155739 2016-03-21 17:36:00 -0700 [Win] SharedBuffer::copy() can cause crash 2016-03-24 22:29:19 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 93078 1 bfulgham bfulgham bfulgham mrobinson rniwa oldest_to_newest 1176891 0 bfulgham 2016-03-21 17:36:00 -0700 As reported by Dongseong Hwang back in 2012: After SharedBuffer::copy(), SharedBuffer::append() often causes segmentation fault, because copy() calls clone->m_buffer.append(m_segments[i], segmentSize) even if 'i' is the last index. The data size of m_segments.last() is often less than segmentSize. So, in the cloned instance m_size < (m_buffer.size() + SUM(m_segments[i].size())). This patch appends the exact size of the last segment instead of segmentSize. We don't encounter this on iOS/OS X because the segments always arrive in full segments. However, Windows, and perhaps other ports, may encounter this problem. This failure is revealed by the TestWebKitAPI "SharedBufferTest::copy())" test case. 1176892 1 274631 bfulgham 2016-03-21 17:43:46 -0700 Created attachment 274631 Correct Windows test failure. 1176896 2 274632 bfulgham 2016-03-21 17:51:57 -0700 Created attachment 274632 Patch 1176906 3 274632 rniwa 2016-03-21 18:48:12 -0700 Comment on attachment 274632 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=274632&action=review > Source/WebCore/platform/SharedBuffer.cpp:272 > + unsigned positionInSegment = m_size - m_buffer->data.size() - lastIndex * segmentSize; I'd call this variable sizeOfLastSegment instead. 1176908 4 bfulgham 2016-03-21 19:20:57 -0700 Martin: FYI in case this affects Gtk+. 1176985 5 274632 bfulgham 2016-03-22 08:56:59 -0700 Comment on attachment 274632 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=274632&action=review >> Source/WebCore/platform/SharedBuffer.cpp:272 >> + unsigned positionInSegment = m_size - m_buffer->data.size() - lastIndex * segmentSize; > > I'd call this variable sizeOfLastSegment instead. Will do! 1176986 6 bfulgham 2016-03-22 09:02:55 -0700 Committed in r198530 <http://trac.webkit.org/changeset/198530>. 274631 2016-03-21 17:43:46 -0700 2016-03-21 17:51:57 -0700 Correct Windows test failure. copy.patch text/plain 2217 bfulgham SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDE5ODUw OSkKKysrIENoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSw1ICsxLDI2IEBACiAyMDE2LTAz LTIxICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgogCisgICAgICAgIFNoYXJl ZEJ1ZmZlcjo6Y29weSgpIGNhbiBjYXVzZSBhIHNlZ21lbnRhdGlvbiBmYXVsdC4KKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1NTczOQorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEJhc2VkIG9uIGEgQmxpbmsg cGF0Y2ggYnkgSHVhbmcgRG9uZ3N1bmcgPGx1eHRlbGxhQGNvbXBhbnkxMDAubmV0Pi4KKyAgICAg ICAgPGh0dHBzOi8vc3JjLmNocm9taXVtLm9yZy92aWV3dmMvYmxpbms/cmV2aXNpb249MTUzODUw JnZpZXc9cmV2aXNpb24KKworICAgICAgICBBZnRlciBTaGFyZWRCdWZmZXI6OmNvcHkoKSwgU2hh cmVkQnVmZmVyOjphcHBlbmQoKSBjYW4gY2F1c2Ugc2VnbWVudGF0aW9uIGZhdWx0LAorICAgICAg ICBiZWNhdXNlIGNvcHkoKSBjYWxscyBjbG9uZS0+bV9idWZmZXIuYXBwZW5kKG1fc2VnbWVudHNb aV0sIHNlZ21lbnRTaXplKSBldmVuIGlmCisgICAgICAgICdpJyBpcyB0aGUgbGFzdCBpbmRleC4g VGhlIGRhdGEgc2l6ZSBvZiBtX3NlZ21lbnRzLmxhc3QoKSBpcyBvZnRlbiBsZXNzIHRoYW4KKyAg ICAgICAgc2VnbWVudFNpemUuIFNvLCBpbiB0aGUgY2xvbmVkIGluc3RhbmNlIG1fc2l6ZSA8ICht X2J1ZmZlci5zaXplKCkgKyBTVU0obV9zZWdtZW50c1tpXS5zaXplKCkpKS4KKyAgICAgICAgVGhp cyBwYXRjaCBhcHBlbmRzIHRoZSBleGFjdCBzaXplIG9mIHRoZSBsYXN0IHNlZ21lbnQgaW5zdGVh ZCBvZiBzZWdtZW50U2l6ZS4KKworICAgICAgICBUZXN0ZWQgYnkgVGVzdFdlYktpdEFQSSBTaGFy ZWRCdWZmZXJUZXN0Ojpjb3B5CisKKyAgICAgICAgKiBwbGF0Zm9ybS9TaGFyZWRCdWZmZXIuY3Bw OgorICAgICAgICAoU2hhcmVkQnVmZmVyOjpjb3B5KTogCisKKzIwMTYtMDMtMjEgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKICAgICAgICAgSW1wcm92ZSBTaGFyZWRCdWZm ZXIgdGVzdGluZwogICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9OTMwNzgKICAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI1Mjc3ODI5PgpJbmRleDogcGxhdGZv cm0vU2hhcmVkQnVmZmVyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBwbGF0Zm9ybS9TaGFyZWRCdWZmZXIu Y3BwCShyZXZpc2lvbiAxOTg1MDcpCisrKyBwbGF0Zm9ybS9TaGFyZWRCdWZmZXIuY3BwCSh3b3Jr aW5nIGNvcHkpCkBAIC0yNjQsOCArMjY0LDE0IEBACiAgICAgY2xvbmUtPm1fYnVmZmVyLT5kYXRh LmFwcGVuZChtX2J1ZmZlci0+ZGF0YS5kYXRhKCksIG1fYnVmZmVyLT5kYXRhLnNpemUoKSk7CiAK ICNpZiAhVVNFKE5FVFdPUktfQ0ZEQVRBX0FSUkFZX0NBTExCQUNLKQotICAgIGZvciAoY2hhciog c2VnbWVudCA6IG1fc2VnbWVudHMpCi0gICAgICAgIGNsb25lLT5tX2J1ZmZlci0+ZGF0YS5hcHBl bmQoc2VnbWVudCwgc2VnbWVudFNpemUpOworICAgIGlmICghbV9zZWdtZW50cy5pc0VtcHR5KCkp IHsKKyAgICAgICAgdW5zaWduZWQgbGFzdEluZGV4ID0gbV9zZWdtZW50cy5zaXplKCkgLSAxOwor ICAgICAgICBmb3IgKHVuc2lnbmVkIGkgPSAwOyBpIDwgbGFzdEluZGV4OyArK2kpCisgICAgICAg ICAgICBjbG9uZS0+bV9idWZmZXItPmRhdGEuYXBwZW5kKG1fc2VnbWVudHNbaV0sIHNlZ21lbnRT aXplKTsKKworICAgICAgICB1bnNpZ25lZCBwb3NpdGlvbkluU2VnbWVudCA9IG1fc2l6ZSAtIG1f YnVmZmVyLT5kYXRhLnNpemUoKSAtIGxhc3RJbmRleCAqIHNlZ21lbnRTaXplOworICAgICAgICBj bG9uZS0+bV9idWZmZXItPmRhdGEuYXBwZW5kKG1fc2VnbWVudHMubGFzdCgpLCBwb3NpdGlvbklu U2VnbWVudCk7CisgICAgfQogI2Vsc2UKICAgICBmb3IgKGF1dG8mIGRhdGEgOiBtX2RhdGFBcnJh eSkKICAgICAgICAgY2xvbmUtPm1fZGF0YUFycmF5LmFwcGVuZChkYXRhLmdldCgpKTsK 274632 2016-03-21 17:51:57 -0700 2016-03-21 18:48:12 -0700 Patch buffer.patch text/plain 3821 bfulgham SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE5ODUwOSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSw1ICsxLDI2IEBACiAyMDE2LTAzLTIxICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgogCisgICAgICAgIFNoYXJlZEJ1ZmZlcjo6Y29w eSgpIGNhbiBjYXVzZSBhIHNlZ21lbnRhdGlvbiBmYXVsdC4KKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1NTczOQorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEJhc2VkIG9uIGEgQmxpbmsgcGF0Y2ggYnkgSHVh bmcgRG9uZ3N1bmcgPGx1eHRlbGxhQGNvbXBhbnkxMDAubmV0Pi4KKyAgICAgICAgPGh0dHBzOi8v c3JjLmNocm9taXVtLm9yZy92aWV3dmMvYmxpbms/cmV2aXNpb249MTUzODUwJnZpZXc9cmV2aXNp b24+CisKKyAgICAgICAgQWZ0ZXIgU2hhcmVkQnVmZmVyOjpjb3B5KCksIFNoYXJlZEJ1ZmZlcjo6 YXBwZW5kKCkgY2FuIGNhdXNlIHNlZ21lbnRhdGlvbiBmYXVsdCwKKyAgICAgICAgYmVjYXVzZSBj b3B5KCkgY2FsbHMgY2xvbmUtPm1fYnVmZmVyLmFwcGVuZChtX3NlZ21lbnRzW2ldLCBzZWdtZW50 U2l6ZSkgZXZlbiBpZgorICAgICAgICAnaScgaXMgdGhlIGxhc3QgaW5kZXguIFRoZSBkYXRhIHNp emUgb2YgbV9zZWdtZW50cy5sYXN0KCkgaXMgb2Z0ZW4gbGVzcyB0aGFuCisgICAgICAgIHNlZ21l bnRTaXplLiBTbywgaW4gdGhlIGNsb25lZCBpbnN0YW5jZSBtX3NpemUgPCAobV9idWZmZXIuc2l6 ZSgpICsgU1VNKG1fc2VnbWVudHNbaV0uc2l6ZSgpKSkuCisgICAgICAgIFRoaXMgcGF0Y2ggYXBw ZW5kcyB0aGUgZXhhY3Qgc2l6ZSBvZiB0aGUgbGFzdCBzZWdtZW50IGluc3RlYWQgb2Ygc2VnbWVu dFNpemUuCisKKyAgICAgICAgVGVzdGVkIGJ5IFRlc3RXZWJLaXRBUEkgU2hhcmVkQnVmZmVyVGVz dDo6Y29weQorCisgICAgICAgICogcGxhdGZvcm0vU2hhcmVkQnVmZmVyLmNwcDoKKyAgICAgICAg KFNoYXJlZEJ1ZmZlcjo6Y29weSk6IAorCisyMDE2LTAzLTIxICBCcmVudCBGdWxnaGFtICA8YmZ1 bGdoYW1AYXBwbGUuY29tPgorCiAgICAgICAgIEltcHJvdmUgU2hhcmVkQnVmZmVyIHRlc3RpbmcK ICAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTkzMDc4CiAg ICAgICAgIDxyZGFyOi8vcHJvYmxlbS8yNTI3NzgyOT4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3Bs YXRmb3JtL1NoYXJlZEJ1ZmZlci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGxh dGZvcm0vU2hhcmVkQnVmZmVyLmNwcAkocmV2aXNpb24gMTk4NTA3KQorKysgU291cmNlL1dlYkNv cmUvcGxhdGZvcm0vU2hhcmVkQnVmZmVyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjY0LDggKzI2 NCwxNCBAQAogICAgIGNsb25lLT5tX2J1ZmZlci0+ZGF0YS5hcHBlbmQobV9idWZmZXItPmRhdGEu ZGF0YSgpLCBtX2J1ZmZlci0+ZGF0YS5zaXplKCkpOwogCiAjaWYgIVVTRShORVRXT1JLX0NGREFU QV9BUlJBWV9DQUxMQkFDSykKLSAgICBmb3IgKGNoYXIqIHNlZ21lbnQgOiBtX3NlZ21lbnRzKQot ICAgICAgICBjbG9uZS0+bV9idWZmZXItPmRhdGEuYXBwZW5kKHNlZ21lbnQsIHNlZ21lbnRTaXpl KTsKKyAgICBpZiAoIW1fc2VnbWVudHMuaXNFbXB0eSgpKSB7CisgICAgICAgIHVuc2lnbmVkIGxh c3RJbmRleCA9IG1fc2VnbWVudHMuc2l6ZSgpIC0gMTsKKyAgICAgICAgZm9yICh1bnNpZ25lZCBp ID0gMDsgaSA8IGxhc3RJbmRleDsgKytpKQorICAgICAgICAgICAgY2xvbmUtPm1fYnVmZmVyLT5k YXRhLmFwcGVuZChtX3NlZ21lbnRzW2ldLCBzZWdtZW50U2l6ZSk7CisKKyAgICAgICAgdW5zaWdu ZWQgcG9zaXRpb25JblNlZ21lbnQgPSBtX3NpemUgLSBtX2J1ZmZlci0+ZGF0YS5zaXplKCkgLSBs YXN0SW5kZXggKiBzZWdtZW50U2l6ZTsKKyAgICAgICAgY2xvbmUtPm1fYnVmZmVyLT5kYXRhLmFw cGVuZChtX3NlZ21lbnRzLmxhc3QoKSwgcG9zaXRpb25JblNlZ21lbnQpOworICAgIH0KICNlbHNl CiAgICAgZm9yIChhdXRvJiBkYXRhIDogbV9kYXRhQXJyYXkpCiAgICAgICAgIGNsb25lLT5tX2Rh dGFBcnJheS5hcHBlbmQoZGF0YS5nZXQoKSk7CkluZGV4OiBUb29scy9DaGFuZ2VMb2cKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gVG9vbHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAxOTg1MDkpCisrKyBUb29scy9DaGFu Z2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsNSArMSwxNSBAQAogMjAxNi0wMy0yMSAgQnJlbnQg RnVsZ2hhbSAgPGJmdWxnaGFtQGFwcGxlLmNvbT4KIAorICAgICAgICBbV2luXSBTaGFyZWRCdWZm ZXI6OmNvcHkoKSBjYW4gY2F1c2UgYSBzZWdtZW50YXRpb24gZmF1bHQuCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTU3MzkKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIFRlc3RXZWJLaXRBUEkvUGxhdGZv cm1XaW4uY21ha2U6IEJ1aWxkIGFuZCBydW4gdGhlCisgICAgICAgIFNoYXJlZEJ1ZmZlciB0ZXN0 cy4KKworMjAxNi0wMy0yMSAgQnJlbnQgRnVsZ2hhbSAgPGJmdWxnaGFtQGFwcGxlLmNvbT4KKwog ICAgICAgICBJbXByb3ZlIFNoYXJlZEJ1ZmZlciB0ZXN0aW5nCiAgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05MzA3OAogICAgICAgICA8cmRhcjovL3Byb2Js ZW0vMjUyNzc4Mjk+CkluZGV4OiBUb29scy9UZXN0V2ViS2l0QVBJL1BsYXRmb3JtV2luLmNtYWtl Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFRvb2xzL1Rlc3RXZWJLaXRBUEkvUGxhdGZvcm1XaW4uY21ha2UJKHJl dmlzaW9uIDE5ODUwNykKKysrIFRvb2xzL1Rlc3RXZWJLaXRBUEkvUGxhdGZvcm1XaW4uY21ha2UJ KHdvcmtpbmcgY29weSkKQEAgLTE4LDYgKzE4LDcgQEAKIGluY2x1ZGVfZGlyZWN0b3JpZXMoCiAg ICAgJHtERVJJVkVEX1NPVVJDRVNfRElSfQogICAgICR7REVSSVZFRF9TT1VSQ0VTX0RJUn0vRm9y d2FyZGluZ0hlYWRlcnMKKyAgICAke0RFUklWRURfU09VUkNFU19ESVJ9L0ZvcndhcmRpbmdIZWFk ZXJzL0phdmFTY3JpcHRDb3JlCiAgICAgJHtURVNUV0VCS0lUQVBJX0RJUn0vd2luCiAgICAgJHtE RVJJVkVEX1NPVVJDRVNfRElSfS9XZWJLaXQvSW50ZXJmYWNlcwogKQpAQCAtNDMsNiArNDQsNyBA QAogICAgICR7VEVTVFdFQktJVEFQSV9ESVJ9L1Rlc3RzL1dlYkNvcmUvSFRNTFBhcnNlcklkaW9t cy5jcHAKICAgICAke1RFU1RXRUJLSVRBUElfRElSfS9UZXN0cy9XZWJDb3JlL0xheW91dFVuaXQu Y3BwCiAgICAgJHtURVNUV0VCS0lUQVBJX0RJUn0vVGVzdHMvV2ViQ29yZS9QYXJzZWRDb250ZW50 UmFuZ2UuY3BwCisgICAgJHtURVNUV0VCS0lUQVBJX0RJUn0vVGVzdHMvV2ViQ29yZS9TaGFyZWRC dWZmZXIuY3BwCiAgICAgJHtURVNUV0VCS0lUQVBJX0RJUn0vVGVzdHMvV2ViQ29yZS9UaW1lUmFu Z2VzLmNwcAogICAgICR7VEVTVFdFQktJVEFQSV9ESVJ9L1Rlc3RzL1dlYkNvcmUvVVJMLmNwcAog KQo=