbmluZygpKSB7CiAgICAg ICAgIGlmICghcHV0QnlJZFN0YXR1cy5pc1NldCgpKQogICAgICAgICAgICAgYWRkVG9HcmFwaChG b3JjZU9TUkV4aXQpOwogICAgICAgICBlbWl0UHV0QnlJZChiYXNlLCBpZGVudGlmaWVyTnVtYmVy LCB2YWx1ZSwgcHV0QnlJZFN0YXR1cywgaXNEaXJlY3QpOwo=