157333 2016-05-03 18:20:37 -0700 REGRESSION(r200383): Setting lazily initialized properties across frame boundaries crashes 2016-05-04 13:02:40 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 157045 P2 Normal --- 157045 1 joepeck fpizlo cdumez commit-queue fpizlo ggaren keith_miller mark.lam msaboff ossy saam oldest_to_newest 1189935 0 278051 joepeck 2016-05-03 18:20:37 -0700 Created attachment 278051 [TEST] Test case * SUMMARY Setting lazily initialized properties across frame boundaries crashes. * TEST <iframe id="x" src="data:text/html,<p>Hello</p>"></iframe> <script>window.frames[0].Math = window.Math;</script> * STEPS TO REPRODUCE 1. Load attached test case => CRASH * NOTES - Caught when trying to make `console` lazily initialized by test: LayoutTests/fast/dom/Window/window-lookup-precedence.html * CRASH SNIPPET Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFY Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 ??? 000000000000000000 0 + 0 1 com.apple.JavaScriptCore 0x00000001059bcc93 JSC::callCustomSetter(JSC::ExecState*, bool (*)(JSC::ExecState*, long long, long long), bool, JSC::JSValue, JSC::JSValue) + 19 (CustomGetterSetter.cpp:43) 2 com.apple.JavaScriptCore 0x0000000105e4d3da JSC::putEntry(JSC::ExecState*, JSC::HashTableValue const*, JSC::JSObject*, JSC::JSObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 138 (Lookup.h:312) 3 com.apple.JavaScriptCore 0x0000000105e4c63a JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 1194 (JSObject.cpp:573) 4 com.apple.JavaScriptCore 0x0000000105e476ae JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 526 (JSObjectInlines.h:81) 5 com.apple.JavaScriptCore 0x0000000105e0e0cf JSC::JSGlobalObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 111 (JSGlobalObject.cpp:825) 6 com.apple.WebCore 0x0000000106ee09fa WebCore::JSDOMWindow::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 90 (JSDOMWindowCustom.cpp:315) 7 com.apple.JavaScriptCore 0x0000000105dbce9a JSC::putByVal(JSC::ExecState*, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::ByValInfo*) + 1466 (JSCJSValueInlines.h:840) 8 ??? 0x000039d551e0e7b3 0 + 63588364511155 9 com.apple.JavaScriptCore 0x0000000105f283c2 llint_entry + 23764 10 com.apple.JavaScriptCore 0x0000000105f2250b vmEntryToJavaScript + 299 11 com.apple.JavaScriptCore 0x0000000105d9a74e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 158 (JITCode.cpp:81) 12 com.apple.JavaScriptCore 0x0000000105d51536 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 15110 (Interpreter.cpp:960) 13 com.apple.JavaScriptCore 0x00000001059b1f25 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 469 (Completion.cpp:106) 14 com.apple.WebCore 0x00000001074e9cfe WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*) + 302 (JSMainThreadExecState.h:81) 15 com.apple.WebCore 0x00000001074efdc7 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 567 (CurrentScriptIncrementer.h:50) 16 com.apple.WebCore 0x00000001074ee6fa WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 1066 (StdLibExtras.h:370) 17 com.apple.WebCore 0x0000000106cb5d02 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 338 (ScriptElement.h:59) 18 com.apple.WebCore 0x0000000106cb5b60 WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) + 48 (HTMLScriptRunner.cpp:189) 19 com.apple.WebCore 0x0000000106c5358c WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 316 (StdLibExtras.h:370) 20 com.apple.WebCore 0x0000000106c5393d WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) + 669 (HTMLDocumentParser.cpp:234) 21 com.apple.WebCore 0x0000000106c532c3 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 115 (DocumentParser.h:70) ... 1189950 1 fpizlo 2016-05-03 19:25:17 -0700 Crazy! I can take a look. 1189963 2 fpizlo 2016-05-03 20:22:15 -0700 Wow, this is a huge omission in the original patch. Luckily, it's easy to fix. Basically, I forgot to thread the new hashtable attributes through putEntry. I didn't realize that putEntry had to also know about all of the attributes. 1189972 3 278063 fpizlo 2016-05-03 20:54:42 -0700 Created attachment 278063 the patch 1189975 4 278063 commit-queue 2016-05-03 22:00:32 -0700 Comment on attachment 278063 the patch Clearing flags on attachment: 278063 Committed r200406: <http://trac.webkit.org/changeset/200406> 1189976 5 commit-queue 2016-05-03 22:00:36 -0700 All reviewed patches have been landed. Closing bug. 1190082 6 cdumez 2016-05-04 08:47:45 -0700 Reverted r200383 and r200406 for reason: Seems to have caused crashes on iOS / ARMv7s Committed r200416: <http://trac.webkit.org/changeset/200416> 1190173 7 fpizlo 2016-05-04 13:02:40 -0700 *** This bug has been marked as a duplicate of bug 157045 *** 278051 2016-05-03 18:20:37 -0700 2016-05-03 20:54:42 -0700 [TEST] Test case test.html text/html 113 joepeck PGlmcmFtZSBpZD0ieCIgc3JjPSJkYXRhOnRleHQvaHRtbCw8cD5IZWxsbzwvcD4iPjwvaWZyYW1l Pgo8c2NyaXB0PndpbmRvdy5mcmFtZXNbMF0uTWF0aCA9IHdpbmRvdy5NYXRoOzwvc2NyaXB0Pgo= 278063 2016-05-03 20:54:42 -0700 2016-05-03 22:00:32 -0700 the patch blah.patch text/plain 5032 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjAwNDA1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBA CisyMDE2LTA1LTAzICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg UkVHUkVTU0lPTihyMjAwMzgzKTogU2V0dGluZyBsYXppbHkgaW5pdGlhbGl6ZWQgcHJvcGVydGll cyBhY3Jvc3MgZnJhbWUgYm91bmRhcmllcyBjcmFzaGVzCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTczMzMKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAgICAgIEkgZm9yZ290IHRvIGFkZCBsb2dpYyBm b3IgbGF6eSBwcm9wZXJ0aWVzIGluIHB1dEVudHJ5KCkuIEl0IHR1cm5zIG91dCB0aGF0IGl0J3Mg ZWFzeSB0bworICAgICAgICBhZGQuCisKKyAgICAgICAgKiBydW50aW1lL0xvb2t1cC5oOgorICAg ICAgICAoSlNDOjpwdXRFbnRyeSk6CisgICAgICAgICogcnVudGltZS9Qcm9wZXJ0eVNsb3QuaDoK KwogMjAxNi0wNS0wMyAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29tPgogCiAgICAgICAg IFJlZmVyZW5jZXMgZnJvbSBjb2RlIHRvIFN0cnVjdHVyZXMgc2hvdWxkIGJlIHN0cm9uZ2VyIHRo YW4gd2VhawpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvTG9va3VwLmgKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvTG9va3VwLmgJKHJldmlz aW9uIDIwMDQwNSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0xvb2t1cC5oCSh3 b3JraW5nIGNvcHkpCkBAIC0yOTMsOSArMjkzLDEwIEBAIGlubGluZSBib29sIGdldFN0YXRpY1Zh bHVlU2xvdChFeGVjU3RhdGUKIC8vICdzbG90LnRoaXNWYWx1ZSgpJyBpcyB0aGUgb2JqZWN0IHRo ZSBwdXQgd2FzIG9yaWdpbmFsbHkgcGVyZm9ybWVkIG9uIChpbiB0aGUgY2FzZSBvZiBhIHByb3h5 LCB0aGUgcHJveHkgaXRzZWxmKS4KIGlubGluZSBib29sIHB1dEVudHJ5KEV4ZWNTdGF0ZSogZXhl YywgY29uc3QgSGFzaFRhYmxlVmFsdWUqIGVudHJ5LCBKU09iamVjdCogYmFzZSwgSlNPYmplY3Qq IHRoaXNWYWx1ZSwgUHJvcGVydHlOYW1lIHByb3BlcnR5TmFtZSwgSlNWYWx1ZSB2YWx1ZSwgUHV0 UHJvcGVydHlTbG90JiBzbG90KQogewotICAgIGlmIChlbnRyeS0+YXR0cmlidXRlcygpICYgQnVp bHRpbk9yRnVuY3Rpb24pIHsKKyAgICBpZiAoZW50cnktPmF0dHJpYnV0ZXMoKSAmIEJ1aWx0aW5P ckZ1bmN0aW9uT3JMYXp5UHJvcGVydHkpIHsKICAgICAgICAgaWYgKCEoZW50cnktPmF0dHJpYnV0 ZXMoKSAmIFJlYWRPbmx5KSkgewotICAgICAgICAgICAgLy8gSWYgdGhpcyBpcyBhIGZ1bmN0aW9u IHB1dCBpdCBhcyBhbiBvdmVycmlkZSBwcm9wZXJ0eS4KKyAgICAgICAgICAgIC8vIElmIHRoaXMg aXMgYSBmdW5jdGlvbiBvciBsYXp5IHByb3BlcnR5IHB1dCB0aGVuIHdlIGp1c3QgZG8gdGhlIHB1 dCBiZWNhdXNlCisgICAgICAgICAgICAvLyBsb2dpY2FsbHkgdGhlIG9iamVjdCBhbHJlYWR5IGhh ZCB0aGUgcHJvcGVydHksIHNvIHRoaXMgaXMganVzdCBhIHJlcGxhY2UuCiAgICAgICAgICAgICBp ZiAoSlNPYmplY3QqIHRoaXNPYmplY3QgPSBqc0R5bmFtaWNDYXN0PEpTT2JqZWN0Kj4odGhpc1Zh bHVlKSkKICAgICAgICAgICAgICAgICB0aGlzT2JqZWN0LT5wdXREaXJlY3QoZXhlYy0+dm0oKSwg cHJvcGVydHlOYW1lLCB2YWx1ZSk7CiAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsKSW5kZXg6IFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1Byb3BlcnR5U2xvdC5oCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1Byb3BlcnR5U2xvdC5oCShyZXZpc2lvbiAy MDA0MDUpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9Qcm9wZXJ0eVNsb3QuaAko d29ya2luZyBjb3B5KQpAQCAtNTAsNiArNTAsNyBAQCBlbnVtIEF0dHJpYnV0ZSB7CiAgICAgQ2xh c3NTdHJ1Y3R1cmUgICAgPSAxIDw8IDEyLCAvLyBwcm9wZXJ0eSBpcyBhIGxhenkgY2xhc3Mgc3Ry dWN0dXJlIC0gb25seSB1c2VkIGJ5IHN0YXRpYyBoYXNodGFibGVzCiAgICAgUHJvcGVydHlDYWxs YmFjayAgPSAxIDw8IDEzLCAvLyBwcm9wZXJ0eSB0aGF0IGlzIGEgbGF6eSBwcm9wZXJ0eSBjYWxs YmFjayAtIG9ubHkgdXNlZCBieSBzdGF0aWMgaGFzaHRhYmxlcwogICAgIEJ1aWx0aW5PckZ1bmN0 aW9uID0gQnVpbHRpbiB8IEZ1bmN0aW9uLCAvLyBoZWxwZXIgb25seSB1c2VkIGJ5IHN0YXRpYyBo YXNodGFibGVzCisgICAgQnVpbHRpbk9yRnVuY3Rpb25PckxhenlQcm9wZXJ0eSA9IEJ1aWx0aW4g fCBGdW5jdGlvbiB8IENlbGxQcm9wZXJ0eSB8IENsYXNzU3RydWN0dXJlIHwgUHJvcGVydHlDYWxs YmFjaywgLy8gaGVscGVyIG9ubHkgdXNlZCBieSBzdGF0aWMgaGFzaHRhYmxlcwogICAgIEJ1aWx0 aW5PckZ1bmN0aW9uT3JBY2Nlc3Nvck9yTGF6eVByb3BlcnR5ID0gQnVpbHRpbiB8IEZ1bmN0aW9u IHwgQWNjZXNzb3IgfCBDZWxsUHJvcGVydHkgfCBDbGFzc1N0cnVjdHVyZSB8IFByb3BlcnR5Q2Fs bGJhY2ssIC8vIGhlbHBlciBvbmx5IHVzZWQgYnkgc3RhdGljIGhhc2h0YWJsZXMKICAgICBCdWls dGluT3JGdW5jdGlvbk9yQWNjZXNzb3JPckxhenlQcm9wZXJ0eU9yQ29uc3RhbnQgPSBCdWlsdGlu IHwgRnVuY3Rpb24gfCBBY2Nlc3NvciB8IENlbGxQcm9wZXJ0eSB8IENsYXNzU3RydWN0dXJlIHwg UHJvcGVydHlDYWxsYmFjayB8IENvbnN0YW50SW50ZWdlciAvLyBoZWxwZXIgb25seSB1c2VkIGJ5 IHN0YXRpYyBoYXNodGFibGVzCiB9OwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMjAwNDA1KQorKysgTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTYt MDUtMDMgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNT SU9OKHIyMDAzODMpOiBTZXR0aW5nIGxhemlseSBpbml0aWFsaXplZCBwcm9wZXJ0aWVzIGFjcm9z cyBmcmFtZSBib3VuZGFyaWVzIGNyYXNoZXMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTE1NzMzMworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorICAgICAgICAKKyAgICAgICAgVGhpcyBpcyBKb2VQZWNrJ3Mgb3JpZ2luYWwgdGVz dCBjYXNlLiBJdCB1c2VkIHRvIGNyYXNoIGFuZCBub3cgaXQgZG9lc24ndCBjcmFzaCBhbnltb3Jl LgorCisgICAgICAgICoganMvZG9tL2Nyb3NzLXdpbmRvdy1wdXQtbWF0aC1leHBlY3RlZC50eHQ6 IEFkZGVkLgorICAgICAgICAqIGpzL2RvbS9jcm9zcy13aW5kb3ctcHV0LW1hdGguaHRtbDogQWRk ZWQuCisKIDIwMTYtMDUtMDMgIFl1c3VrZSBTdXp1a2kgIDx1dGF0YW5lLnRlYUBnbWFpbC5jb20+ CiAKICAgICAgICAgSW1wcm92ZSBTeW1ib2woKSB0byBzdHJpbmcgY29lcmNpb24gZXJyb3IgbWVz c2FnZQpJbmRleDogTGF5b3V0VGVzdHMvanMvZG9tL2Nyb3NzLXdpbmRvdy1wdXQtbWF0aC1leHBl Y3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvanMvZG9tL2Nyb3NzLXdpbmRvdy1w dXQtbWF0aC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9kb20v Y3Jvc3Mtd2luZG93LXB1dC1tYXRoLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMCww ICsxLDkgQEAKKworVGVzdCBzdG9yaW5nIHRvIGEgbGF6eSBnbG9iYWwgcHJvcGVydHkuCisKK09u IHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxv d2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1 ZQorCitURVNUIENPTVBMRVRFCisKSW5kZXg6IExheW91dFRlc3RzL2pzL2RvbS9jcm9zcy13aW5k b3ctcHV0LW1hdGguaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9kb20vY3Jvc3Mt d2luZG93LXB1dC1tYXRoLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9kb20v Y3Jvc3Mtd2luZG93LXB1dC1tYXRoLmh0bWwJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwxNiBA QAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxoZWFkPgorPHNjcmlwdCBzcmM9Ii4uLy4uL3Jl c291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxpZnJh bWUgaWQ9IngiIHNyYz0iZGF0YTp0ZXh0L2h0bWwsPHA+SGVsbG88L3A+Ij48L2lmcmFtZT4KKzxk aXYgaWQ9ImRlc2NyaXB0aW9uIj48L2Rpdj4KKzxkaXYgaWQ9ImNvbnNvbGUiPjwvZGl2PgorPHNj cmlwdD4KK2Rlc2NyaXB0aW9uKCdUZXN0IHN0b3JpbmcgdG8gYSBsYXp5IGdsb2JhbCBwcm9wZXJ0 eS4nKTsKK3dpbmRvdy5mcmFtZXNbMF0uTWF0aCA9IHdpbmRvdy5NYXRoOworPC9zY3JpcHQ+Cis8 c2NyaXB0IHNyYz0iLi4vLi4vcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8 L2JvZHk+Cis8L2h0bWw+Cg==