156804 2016-04-20 12:02:35 -0700 Potential overflow in RenderLayer::hitTestList() 2016-04-20 12:56:57 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=156796 InRadar P2 Normal --- 1 cdumez cdumez commit-queue darin esprehn+autocc glenn kondapallykalyan simon.fraser webkit-bug-importer zalan oldest_to_newest 1185494 0 cdumez 2016-04-20 12:02:35 -0700 Potential overflow in RenderLayer::hitTestList(): 1 com.apple.JavaScriptCore 0x7fff8d8dd7ce WTFCrash + 0x3e 2 com.apple.WebCore 0x7fff9772ccc9 WTF::CrashOnOverflow::crash() + 0x9 3 com.apple.WebCore 0x7fff9772ccb9 WTF::CrashOnOverflow::overflowed() + 0x9 > 4 com.apple.WebCore 0x7fff9804d8ee WebCore::RenderLayer::hitTestList(WTF::Vector<WebCore::RenderLayer*, 0ul, WTF::CrashOnOverflow, 16ul>*, WebCore::RenderLayer*, WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::LayoutRect const&, WebCore::HitTestLocation const&, WebCore::HitTestingTransformState const*, double*, double*, WebCore::HitTestingTransformState const*, bool) + 0x1ae 5 com.apple.WebCore 0x7fff9758ae95 WebCore::RenderLayer::hitTestLayer(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::LayoutRect const&, WebCore::HitTestLocation const&, bool, WebCore::HitTestingTransformState const*, double*) + 0x565 6 com.apple.WebCore 0x7fff9804d85f WebCore::RenderLayer::hitTestList(WTF::Vector<WebCore::RenderLayer*, 0ul, WTF::CrashOnOverflow, 16ul>*, WebCore::RenderLayer*, WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::LayoutRect const&, WebCore::HitTestLocation const&, WebCore::HitTestingTransformState const*, double*, double*, WebCore::HitTestingTransformState const*, bool) + 0x11f 7 com.apple.WebCore 0x7fff9758ae04 WebCore::RenderLayer::hitTestLayer(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::LayoutRect const&, WebCore::HitTestLocation const&, bool, WebCore::HitTestingTransformState const*, double*) + 0x4d4 8 com.apple.WebCore 0x7fff9758a8a0 WebCore::RenderLayer::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestLocation const&, WebCore::HitTestResult&) + 0x250 9 com.apple.WebCore 0x7fff97634a8e WebCore::RenderView::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestLocation const&, WebCore::HitTestResult&) + 0x6e 10 com.apple.WebCore 0x7fff9758a45f WebCore::EventHandler::hitTestResultAtPoint(WebCore::LayoutPoint const&, unsigned int, WebCore::LayoutSize const&) + 0xcf 11 com.apple.WebKit 0x7fff8f250c34 WebKit::WebFrame::hitTest(WebCore::IntPoint) const + 0xc2 12 com.apple.WebKit 0x7fff8f250b3d WKBundleFrameCreateHitTestResult + 0x35 13 com.apple.Safari.framework 0x7fff966d3bc5 Safari::WK::BundleFrame::hitTest(CGPoint) const + 0x1f 14 com.apple.Safari.framework 0x7fff965b2e09 Safari::ArticleFinderJSController::nodeAtPoint(double, double) const + 0x23 15 com.apple.JavaScriptCore 0x7fff8dbda39b long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::ExecState*) + 0x23b 16 com.apple.JavaScriptCore 0x7fff8d77fda0 JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 0x210 1185495 1 cdumez 2016-04-20 12:02:54 -0700 rdar://problem/23249479 1185497 2 276841 cdumez 2016-04-20 12:05:17 -0700 Created attachment 276841 Patch 1185499 3 276841 simon.fraser 2016-04-20 12:07:51 -0700 Comment on attachment 276841 Patch This is a good change but I don't think it fixes the underlying cause of the bug. 1185503 4 cdumez 2016-04-20 12:12:11 -0700 (In reply to comment #3) > Comment on attachment 276841 [details] > Patch > > This is a good change but I don't think it fixes the underlying cause of the > bug. Similar fix at https://bugs.webkit.org/show_bug.cgi?id=156796 where there were also overflow crashes. 1185512 5 276841 commit-queue 2016-04-20 12:56:52 -0700 Comment on attachment 276841 Patch Clearing flags on attachment: 276841 Committed r199781: <http://trac.webkit.org/changeset/199781> 1185513 6 commit-queue 2016-04-20 12:56:57 -0700 All reviewed patches have been landed. Closing bug. 276841 2016-04-20 12:05:17 -0700 2016-04-20 12:56:52 -0700 Patch bug-156804-20160420120538.patch text/plain 1635 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMTk5Nzc4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYTRmNWM3MTZlOGFiM2E5 ZTNkMzAzZTc4NDJkZmMwODQyZGQ2MjcwZC4uODQ1ZDBhMzQwNTIxZjI2YmU1YWQwNjZiYTA3NDk4 MTIwODIyNTY4OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE2LTA0LTIwICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUG90ZW50aWFsIG92ZXJmbG93 IGluIFJlbmRlckxheWVyOjpoaXRUZXN0TGlzdCgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTY4MDQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBVc2Ugc2l6ZV90IHR5cGUgaW5zdGVhZCBvZiBpbnQgdG8g aXRlcmF0ZSBvdmVyIHRoZSBWZWN0b3IgdG8gbWFrZSBzdXJlCisgICAgICAgIHdlIGRvbid0IG92 ZXJmbG93LiBUaGlzIGlzIGEgc3BlY3VsYXRpdmUgZml4IGZvciA8cmRhcjovL3Byb2JsZW0vMjMy NDk0Nzk+LgorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlckxheWVyLmNwcDoKKyAgICAgICAg KFdlYkNvcmU6OlJlbmRlckxheWVyOjpoaXRUZXN0TGlzdCk6CisKIDIwMTYtMDQtMjAgIERhdmUg SHlhdHQgIDxoeWF0dEBhcHBsZS5jb20+CiAKICAgICAgICAgSGFuZ2FibGUgcHVuY3R1YXRpb24g bWVhc3VyZW1lbnQgdXNpbmcgdGhlIHdyb25nIGluZGljZXMuCmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5ZXIuY3BwIGIvU291cmNlL1dlYkNvcmUvcmVuZGVy aW5nL1JlbmRlckxheWVyLmNwcAppbmRleCBhMjUyMDQwMjQ0MDBjZWQ3MzYyZjk0MmE4ZGJlYWJi NTZmMmE4ZTgzLi44NzJjYjg5ZjQ3OWY5NzU1MzMwNzNkMmM5MzI2ZjdhZjIxMDlhYjQzIDEwMDY0 NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5ZXIuY3BwCisrKyBiL1Nv dXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJMYXllci5jcHAKQEAgLTUzNTIsOCArNTM1Miw4 IEBAIFJlbmRlckxheWVyKiBSZW5kZXJMYXllcjo6aGl0VGVzdExpc3QoVmVjdG9yPFJlbmRlckxh eWVyKj4qIGxpc3QsIFJlbmRlckxheWVyKiByCiAgICAgICAgIHJldHVybiBudWxscHRyOwogCiAg ICAgUmVuZGVyTGF5ZXIqIHJlc3VsdExheWVyID0gbnVsbHB0cjsKLSAgICBmb3IgKGludCBpID0g bGlzdC0+c2l6ZSgpIC0gMTsgaSA+PSAwOyAtLWkpIHsKLSAgICAgICAgUmVuZGVyTGF5ZXIqIGNo aWxkTGF5ZXIgPSBsaXN0LT5hdChpKTsKKyAgICBmb3IgKHNpemVfdCBpID0gbGlzdC0+c2l6ZSgp OyBpID4gMDsgLS1pKSB7CisgICAgICAgIFJlbmRlckxheWVyKiBjaGlsZExheWVyID0gbGlzdC0+ YXQoaSAtIDEpOwogICAgICAgICBpZiAoY2hpbGRMYXllci0+aXNGbG93VGhyZWFkQ29sbGVjdGlu Z0dyYXBoaWNzTGF5ZXJzVW5kZXJSZWdpb25zKCkpCiAgICAgICAgICAgICBjb250aW51ZTsKICAg ICAgICAgUmVuZGVyTGF5ZXIqIGhpdExheWVyID0gbnVsbHB0cjsK