151900 2015-12-04 17:36:45 -0800 Crash when secondary clicking on a link on yahoo.com 2015-12-07 10:59:41 -0800 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 andersca andersca bdakin oldest_to_newest 1146526 0 andersca 2015-12-04 17:36:45 -0800 Crash when secondary clicking on a link on yahoo.com 1146527 1 266693 andersca 2015-12-04 17:38:00 -0800 Created attachment 266693 Patch 1146530 2 andersca 2015-12-04 17:45:42 -0800 Committed r193499: <http://trac.webkit.org/changeset/193499> 1146909 3 266693 darin 2015-12-07 10:59:41 -0800 Comment on attachment 266693 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=266693&action=review > Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm:271 > + auto absoluteLinkURL = URL(ParsedURLString, hitTestData.absoluteLinkURL); I’m a bit surprised at the use of ParsedURLString here. Does this string com from something that the WebCore URL class produced in the other process that was shipped over by XPC? If so, then I suppose ParsedURLString is correct, but I worry slight if the URL “can be trusted” and thus how the use of ParsedURLString might be risky in some way. 266693 2015-12-04 17:38:00 -0800 2015-12-04 17:39:37 -0800 Patch bug-151900-20151204173734.patch text/plain 2192 andersca U3VidmVyc2lvbiBSZXZpc2lvbjogMTkzNDgzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXggMzk3MTc4OWM3ZGMyOGFj NGI4MmY0ZjUzMmIwYjE2ZDFiZWI0NWZlYS4uNDMwYTZjZjgxMmI0ZDIwYWY2MmZkNTI3NmIyNzEy YjgxZWE3NTc4OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE1LTEyLTA0ICBBbmRl cnMgQ2FybHNzb24gIDxhbmRlcnNjYUBhcHBsZS5jb20+CisKKyAgICAgICAgQ3Jhc2ggd2hlbiBz ZWNvbmRhcnkgY2xpY2tpbmcgb24gYSBsaW5rIG9uIHlhaG9vLmNvbQorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTUxOTAwCisgICAgICAgIHJkYXI6Ly9w cm9ibGVtLzIzNzY1MTQ5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgRG9uJ3QgdXNlICtbTlNVUkwgVVJMV2l0aFN0cmluZzpdIHNpbmNlIGl0IGRvZXNu J3QgaGFuZGxlIGludmFsaWQgVVJMcyBhcyB3ZWxsIGFzIFdlYkNvcmU6OlVSTC4KKworICAgICAg ICAqIFVJUHJvY2Vzcy9tYWMvV2ViQ29udGV4dE1lbnVQcm94eU1hYy5tbToKKyAgICAgICAgKFdl YktpdDo6V2ViQ29udGV4dE1lbnVQcm94eU1hYzo6Y3JlYXRlU2hhcmVNZW51SXRlbSk6CisKIDIw MTUtMTItMDQgIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29tPgogCiAgICAgICAgIENyYXNo IGluIGNsaWVudHMgdXNpbmcgdXNlckRhdGEgaW4gCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0 Mi9VSVByb2Nlc3MvbWFjL1dlYkNvbnRleHRNZW51UHJveHlNYWMubW0gYi9Tb3VyY2UvV2ViS2l0 Mi9VSVByb2Nlc3MvbWFjL1dlYkNvbnRleHRNZW51UHJveHlNYWMubW0KaW5kZXggNzJmYmY2ZWNl ZTNkNzRmYzcyZTBmMjczMTlmNDQxY2FlMTk3N2RkOC4uMDFlZGRhZDE5NDhkMjNiNWI5YWUxZDBj ZjhiYzBlZjZiZWVmYzE0ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvVUlQcm9jZXNzL21h Yy9XZWJDb250ZXh0TWVudVByb3h5TWFjLm1tCisrKyBiL1NvdXJjZS9XZWJLaXQyL1VJUHJvY2Vz cy9tYWMvV2ViQ29udGV4dE1lbnVQcm94eU1hYy5tbQpAQCAtMjY4LDEzICsyNjgsMTUgQEAgUmV0 YWluUHRyPE5TTWVudUl0ZW0+IFdlYkNvbnRleHRNZW51UHJveHlNYWM6OmNyZWF0ZVNoYXJlTWVu dUl0ZW0oKQogICAgIGF1dG8gaXRlbXMgPSBhZG9wdE5TKFtbTlNNdXRhYmxlQXJyYXkgYWxsb2Nd IGluaXRdKTsKIAogICAgIGlmICghaGl0VGVzdERhdGEuYWJzb2x1dGVMaW5rVVJMLmlzRW1wdHko KSkgewotICAgICAgICBOU1VSTCAqYWJzb2x1dGVMaW5rVVJMID0gW05TVVJMIFVSTFdpdGhTdHJp bmc6aGl0VGVzdERhdGEuYWJzb2x1dGVMaW5rVVJMXTsKLSAgICAgICAgW2l0ZW1zIGFkZE9iamVj dDphYnNvbHV0ZUxpbmtVUkxdOworICAgICAgICBhdXRvIGFic29sdXRlTGlua1VSTCA9IFVSTChQ YXJzZWRVUkxTdHJpbmcsIGhpdFRlc3REYXRhLmFic29sdXRlTGlua1VSTCk7CisgICAgICAgIGlm ICghYWJzb2x1dGVMaW5rVVJMLmlzRW1wdHkoKSkKKyAgICAgICAgICAgIFtpdGVtcyBhZGRPYmpl Y3Q6KE5TVVJMICopYWJzb2x1dGVMaW5rVVJMXTsKICAgICB9CiAKICAgICBpZiAoaGl0VGVzdERh dGEuaXNEb3dubG9hZGFibGVNZWRpYSAmJiAhaGl0VGVzdERhdGEuYWJzb2x1dGVNZWRpYVVSTC5p c0VtcHR5KCkpIHsKLSAgICAgICAgTlNVUkwgKmRvd25sb2FkYWJsZU1lZGlhVVJMID0gW05TVVJM IFVSTFdpdGhTdHJpbmc6aGl0VGVzdERhdGEuYWJzb2x1dGVNZWRpYVVSTF07Ci0gICAgICAgIFtp dGVtcyBhZGRPYmplY3Q6ZG93bmxvYWRhYmxlTWVkaWFVUkxdOworICAgICAgICBhdXRvIGRvd25s b2FkYWJsZU1lZGlhVVJMID0gVVJMKFBhcnNlZFVSTFN0cmluZywgaGl0VGVzdERhdGEuYWJzb2x1 dGVNZWRpYVVSTCk7CisgICAgICAgIGlmICghZG93bmxvYWRhYmxlTWVkaWFVUkwuaXNFbXB0eSgp KQorICAgICAgICAgICAgW2l0ZW1zIGFkZE9iamVjdDooTlNVUkwgKilkb3dubG9hZGFibGVNZWRp YVVSTF07CiAgICAgfQogCiAgICAgaWYgKGhpdFRlc3REYXRhLmltYWdlU2hhcmVkTWVtb3J5ICYm IGhpdFRlc3REYXRhLmltYWdlU2l6ZSkgewo=