146494 2015-06-30 22:35:17 -0700 REGRESSION (185319): Reproducible crash in WebHistoryItem launching FluidApp 2022-02-28 04:09:53 -0800 1 1 1 Unclassified WebKit WebKit Misc. 528+ (Nightly build) Mac All RESOLVED FIXED InRadar P2 Normal --- 1 beidson beidson andersca beidson darin oldest_to_newest 1105966 0 beidson 2015-06-30 22:35:17 -0700 REGRESSION (185319): Reproducible crash in WebHistoryItem launching FluidApp Steps to reproduce: 1 - Download FluidApp from http://fluidapp.com 2 - Create an app from a website (I used webkit.org) 3 - Launch that WebApp Crash: 1 0x1034112e0 WTFCrash 2 0x104dbe7d9 WTF::CrashOnOverflow::crash() 3 0x104dbe7a9 WTF::CrashOnOverflow::overflowed() 4 0x104dbf471 WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::at(unsigned long) 5 0x104e51edd WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::operator[](unsigned long) 6 0x104eb909b -[WebHistoryItem initFromDictionaryRepresentation:] 7 0x104eb0897 -[WebHistoryPrivate loadHistoryGutsFromURL:savedItemsCount:collectDiscardedItemsInto:error:] 8 0x104eb0a8c -[WebHistoryPrivate loadFromURL:collectDiscardedItemsInto:error:] 9 0x104eb17db -[WebHistory loadFromURL:error:] 10 0x100019c11 -[FUHistoryController setUpHistory] 11 0x1000198ca -[FUHistoryController init] 12 0x100019807 +[FUHistoryController instance] 13 0x10000e293 -[FUApplication finishLaunching] 14 0x7fff8b010a21 -[NSApplication run] 15 0x7fff8af8d354 NSApplicationMain 16 0x1000017c4 start The code in question: auto redirectURLsVector = std::make_unique<Vector<String>>(); for (NSUInteger i = 0; i < size; ++i) { id redirectURL = [redirectURLs objectAtIndex:i]; if (![redirectURL isKindOfClass:[NSString class]]) continue; (*redirectURLsVector)[i] = (NSString *)redirectURL; } We create a Vector of size 0 then immediately reference the first element. That's obviously wrong. In radar as rdar://problem/21598293 1105967 1 255899 beidson 2015-06-30 22:38:01 -0700 Created attachment 255899 Patch v1 1105968 2 beidson 2015-06-30 22:39:01 -0700 Was introduced in http://trac.webkit.org/changeset/185319 1106071 3 255899 darin 2015-07-01 09:25:15 -0700 Comment on attachment 255899 Patch v1 View in context: https://bugs.webkit.org/attachment.cgi?id=255899&action=review > Source/WebKit/mac/History/WebHistoryItem.mm:363 > NSUInteger size = [redirectURLs count]; After making the thing below a modern Objective-C for loop this can be called right in the reserveInitialCapacity call below. > Source/WebKit/mac/History/WebHistoryItem.mm:365 > + redirectURLsVector->reserveCapacity(size); This should be reserveInitialCapacity. > Source/WebKit/mac/History/WebHistoryItem.mm:368 > for (NSUInteger i = 0; i < size; ++i) { > id redirectURL = [redirectURLs objectAtIndex:i]; This should be a modern Objective-C for loop: for (id redirectURL in redirectURLs) { > Source/WebKit/mac/History/WebHistoryItem.mm:372 > + redirectURLsVector->append((NSString *)redirectURL); This should be uncheckedAppend. 1106098 4 beidson 2015-07-01 10:14:28 -0700 https://trac.webkit.org/changeset/186179 255899 2015-06-30 22:38:01 -0700 2022-02-28 04:09:53 -0800 Patch v1 patch text/plain 1727 beidson ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvbWFjL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQv bWFjL0NoYW5nZUxvZwppbmRleCA5NGI1YzYxLi5lZGQ5NWQ1IDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViS2l0L21hYy9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdC9tYWMvQ2hhbmdlTG9nCkBA IC0xLDMgKzEsMTQgQEAKKzIwMTUtMDYtMzAgIEJyYWR5IEVpZHNvbiAgPGJlaWRzb25AYXBwbGUu Y29tPgorCisgICAgICAgIFJFR1JFU1NJT04gKDE4NTMxOSk6IFJlcHJvZHVjaWJsZSBjcmFzaCBp biBXZWJIaXN0b3J5SXRlbSBsYXVuY2hpbmcgRmx1aWRBcHAuCisgICAgICAgIDxyZGFyOi8vcHJv YmxlbS8yMTU5ODI5Mz4gYW5kIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0xNDY0OTQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICAqIEhpc3RvcnkvV2ViSGlzdG9yeUl0ZW0ubW06CisgICAgICAgICgtW1dlYkhpc3RvcnlJdGVt IGluaXRGcm9tRGljdGlvbmFyeVJlcHJlc2VudGF0aW9uOl0pOiBEb27igJl0IHJlZmVyZW5jZSBt ZW1iZXJzIG9mIGEgVmVjdG9yCisgICAgICAgICAgdGhhdCBkb27igJl0IGV4aXN0LgorCiAyMDE1 LTA2LTI5ICBEZWFuIEphY2tzb24gIDxkaW5vQGFwcGxlLmNvbT4KIAogICAgICAgICBTZXR0aW5n IHRvIGVuYWJsZS9kaXNhYmxlIG1lZGlhIGNvbnRyb2xzIHNpemluZyBvbiBwYWdlIHpvb20KZGlm ZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvbWFjL0hpc3RvcnkvV2ViSGlzdG9yeUl0ZW0ubW0gYi9T b3VyY2UvV2ViS2l0L21hYy9IaXN0b3J5L1dlYkhpc3RvcnlJdGVtLm1tCmluZGV4IGYyZWJlYzcu LjUxNGQ4ZDUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvbWFjL0hpc3RvcnkvV2ViSGlzdG9y eUl0ZW0ubW0KKysrIGIvU291cmNlL1dlYktpdC9tYWMvSGlzdG9yeS9XZWJIaXN0b3J5SXRlbS5t bQpAQCAtMzYyLDEzICszNjIsMTQgQEAgLSAoaWQpaW5pdEZyb21EaWN0aW9uYXJ5UmVwcmVzZW50 YXRpb246KE5TRGljdGlvbmFyeSAqKWRpY3QKICAgICBpZiAoTlNBcnJheSAqcmVkaXJlY3RVUkxz ID0gW2RpY3QgX3dlYmtpdF9hcnJheUZvcktleTpyZWRpcmVjdFVSTHNLZXldKSB7CiAgICAgICAg IE5TVUludGVnZXIgc2l6ZSA9IFtyZWRpcmVjdFVSTHMgY291bnRdOwogICAgICAgICBhdXRvIHJl ZGlyZWN0VVJMc1ZlY3RvciA9IHN0ZDo6bWFrZV91bmlxdWU8VmVjdG9yPFN0cmluZz4+KCk7Cisg ICAgICAgIHJlZGlyZWN0VVJMc1ZlY3Rvci0+cmVzZXJ2ZUNhcGFjaXR5KHNpemUpOwogCiAgICAg ICAgIGZvciAoTlNVSW50ZWdlciBpID0gMDsgaSA8IHNpemU7ICsraSkgewogICAgICAgICAgICAg aWQgcmVkaXJlY3RVUkwgPSBbcmVkaXJlY3RVUkxzIG9iamVjdEF0SW5kZXg6aV07CiAgICAgICAg ICAgICBpZiAoIVtyZWRpcmVjdFVSTCBpc0tpbmRPZkNsYXNzOltOU1N0cmluZyBjbGFzc11dKQog ICAgICAgICAgICAgICAgIGNvbnRpbnVlOwogCi0gICAgICAgICAgICAoKnJlZGlyZWN0VVJMc1Zl Y3RvcilbaV0gPSAoTlNTdHJpbmcgKilyZWRpcmVjdFVSTDsKKyAgICAgICAgICAgIHJlZGlyZWN0 VVJMc1ZlY3Rvci0+YXBwZW5kKChOU1N0cmluZyAqKXJlZGlyZWN0VVJMKTsKICAgICAgICAgfQog CiAgICAgICAgIGNvcmUoX3ByaXZhdGUpLT5zZXRSZWRpcmVjdFVSTHMoV1RGOjptb3ZlKHJlZGly ZWN0VVJMc1ZlY3RvcikpOwo=