158378 2016-06-03 22:42:47 -0700 Crash inside moveOutOfAllShadowRoots 2016-06-06 19:38:44 -0700 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 148695 116046 1 rniwa rniwa calvaris cdumez commit-queue eric.carlson esprehn+autocc gyuyoung.kim jer.noble kangil.han kling koivisto philipj webkit-bug-importer oldest_to_newest 1199220 0 rniwa 2016-06-03 22:42:47 -0700 Sometimes, we're not removing InShadowTreeFlag after removing a node. In addition, I'm fixing a bug in VTTCue::~VTTCue that it could ref a document while the document is being destructed. 1199223 1 280510 rniwa 2016-06-03 22:59:51 -0700 Created attachment 280510 Fixes the bug 1199234 2 280510 cdumez 2016-06-04 10:04:07 -0700 Comment on attachment 280510 Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=280510&action=review > Source/WebCore/html/track/VTTCue.cpp:271 > + if (m_displayTree && m_displayTree->document().refCount()) It seems very odd to have to check the document ref count. It is also weird that bodes would have to remove themselves from the tree upon destruction. I could not find the code that adds this displayTree to the DOM. 1199297 3 rniwa 2016-06-04 15:41:56 -0700 (In reply to comment #2) > Comment on attachment 280510 [details] > Fixes the bug > > View in context: > https://bugs.webkit.org/attachment.cgi?id=280510&action=review > > > Source/WebCore/html/track/VTTCue.cpp:271 > > + if (m_displayTree && m_displayTree->document().refCount()) > > It seems very odd to have to check the document ref count. It is also weird > that bodes would have to remove themselves from the tree upon destruction. I > could not find the code that adds this displayTree to the DOM. That's done in HTMLMediaElement. The problem here is that m_displayTree refers back to VTTCue using a reference so we can end up doing a use-after-free if we don't remove the nodes from the UA shadow tree. However, when the document itself is being destructed, we don't need to do this because we won't be updating style, etc... anymore. On the other hand, Node::remove would try to ref the document before dispatching mutation events, and this would hit an assertion since we've already began destructing the document. An alternative approach would be to change the reference to a pointer and set it to null when VTTCue is getting destroyed. 1199699 4 koivisto 2016-06-06 13:37:40 -0700 > An alternative approach would be to change the reference to a pointer and > set it to null when VTTCue is getting destroyed. That might be nicer. 1199834 5 rniwa 2016-06-06 18:45:18 -0700 (In reply to comment #4) > > An alternative approach would be to change the reference to a pointer and > > set it to null when VTTCue is getting destroyed. > > That might be nicer. I'm going to add a FIXME for now since I'm not an expert on this area and I couldn't get a feedback from Eric & Jer. 1199835 6 webkit-bug-importer 2016-06-06 18:45:54 -0700 <rdar://problem/26664749> 1199850 7 rniwa 2016-06-06 19:38:44 -0700 Committed r201736: <http://trac.webkit.org/changeset/201736> 280510 2016-06-03 22:59:51 -0700 2016-06-06 13:37:16 -0700 Fixes the bug bug-158378-20160603230113.patch text/plain 5842 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwMTY3OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI1IEBACisyMDE2LTA2LTAzICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIENyYXNoIGluc2lkZSBtb3ZlT3V0 T2ZBbGxTaGFkb3dSb290cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MTU4Mzc4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgVGhlIGJ1ZyB3YXMgY2F1c2VkIGJ5IEluU2hhZG93VHJlZUZsYWcgbm90IGJlaW5n IGNsZWFyZWQgd2hlbiBhIHNoYWRvdyBob3N0IG9yIGl0cyBhbmNlc3RvciB3YXMgcmVtb3ZlZAor ICAgICAgICBkdWUgdG8gYWRkQ2hpbGROb2Rlc1RvRGVsZXRpb25RdWV1ZSBub3QgaW52b2tpbmcg bm90aWZ5Q2hpbGROb2RlUmVtb3ZlZCB3aGVuIGEgbm9kZSB3YXMgaW4gYSBzaGFkb3cgdHJlZQor ICAgICAgICBidXQgbm90IGluIGEgZG9jdW1lbnQuCisKKyAgICAgICAgRml4ZWQgdGhlIGJ1ZyBi eSBpbnZva2luZyBub3RpZnlDaGlsZE5vZGVSZW1vdmVkIHdoZW4gdGhlIHJlbW92ZWQgbm9kZSBp cyBlaXRoZXIgaW4gYSBzaGFkb3cgdHJlZQorICAgICAgICBvciBpdCdzIGluIGEgc2hhZG93IHRy ZWUuIEFsc28gZml4ZWQgYSBidWcgaW4gVlRUQ3VlOjp+VlRUQ3VlIHRoYXQgaXQgd2FzIHRyeWlu ZyB0byByZW1vdmUgdGhlIGRpc3BsYXkKKyAgICAgICAgdHJlZSBldmVuIHdoZW4gdGhlIG93bmVy IGRvY3VtZW50IHdhcyBiZWluZyBkZXN0cm95ZWQuIFRoaXMgcmVzdWx0cyBpbiB2YXJpb3VzIGFz c2VydGlvbnMgdG8gYmUgaGl0LgorCisgICAgICAgIFRlc3Q6IGZhc3Qvc2hhZG93LWRvbS9zaGFk b3ctaG9zdC1yZW1vdmFsLWNyYXNoLmh0bWwKKworICAgICAgICAqIGRvbS9Db250YWluZXJOb2Rl QWxnb3JpdGhtcy5jcHA6CisgICAgICAgIChXZWJDb3JlOjphZGRDaGlsZE5vZGVzVG9EZWxldGlv blF1ZXVlKToKKyAgICAgICAgKiBodG1sL3RyYWNrL1ZUVEN1ZS5jcHA6CisgICAgICAgIChXZWJD b3JlOjpWVFRDdWU6On5WVFRDdWUpOgorCiAyMDE2LTA2LTAzICBNeWxlcyBDLiBNYXhmaWVsZCAg PG1tYXhmaWVsZEBhcHBsZS5jb20+CiAKICAgICAgICAgQm9wb21vZm8gcnVieSBpbiBEaWN0aW9u YXJ5LmFwcCBpcyB3cml0dGVuIGhvcml6b250YWxseSAod2hlbiBpdCBzaG91bGQgYmUgd3JpdHRl biB2ZXJ0aWNhbGx5KQpJbmRleDogU291cmNlL1dlYkNvcmUvZG9tL0NvbnRhaW5lck5vZGVBbGdv cml0aG1zLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9kb20vQ29udGFpbmVyTm9k ZUFsZ29yaXRobXMuY3BwCShyZXZpc2lvbiAyMDE2NzEpCisrKyBTb3VyY2UvV2ViQ29yZS9kb20v Q29udGFpbmVyTm9kZUFsZ29yaXRobXMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xODgsNyArMTg4 LDcgQEAgdm9pZCBhZGRDaGlsZE5vZGVzVG9EZWxldGlvblF1ZXVlKE5vZGUqJgogICAgICAgICAg ICAgUmVmPE5vZGU+IHByb3RlY3QoKm5vZGUpOyAvLyByZW1vdmVkRnJvbURvY3VtZW50IG1heSBy ZW1vdmUgcmVtb3ZlIGFsbCByZWZlcmVuY2VzIHRvIHRoaXMgbm9kZS4KICAgICAgICAgICAgIGlm IChEb2N1bWVudCogY29udGFpbmVyRG9jdW1lbnQgPSBjb250YWluZXIub3duZXJEb2N1bWVudCgp KQogICAgICAgICAgICAgICAgIGNvbnRhaW5lckRvY3VtZW50LT5hZG9wdElmTmVlZGVkKG5vZGUp OwotICAgICAgICAgICAgaWYgKG5vZGUtPmluRG9jdW1lbnQoKSkKKyAgICAgICAgICAgIGlmIChu b2RlLT5pc0luVHJlZVNjb3BlKCkpCiAgICAgICAgICAgICAgICAgbm90aWZ5Q2hpbGROb2RlUmVt b3ZlZChjb250YWluZXIsICpub2RlKTsKICAgICAgICAgfQogICAgIH0KSW5kZXg6IFNvdXJjZS9X ZWJDb3JlL2h0bWwvdHJhY2svVlRUQ3VlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29y ZS9odG1sL3RyYWNrL1ZUVEN1ZS5jcHAJKHJldmlzaW9uIDIwMTY3MSkKKysrIFNvdXJjZS9XZWJD b3JlL2h0bWwvdHJhY2svVlRUQ3VlLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjY4LDEwICsyNjgs OCBAQCBWVFRDdWU6OlZUVEN1ZShTY3JpcHRFeGVjdXRpb25Db250ZXh0JiBjCiAKIFZUVEN1ZTo6 flZUVEN1ZSgpCiB7Ci0gICAgaWYgKCFoYXNEaXNwbGF5VHJlZSgpKQotICAgICAgICByZXR1cm47 Ci0KLSAgICBkaXNwbGF5VHJlZUludGVybmFsKCktPnJlbW92ZShBU1NFUlRfTk9fRVhDRVBUSU9O KTsKKyAgICBpZiAobV9kaXNwbGF5VHJlZSAmJiBtX2Rpc3BsYXlUcmVlLT5kb2N1bWVudCgpLnJl ZkNvdW50KCkpCisgICAgICAgIG1fZGlzcGxheVRyZWUtPnJlbW92ZShBU1NFUlRfTk9fRVhDRVBU SU9OKTsKIH0KIAogdm9pZCBWVFRDdWU6OmluaXRpYWxpemUoU2NyaXB0RXhlY3V0aW9uQ29udGV4 dCYgY29udGV4dCkKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwMTY3MSkKKysrIExheW91dFRlc3RzL0No YW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE2LTA2LTAzICBSeW9z dWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIENyYXNoIGluc2lkZSBtb3Zl T3V0T2ZBbGxTaGFkb3dSb290cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTU4Mzc4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgQWRkZWQgYSByZWdyZXNzaW9uIHRlc3QgdGhhdCByZXByb2R1Y2VkIHRoZSBj cmFzaCByZWxpYWJseSBhdCBsZWFzdCBvbiBteSBtYWNoaW5lLgorCisgICAgICAgICogZmFzdC9z aGFkb3ctZG9tL3NoYWRvdy1ob3N0LXJlbW92YWwtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4K KyAgICAgICAgKiBmYXN0L3NoYWRvdy1kb20vc2hhZG93LWhvc3QtcmVtb3ZhbC1jcmFzaC5odG1s OiBBZGRlZC4KKyAgICAgICAgKiBwbGF0Zm9ybS9pb3Mtc2ltdWxhdG9yL1Rlc3RFeHBlY3RhdGlv bnM6CisKIDIwMTYtMDYtMDMgIFJ5b3N1a2UgTml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CiAKICAg ICAgICAgQ3Jhc2ggdW5kZXIgVmlzaWJsZVNlbGVjdGlvbjo6Zmlyc3RSYW5nZSgpCkluZGV4OiBM YXlvdXRUZXN0cy9mYXN0L3NoYWRvdy1kb20vc2hhZG93LWhvc3QtcmVtb3ZhbC1jcmFzaC1leHBl Y3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9zaGFkb3ctZG9tL3NoYWRv dy1ob3N0LXJlbW92YWwtY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0 VGVzdHMvZmFzdC9zaGFkb3ctZG9tL3NoYWRvdy1ob3N0LXJlbW92YWwtY3Jhc2gtZXhwZWN0ZWQu dHh0CSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsNCBAQAorVGhpcyB0ZXN0cyByZW1vdmluZyBh IHNoYWRvdyBob3N0IHdoaWxlIEV2ZW50SGFuZGxlciBob2xkcyBvbnRvIGl0cyBzaGFkb3cgZGVz Y2VuZGVudC4gV2ViS2l0IHNob3VsZCBub3QgaGl0IGFuIGFzc2VydGlvbiBvciBjcmFzaC4gVGhp cyB0ZXN0IHJlcXVpcmVzIHdpbmRvdy5ldmVudFNlbmRlciB0byBydW4uCisKK2ZvbworYmFyCklu ZGV4OiBMYXlvdXRUZXN0cy9mYXN0L3NoYWRvdy1kb20vc2hhZG93LWhvc3QtcmVtb3ZhbC1jcmFz aC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3Qvc2hhZG93LWRvbS9zaGFkb3ct aG9zdC1yZW1vdmFsLWNyYXNoLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0 L3NoYWRvdy1kb20vc2hhZG93LWhvc3QtcmVtb3ZhbC1jcmFzaC5odG1sCSh3b3JraW5nIGNvcHkp CkBAIC0wLDAgKzEsMzEgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8Ym9keSBvbmxvYWQ9 InJ1blRlc3QoKTsiPgorPHA+VGhpcyB0ZXN0cyByZW1vdmluZyBhIHNoYWRvdyBob3N0IHdoaWxl IEV2ZW50SGFuZGxlciBob2xkcyBvbnRvIGl0cyBzaGFkb3cgZGVzY2VuZGVudC4KK1dlYktpdCBz aG91bGQgbm90IGhpdCBhbiBhc3NlcnRpb24gb3IgY3Jhc2guIFRoaXMgdGVzdCByZXF1aXJlcyB3 aW5kb3cuZXZlbnRTZW5kZXIgdG8gcnVuLjwvcD4KKzxkaXYgaWQ9ImxvZyI+PC9kaXY+Cis8ZGl2 IGlkPSJjb250YWluZXIiPjxpbnB1dD48ZGl2PjxzcGFuPnRleHQ8L3NwYW4+PC9kaXY+PC9kaXY+ Cis8c2NyaXB0PgorCitmdW5jdGlvbiBjbGlja0NlbnRlcihlbGVtZW50KSB7CisgICAgZXZlbnRT ZW5kZXIubW91c2VNb3ZlVG8oZWxlbWVudC5vZmZzZXRMZWZ0ICsgZWxlbWVudC5vZmZzZXRXaWR0 aCAvIDIsIGVsZW1lbnQub2Zmc2V0VG9wICsgZWxlbWVudC5vZmZzZXRIZWlnaHQgLyAyKTsKKyAg ICBldmVudFNlbmRlci5tb3VzZURvd24oKTsKK30KKworZnVuY3Rpb24gcnVuVGVzdCgpIHsKKyAg ICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKworICAgIHZhciBjb250YWluZXIgPSBkb2N1bWVu dC5xdWVyeVNlbGVjdG9yKCcjY29udGFpbmVyJyk7CisKKyAgICBjbGlja0NlbnRlcihkb2N1bWVu dC5xdWVyeVNlbGVjdG9yKCcjY29udGFpbmVyIHNwYW4nKSk7CisKKyAgICBkb2N1bWVudC5nZXRF bGVtZW50QnlJZCgnbG9nJykuaW5uZXJIVE1MID0gJ2Zvbyc7CisgICAgZXZlbnRTZW5kZXIubW91 c2VEb3duKCk7CisgICAgY29udGFpbmVyLmlubmVySFRNTCA9ICdiYXInOworCisgICAgY2xpY2tD ZW50ZXIoY29udGFpbmVyKTsKK30KKworPC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CkluZGV4 OiBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9pb3Mtc2ltdWxhdG9yL1Rlc3RFeHBlY3RhdGlvbnMKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gTGF5b3V0VGVzdHMvcGxhdGZvcm0vaW9zLXNpbXVsYXRvci9UZXN0RXhwZWN0 YXRpb25zCShyZXZpc2lvbiAyMDE2NzEpCisrKyBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9pb3Mtc2lt dWxhdG9yL1Rlc3RFeHBlY3RhdGlvbnMJKHdvcmtpbmcgY29weSkKQEAgLTI3NSw2ICsyNzUsNyBA QCBmYXN0L3RleHQvYWxsLXNtYWxsLWNhcHMtd2hpdGVzcGFjZS5odG1sCiAKICMgVGhpcyB0ZXN0 IHJlbGllcyBvbiBFdmVudFNlbmRlci5rZXlkb3duKCksIHdoaWNoIGlzIG5vdCBzdXBwb3J0ZWQg b24gaU9TCiB3ZWJraXQub3JnL2IvMTU1MjMzIGZhc3QvZXZlbnRzL21heC10YWJpbmRleC1mb2N1 cy5odG1sIFsgU2tpcCBdCitmYXN0L3NoYWRvdy1kb20vc2hhZG93LWhvc3QtcmVtb3ZhbC1jcmFz aC5odG1sIFsgU2tpcCBdCiAKICMgVGhlIGZpbGUtd3JhcHBlciBwYXJ0IG9mIDxhdHRhY2htZW50 PiBpcyBub3QgeWV0IHdvcmtpbmcgb24gaU9TCiBmYXN0L2F0dGFjaG1lbnQvYXR0YWNobWVudC10 eXBlLWF0dHJpYnV0ZS5odG1sIFsgU2tpcCBdCg==