139969 2014-12-27 13:01:48 -0800 [WinCairo] Crash when font data pointer is null. 2015-01-05 07:05:53 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 peavo webkit-unassigned alex.christensen bfulgham commit-queue ossy sam oldest_to_newest 1057992 0 peavo 2014-12-27 13:01:48 -0800 There is missing a null pointer check in the UniscribeController::shape() method. I have gotten several crashes here because the font data pointer was null. 1057993 1 243779 peavo 2014-12-27 13:07:49 -0800 Created attachment 243779 Patch 1057998 2 243779 sam 2014-12-27 13:57:16 -0800 Comment on attachment 243779 Patch Test case? 1058003 3 ossy 2014-12-27 14:39:32 -0800 (In reply to comment #2) > Comment on attachment 243779 [details] > Patch > > Test case? test for wincairo? :) It's impossible to run any layout test on wincairo. (N)RWT doesn't know wincairo port (bug124927) and there isn't ORWT long time ago ... 1058004 4 sam 2014-12-27 15:14:59 -0800 (In reply to comment #3) > (In reply to comment #2) > > Comment on attachment 243779 [details] > > Patch > > > > Test case? > > test for wincairo? :) > > It's impossible to run any layout test on wincairo. (N)RWT doesn't > know wincairo port (bug124927) and there isn't ORWT long time ago ... So, is it time to remove support for WinCairo? A port without any testing seems like a bad idea. Do you at least have a test case that crashes in a WinCairo mini browser? 1058012 5 alex.christensen 2014-12-28 00:05:21 -0800 I think we should not need both an assert and a null check. Asserts should be for things that should never be false. Sam, I have hardware for a WinCairo bot. See https://bugs.webkit.org/show_bug.cgi?id=139908 The few differences between AppleWin and WinCairo are tested manually and that has worked well for some time now. 1058014 6 alex.christensen 2014-12-28 00:32:21 -0800 And layout tests can be run with WinCairo, it just requires a bit of impersonating AppleWin right now. 1058051 7 peavo 2014-12-28 12:31:36 -0800 (In reply to comment #2) > Comment on attachment 243779 [details] > Patch > > Test case? I will try to come up with a test case :) 1058138 8 peavo 2014-12-29 13:32:27 -0800 Here is a somewhat reduced test case which crashes the browser every time: <html> <head> <style> span.texhtml{font-family:"Nimbus Roman No9 L","Times New Roman",Times,serif;font-size:118%;line-height:1} .texhtml{-webkit-font-feature-settings:"lnum","tnum";font-feature-settings:"lnum","tnum"} </style> </head> <body> <span class="texhtml">|<span class="Unicode">⟩</span></span> </body> </html> 1058162 9 243779 alex.christensen 2014-12-29 19:43:41 -0800 Comment on attachment 243779 Patch I assume this change fixes it so it doesn't crash. Then add the test to layout tests and upload a new patch. 1058513 10 243917 peavo 2015-01-03 08:21:33 -0800 Created attachment 243917 Patch 1058514 11 peavo 2015-01-03 08:22:59 -0800 (In reply to comment #9) > Comment on attachment 243779 [details] > Patch > > I assume this change fixes it so it doesn't crash. Then add the test to > layout tests and upload a new patch. Thanks for reviewing :) Updated patch. 1058703 12 243917 commit-queue 2015-01-05 07:05:48 -0800 Comment on attachment 243917 Patch Clearing flags on attachment: 243917 Committed r177909: <http://trac.webkit.org/changeset/177909> 1058704 13 commit-queue 2015-01-05 07:05:53 -0800 All reviewed patches have been landed. Closing bug. 243779 2014-12-27 13:07:49 -0800 2015-01-03 08:21:23 -0800 Patch bug-139969-20141227220735.patch text/plain 1406 peavo SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3Nzc2OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE0LTEyLTI3ICBwZWF2b0Bv dXRsb29rLmNvbSAgPHBlYXZvQG91dGxvb2suY29tPgorCisgICAgICAgIFtXaW5DYWlyb10gQ3Jh c2ggd2hlbiBmb250IGRhdGEgcG9pbnRlciBpcyBudWxsLgorICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM5OTY5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkZWQgbnVsbCBwb2ludGVyIGNoZWNrLgorCisg ICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3Mvd2luL1VuaXNjcmliZUNvbnRyb2xsZXIuY3BwOgor ICAgICAgICAoV2ViQ29yZTo6VW5pc2NyaWJlQ29udHJvbGxlcjo6c2hhcGUpOgorCiAyMDE0LTEy LTI2ICBBbmRyZWFzIEtsaW5nICA8YWtsaW5nQGFwcGxlLmNvbT4KIAogICAgICAgICBQdXJnZSBQ YXNzUmVmUHRyIGZyb20gRWxlbWVudCBhbmQgRWxlbWVudFJhcmVEYXRhLgpJbmRleDogU291cmNl L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3Mvd2luL1VuaXNjcmliZUNvbnRyb2xsZXIuY3BwCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3dpbi9VbmlzY3Jp YmVDb250cm9sbGVyLmNwcAkocmV2aXNpb24gMTc3MzcwKQorKysgU291cmNlL1dlYkNvcmUvcGxh dGZvcm0vZ3JhcGhpY3Mvd2luL1VuaXNjcmliZUNvbnRyb2xsZXIuY3BwCSh3b3JraW5nIGNvcHkp CkBAIC00MTIsNiArNDEyLDEyIEBAIGJvb2wgVW5pc2NyaWJlQ29udHJvbGxlcjo6c2hhcGUoY29u c3QgVUMKICAgICBIRk9OVCBvbGRGb250ID0gMDsKICAgICBIUkVTVUxUIHNoYXBlUmVzdWx0ID0g RV9QRU5ESU5HOwogICAgIGludCBnbHlwaENvdW50ID0gMDsKKworICAgIEFTU0VSVChmb250RGF0 YSk7CisKKyAgICBpZiAoIWZvbnREYXRhKQorICAgICAgICByZXR1cm4gZmFsc2U7CisKICAgICBk byB7CiAgICAgICAgIHNoYXBlUmVzdWx0ID0gU2NyaXB0U2hhcGUoaGRjLCBmb250RGF0YS0+c2Ny aXB0Q2FjaGUoKSwgc3RyLCBsZW4sIGdseXBocy5zaXplKCksICZpdGVtLmEsCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgZ2x5cGhzLmRhdGEoKSwgY2x1c3RlcnMuZGF0YSgpLCB2 aXN1YWxBdHRyaWJ1dGVzLmRhdGEoKSwgJmdseXBoQ291bnQpOwo= 243917 2015-01-03 08:21:33 -0800 2015-01-05 07:05:48 -0800 Patch bug-139969-20150103172118.patch text/plain 4176 peavo SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3Nzg3MCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE1LTAxLTAzICBwZWF2b0Bv dXRsb29rLmNvbSAgPHBlYXZvQG91dGxvb2suY29tPgorCisgICAgICAgIFtXaW5DYWlyb10gQ3Jh c2ggd2hlbiBmb250IGRhdGEgcG9pbnRlciBpcyBudWxsLgorICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM5OTY5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkZWQgbnVsbCBwb2ludGVyIGNoZWNrLgorCisg ICAgICAgIFRlc3Q6IGZvbnRzL3VuaWNvZGUtY2hhcmFjdGVyLWZvbnQtY3Jhc2guaHRtbAorCisg ICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3Mvd2luL1VuaXNjcmliZUNvbnRyb2xsZXIuY3BwOgor ICAgICAgICAoV2ViQ29yZTo6VW5pc2NyaWJlQ29udHJvbGxlcjo6YWR2YW5jZSk6CisgICAgICAg IChXZWJDb3JlOjpVbmlzY3JpYmVDb250cm9sbGVyOjpzaGFwZSk6CisKIDIwMTUtMDEtMDIgIENo cmlzIER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAgICBLaWxsIHRoZSBEZXByZWNh dGVkU3R5bGVCdWlsZGVyCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy93 aW4vVW5pc2NyaWJlQ29udHJvbGxlci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUv cGxhdGZvcm0vZ3JhcGhpY3Mvd2luL1VuaXNjcmliZUNvbnRyb2xsZXIuY3BwCShyZXZpc2lvbiAx Nzc4NzApCisrKyBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy93aW4vVW5pc2NyaWJl Q29udHJvbGxlci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE2NSw3ICsxNjUsNyBAQCB2b2lkIFVu aXNjcmliZUNvbnRyb2xsZXI6OmFkdmFuY2UodW5zaWduCiAgICAgICAgICAgICAgICAgc21hbGxD YXBzQnVmZmVyW2luZGV4XSA9IGZvcmNlU21hbGxDYXBzID8gYyA6IG5ld0M7CiAgICAgICAgIH0K IAotICAgICAgICBpZiAobV9mYWxsYmFja0ZvbnRzICYmIG5leHRGb250RGF0YSAhPSBmb250RGF0 YSAmJiBmb250RGF0YSAhPSBtX2ZvbnQucHJpbWFyeUZvbnQoKSkKKyAgICAgICAgaWYgKG1fZmFs bGJhY2tGb250cyAmJiBmb250RGF0YSAmJiBuZXh0Rm9udERhdGEgIT0gZm9udERhdGEgJiYgZm9u dERhdGEgIT0gbV9mb250LnByaW1hcnlGb250KCkpCiAgICAgICAgICAgICBtX2ZhbGxiYWNrRm9u dHMtPmFkZChmb250RGF0YSk7CiAKICAgICAgICAgaWYgKG5leHRGb250RGF0YSAhPSBmb250RGF0 YSB8fCBuZXh0SXNTbWFsbENhcHMgIT0gaXNTbWFsbENhcHMpIHsKQEAgLTE3OSw3ICsxNzksNyBA QCB2b2lkIFVuaXNjcmliZUNvbnRyb2xsZXI6OmFkdmFuY2UodW5zaWduCiAgICAgCiAgICAgaW50 IGl0ZW1MZW5ndGggPSBtX3J1bi5ydGwoKSA/IGluZGV4T2ZGb250VHJhbnNpdGlvbiArIDEgOiBs ZW5ndGggLSBpbmRleE9mRm9udFRyYW5zaXRpb247CiAgICAgaWYgKGl0ZW1MZW5ndGgpIHsKLSAg ICAgICAgaWYgKG1fZmFsbGJhY2tGb250cyAmJiBuZXh0Rm9udERhdGEgIT0gbV9mb250LnByaW1h cnlGb250KCkpCisgICAgICAgIGlmIChtX2ZhbGxiYWNrRm9udHMgJiYgbmV4dEZvbnREYXRhICYm IG5leHRGb250RGF0YSAhPSBtX2ZvbnQucHJpbWFyeUZvbnQoKSkKICAgICAgICAgICAgIG1fZmFs bGJhY2tGb250cy0+YWRkKG5leHRGb250RGF0YSk7CiAKICAgICAgICAgaW50IGl0ZW1TdGFydCA9 IG1fcnVuLnJ0bCgpID8gMCA6IGluZGV4T2ZGb250VHJhbnNpdGlvbjsKQEAgLTQxMiw2ICs0MTIs MTAgQEAgYm9vbCBVbmlzY3JpYmVDb250cm9sbGVyOjpzaGFwZShjb25zdCBVQwogICAgIEhGT05U IG9sZEZvbnQgPSAwOwogICAgIEhSRVNVTFQgc2hhcGVSZXN1bHQgPSBFX1BFTkRJTkc7CiAgICAg aW50IGdseXBoQ291bnQgPSAwOworCisgICAgaWYgKCFmb250RGF0YSkKKyAgICAgICAgcmV0dXJu IGZhbHNlOworCiAgICAgZG8gewogICAgICAgICBzaGFwZVJlc3VsdCA9IFNjcmlwdFNoYXBlKGhk YywgZm9udERhdGEtPnNjcmlwdENhY2hlKCksIHN0ciwgbGVuLCBnbHlwaHMuc2l6ZSgpLCAmaXRl bS5hLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdseXBocy5kYXRhKCksIGNs dXN0ZXJzLmRhdGEoKSwgdmlzdWFsQXR0cmlidXRlcy5kYXRhKCksICZnbHlwaENvdW50KTsKSW5k ZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFu Z2VMb2cJKHJldmlzaW9uIDE3Nzg3MCkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDE1LTAxLTAzICBwZWF2b0BvdXRsb29rLmNvbSAg PHBlYXZvQG91dGxvb2suY29tPgorCisgICAgICAgIFtXaW5DYWlyb10gQ3Jhc2ggd2hlbiBmb250 IGRhdGEgcG9pbnRlciBpcyBudWxsLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MTM5OTY5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgKiBmb250cy91bmljb2RlLWNoYXJhY3Rlci1mb250LWNyYXNoLWV4cGVj dGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZm9udHMvdW5pY29kZS1jaGFyYWN0ZXItZm9udC1j cmFzaC5odG1sOiBBZGRlZC4KKwogMjAxNS0wMS0wMiAgQW5kZXJzIENhcmxzc29uICA8YW5kZXJz Y2FAYXBwbGUuY29tPgogCiAgICAgICAgIEdldCByaWQgb2Ygc3RvcmFnZSB0cmFja2VyIGxheW91 dCB0ZXN0cwpJbmRleDogTGF5b3V0VGVzdHMvZm9udHMvdW5pY29kZS1jaGFyYWN0ZXItZm9udC1j cmFzaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZm9udHMvdW5pY29k ZS1jaGFyYWN0ZXItZm9udC1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlv dXRUZXN0cy9mb250cy91bmljb2RlLWNoYXJhY3Rlci1mb250LWNyYXNoLWV4cGVjdGVkLnR4dAko d29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDUgQEAKK1Rlc3QgY2FzZSBmb3IgYnVnIDEzOTk2OTog W1dpbkNhaXJvXSBDcmFzaCB3aGVuIGZvbnQgZGF0YSBwb2ludGVyIGlzIG51bGwuCisKK1RoaXMg dGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guCisKK+KfqQpJbmRleDogTGF5b3V0VGVz dHMvZm9udHMvdW5pY29kZS1jaGFyYWN0ZXItZm9udC1jcmFzaC5odG1sCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IExheW91dFRlc3RzL2ZvbnRzL3VuaWNvZGUtY2hhcmFjdGVyLWZvbnQtY3Jhc2guaHRtbAkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL2ZvbnRzL3VuaWNvZGUtY2hhcmFjdGVyLWZvbnQtY3Jh c2guaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDE5IEBACivvu788aHRtbD4KKworPGhl YWQ+Cis8c3R5bGU+CisudGV4aHRtbHstd2Via2l0LWZvbnQtZmVhdHVyZS1zZXR0aW5nczoibG51 bSIsInRudW0ifQorPC9zdHlsZT4KKzwvaGVhZD4KKworPGJvZHk+Cis8cD5UZXN0IGNhc2UgZm9y IDxhIGhyZWY9Imh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzOTk2OSI+ YnVnIDEzOTk2OTwvYT46IFtXaW5DYWlyb10gQ3Jhc2ggd2hlbiBmb250IGRhdGEgcG9pbnRlciBp cyBudWxsLjwvcD4KKzxwPlRoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guPC9w PgorPHNwYW4gY2xhc3M9InRleGh0bWwiPuKfqTwvc3Bhbj4KKzxzY3JpcHQ+CitpZiAod2luZG93 LnRlc3RSdW5uZXIpCisgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworPC9zY3JpcHQ+Cis8L2Jv ZHk+CisKKzwvaHRtbD4K