159328 2016-06-30 20:57:38 -0700 [iOS] Possible null Range dereference under computeAutocorrectionContext() 2016-07-01 13:59:40 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez enrica rniwa webkit-bug-importer oldest_to_newest 1206981 0 cdumez 2016-06-30 20:57:38 -0700 Possible null Range dereference under computeAutocorrectionContext(): Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000018 Triggered by Thread: 0 Filtered syslog: None found Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 WebKit 0x000000018bf2130c WebCore::RangeBoundaryPoint::toPosition() const + 24 (RangeBoundaryPoint.h:93) 1 WebKit 0x000000018bf1ba5c WebKit::computeAutocorrectionContext(WebCore::Frame&, WTF::String&, WTF::String&, WTF::String&, WTF::String&, unsigned long long&, unsigned long long&) + 460 (Range.h:105) 2 WebKit 0x000000018bf1ba5c WebKit::computeAutocorrectionContext(WebCore::Frame&, WTF::String&, WTF::String&, WTF::String&, WTF::String&, unsigned long long&, unsigned long long&) + 460 (Range.h:105) 3 WebKit 0x000000018bf2a170 void IPC::handleMessage<Messages::WebPage::GetAutocorrectionContext, WebKit::WebPage, void (WebKit::WebPage::*)(WTF::String&, WTF::String&, WTF::String&, WTF::String&, unsigned long long&, unsigned long long&)>(IPC::MessageDecoder&, IPC::MessageEncoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::String&, WTF::String&, WTF::String&, WTF::String&, unsigned long long&, unsigned long long&)) + 88 (HandleMessage.h:30) 4 WebKit 0x000000018be0f074 IPC::MessageReceiverMap::dispatchSyncMessage(IPC::Connection&, IPC::MessageDecoder&, std::__1::unique_ptr<IPC::MessageEncoder, std::__1::default_delete<IPC::MessageEncoder> >&) + 128 (MessageReceiverMap.cpp:119) 5 WebKit 0x000000018bf7c6d8 WebKit::WebProcess::didReceiveSyncMessage(IPC::Connection&, IPC::MessageDecoder&, std::__1::unique_ptr<IPC::MessageEncoder, std::__1::default_delete<IPC::MessageEncoder> >&) + 40 (WebProcess.cpp:616) 6 WebKit 0x000000018bdd94c0 IPC::Connection::dispatchSyncMessage(IPC::MessageDecoder&) + 196 (Connection.cpp:856) 7 WebKit 0x000000018bdd6ee8 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 136 (Connection.cpp:928) 8 WebKit 0x000000018bdd6d88 IPC::Connection::SyncMessageState::dispatchMessages(IPC::Connection*) + 240 (Connection.cpp:176) 9 JavaScriptCore 0x0000000187091fcc WTF::RunLoop::performWork() + 172 (NoncopyableFunction.h:49) 10 JavaScriptCore 0x00000001870921f8 WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38) 11 CoreFoundation 0x0000000182875cbc __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24 (CFRunLoop.c:1943) 12 CoreFoundation 0x0000000182875604 __CFRunLoopDoSources0 + 524 (CFRunLoop.c:1989) 13 CoreFoundation 0x0000000182873204 __CFRunLoopRun + 804 (CFRunLoop.c:2821) 14 CoreFoundation 0x00000001827a45a4 CFRunLoopRunSpecific + 292 (CFRunLoop.c:3103) 15 Foundation 0x0000000183235bf8 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304 (NSRunLoop.m:367) 16 Foundation 0x000000018328a244 -[NSRunLoop(NSRunLoop) run] + 88 (NSRunLoop.m:389) 17 libxpc.dylib 0x000000018255af08 _xpc_objc_main + 660 (main.m:186) 18 libxpc.dylib 0x000000018255cc00 xpc_main + 200 (init.c:1438) 19 com.apple.WebKit.WebContent 0x00000001000975e4 main + 376 (XPCServiceMain.mm:114) 20 libdyld.dylib 0x0000000182344600 start + 4 1206982 1 cdumez 2016-06-30 20:57:57 -0700 rdar://problem/26766720 1206983 2 282510 cdumez 2016-06-30 21:03:39 -0700 Created attachment 282510 Patch 1207005 3 282510 benjamin 2016-06-30 23:55:38 -0700 Comment on attachment 282510 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=282510&action=review I am not sure to understand why this happens. I don't even know how you would test computeAutocorrectionContext() with the current infrastructure :( > Source/WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm:2194 > + if (auto compositionRange = frame.editor().compositionRange()) { For the love of FSM, use types, not auto. 1207258 4 282510 cdumez 2016-07-01 13:59:36 -0700 Comment on attachment 282510 Patch Clearing flags on attachment: 282510 Committed r202757: <http://trac.webkit.org/changeset/202757> 1207259 5 cdumez 2016-07-01 13:59:40 -0700 All reviewed patches have been landed. Closing bug. 282510 2016-06-30 21:03:39 -0700 2016-07-01 13:59:36 -0700 Patch bug-159328-20160630210318.patch text/plain 5291 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjAyNzIzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggODM3MjJjZjE1ZWRhNjIy MWUwYjBmMmFmNDg1NDc3ZGQyNTM4NzEyOC4uZDA4YWI5OTlkNTM0MzhiZTk2OTViOGNlYzU3OTFh YzJiOTYyYmVmNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE2LTA2LTMwICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgW2lPU10gUG9zc2libGUgbnVs bCBSYW5nZSBkZXJlZmVyZW5jZSB1bmRlciBjb21wdXRlQXV0b2NvcnJlY3Rpb25Db250ZXh0KCkK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1OTMyOAor ICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjY3NjY3MjA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBlZGl0aW5nL0VkaXRvci5jcHA6CisgICAgICAg IChXZWJDb3JlOjpFZGl0b3I6OmNvbXBvc2l0aW9uUmFuZ2UpOgorICAgICAgICAqIGVkaXRpbmcv RWRpdG9yLmg6CisgICAgICAgIFVwZGF0ZSB0byByZXR1cm4gYSBSZWZQdHIgaW5zdGVhZCBvZiBh IFBhc3NSZWZQdHIgYW5kIHVzZSBudWxscHRyCisgICAgICAgIGluc3RlYWQgb2YgMCBpbiB0aGUg aW1wbGVtZW50YXRpb24uCisKIDIwMTYtMDYtMzAgIEppZXdlbiBUYW4gIDxqaWV3ZW5fdGFuQGFw cGxlLmNvbT4KIAogICAgICAgICBDcmVhdGUgYSBnZW5lcmljICJsaW5rZWQtb24tb3ItYWZ0ZXIi IGNoZWNrIGZvciBuZXcgQ1NQIFJ1bGVzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9DaGFu Z2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXggNWNhNjIxNWVjYjA3NzM0ZDNi YmQxMGI2MDBlNTIwZjNjNjUxNjliNC4uZGVjYWRhNWVhNTFkYTYxNTlkZjY5NzQxMWNjYTJmYWY2 MDE2YjYyOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSw1ICsxLDIzIEBACiAyMDE2LTA2LTMwICBDaHJpcyBE dW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKKyAgICAgICAgW2lPU10gUG9zc2libGUgbnVsbCBS YW5nZSBkZXJlZmVyZW5jZSB1bmRlciBjb21wdXRlQXV0b2NvcnJlY3Rpb25Db250ZXh0KCkKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1OTMyOAorICAg ICAgICA8cmRhcjovL3Byb2JsZW0vMjY3NjY3MjA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgVGhlIGNvZGUgaW4gY29tcHV0ZUF1dG9jb3JyZWN0aW9u Q29udGV4dCgpIHdhcyBjaGVja2luZyBFZGl0b3I6Omhhc0NvbXBvc2l0aW9uKCkKKyAgICAgICAg YmVmb3JlIGRlcmVmZXJlbmNpbmcgRWRpdG9yOjpjb21wb3NpdGlvblJhbmdlKCkuIEhvd2V2ZXIs IGNvbXBvc2l0aW9uUmFuZ2UoKQorICAgICAgICBjYW4gYWxzbyByZXR1cm4gbnVsbCBpbiBvdGhl ciBjYXNlcyAoZS5nLiBjb21wb3NpdGlvblN0YXJ0ID09IGNvbXBvc2l0aW9uRW5kKS4KKworICAg ICAgICBEcm9wIHRoZSBjaGVjayBmb3IgaGFzQ29tcG9zaXRpb24oKSBhbmQgZG8gYSBudWxsIGNo ZWNrIG9uIHRoZSB2YWx1ZSByZXR1cm5lZAorICAgICAgICBieSBjb21wb3NpdGlvblJhbmdlKCkg aW5zdGVhZC4KKworICAgICAgICAqIFdlYlByb2Nlc3MvV2ViUGFnZS9pb3MvV2ViUGFnZUlPUy5t bToKKyAgICAgICAgKFdlYktpdDo6Y29tcHV0ZUF1dG9jb3JyZWN0aW9uQ29udGV4dCk6CisKKzIw MTYtMDYtMzAgIENocmlzIER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKwogICAgICAgICBbaU9T XSBXZWJDb250ZW50IHByb2Nlc3NlcyBkbyBub3QgZXhpdCBwcm9tcHRseQogICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU5MzAxCiAgICAgICAgIDxyZGFy Oi8vcHJvYmxlbS8yNjk2NTQ4OD4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcv RWRpdG9yLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvRWRpdG9yLmNwcAppbmRleCBmZmIz ODg0ZDkyNjUxNjk5MWJmZDUzZjllNmEwMWNiYzE4MTEzMzQyLi40NmQ1ODg4NzljNjM1ZDM2NjEy Mzg1OWEzZjAxNzMzMDkxM2Y4YjFhIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5n L0VkaXRvci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9FZGl0b3IuY3BwCkBAIC0y ODIzLDE1ICsyODIzLDE1IEBAIHZvaWQgRWRpdG9yOjpzZXRJZ25vcmVDb21wb3NpdGlvblNlbGVj dGlvbkNoYW5nZShib29sIGlnbm9yZSwgUmV2ZWFsU2VsZWN0aW9uIHNoCiAgICAgICAgIHJldmVh bFNlbGVjdGlvbkFmdGVyRWRpdGluZ09wZXJhdGlvbihTY3JvbGxBbGlnbm1lbnQ6OmFsaWduVG9F ZGdlSWZOZWVkZWQsIFJldmVhbEV4dGVudCk7CiB9CiAKLVBhc3NSZWZQdHI8UmFuZ2U+IEVkaXRv cjo6Y29tcG9zaXRpb25SYW5nZSgpIGNvbnN0CitSZWZQdHI8UmFuZ2U+IEVkaXRvcjo6Y29tcG9z aXRpb25SYW5nZSgpIGNvbnN0CiB7CiAgICAgaWYgKCFtX2NvbXBvc2l0aW9uTm9kZSkKLSAgICAg ICAgcmV0dXJuIDA7CisgICAgICAgIHJldHVybiBudWxscHRyOwogICAgIHVuc2lnbmVkIGxlbmd0 aCA9IG1fY29tcG9zaXRpb25Ob2RlLT5sZW5ndGgoKTsKICAgICB1bnNpZ25lZCBzdGFydCA9IHN0 ZDo6bWluKG1fY29tcG9zaXRpb25TdGFydCwgbGVuZ3RoKTsKICAgICB1bnNpZ25lZCBlbmQgPSBz dGQ6Om1pbihzdGQ6Om1heChzdGFydCwgbV9jb21wb3NpdGlvbkVuZCksIGxlbmd0aCk7CiAgICAg aWYgKHN0YXJ0ID49IGVuZCkKLSAgICAgICAgcmV0dXJuIDA7CisgICAgICAgIHJldHVybiBudWxs cHRyOwogICAgIHJldHVybiBSYW5nZTo6Y3JlYXRlKG1fY29tcG9zaXRpb25Ob2RlLT5kb2N1bWVu dCgpLCBtX2NvbXBvc2l0aW9uTm9kZS5nZXQoKSwgc3RhcnQsIG1fY29tcG9zaXRpb25Ob2RlLmdl dCgpLCBlbmQpOwogfQogCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0VkaXRv ci5oIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9FZGl0b3IuaAppbmRleCA4NGZmNGI5ZDNhZWYw OGYzZTQzMTU5NDg5MjZlMmIyZTg0YWZjNmM1Li43N2Y0YjQwOGJmMmRjNWVkMTdlMmZlZTI1YTJm YzI0ZTlkOTg2ZDNlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0VkaXRvci5o CisrKyBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvRWRpdG9yLmgKQEAgLTMwNCw3ICszMDQsNyBA QCBwdWJsaWM6CiAgICAgV0VCQ09SRV9FWFBPUlQgdm9pZCBjb25maXJtQ29tcG9zaXRpb24oY29u c3QgU3RyaW5nJik7IC8vIGlmIG5vIGV4aXN0aW5nIGNvbXBvc2l0aW9uLCByZXBsYWNlcyBzZWxl Y3Rpb24KICAgICBXRUJDT1JFX0VYUE9SVCB2b2lkIGNhbmNlbENvbXBvc2l0aW9uKCk7CiAgICAg Ym9vbCBjYW5jZWxDb21wb3NpdGlvbklmU2VsZWN0aW9uSXNJbnZhbGlkKCk7Ci0gICAgV0VCQ09S RV9FWFBPUlQgUGFzc1JlZlB0cjxSYW5nZT4gY29tcG9zaXRpb25SYW5nZSgpIGNvbnN0OworICAg IFdFQkNPUkVfRVhQT1JUIFJlZlB0cjxSYW5nZT4gY29tcG9zaXRpb25SYW5nZSgpIGNvbnN0Owog ICAgIFdFQkNPUkVfRVhQT1JUIGJvb2wgZ2V0Q29tcG9zaXRpb25TZWxlY3Rpb24odW5zaWduZWQm IHNlbGVjdGlvblN0YXJ0LCB1bnNpZ25lZCYgc2VsZWN0aW9uRW5kKSBjb25zdDsKIAogICAgIC8v IGdldHRpbmcgaW50ZXJuYXRpb25hbCB0ZXh0IGlucHV0IGNvbXBvc2l0aW9uIHN0YXRlIChmb3Ig dXNlIGJ5IElubGluZVRleHRCb3gpCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9j ZXNzL1dlYlBhZ2UvaW9zL1dlYlBhZ2VJT1MubW0gYi9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNz L1dlYlBhZ2UvaW9zL1dlYlBhZ2VJT1MubW0KaW5kZXggNGY5NDVmODQzMmZmZWI5Y2NiNGM2MmQz NmQwZTY3YzE4NDUyZWE4OC4uMjFlNGMyYjgyZjNhNTQxZTk1NGI2NDMzNGY0MTdmMDcyN2U3ODdl YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQYWdlL2lvcy9XZWJQ YWdlSU9TLm1tCisrKyBiL1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9pb3MvV2Vi UGFnZUlPUy5tbQpAQCAtMjE5MSwxMiArMjE5MSwxMiBAQCBzdGF0aWMgdm9pZCBjb21wdXRlQXV0 b2NvcnJlY3Rpb25Db250ZXh0KEZyYW1lJiBmcmFtZSwgU3RyaW5nJiBjb250ZXh0QmVmb3JlLCBT dAogICAgIGlmIChmcmFtZS5zZWxlY3Rpb24oKS5pc1JhbmdlKCkpCiAgICAgICAgIHNlbGVjdGVk VGV4dCA9IHBsYWluVGV4dFJlcGxhY2luZ05vQnJlYWtTcGFjZShmcmFtZS5zZWxlY3Rpb24oKS5z ZWxlY3Rpb24oKS50b05vcm1hbGl6ZWRSYW5nZSgpLmdldCgpKTsKIAotICAgIGlmIChmcmFtZS5l ZGl0b3IoKS5oYXNDb21wb3NpdGlvbigpKSB7Ci0gICAgICAgIHJhbmdlID0gUmFuZ2U6OmNyZWF0 ZSgqZnJhbWUuZG9jdW1lbnQoKSwgZnJhbWUuZWRpdG9yKCkuY29tcG9zaXRpb25SYW5nZSgpLT5z dGFydFBvc2l0aW9uKCksIHN0YXJ0UG9zaXRpb24pOworICAgIGlmIChhdXRvIGNvbXBvc2l0aW9u UmFuZ2UgPSBmcmFtZS5lZGl0b3IoKS5jb21wb3NpdGlvblJhbmdlKCkpIHsKKyAgICAgICAgcmFu Z2UgPSBSYW5nZTo6Y3JlYXRlKCpmcmFtZS5kb2N1bWVudCgpLCBjb21wb3NpdGlvblJhbmdlLT5z dGFydFBvc2l0aW9uKCksIHN0YXJ0UG9zaXRpb24pOwogICAgICAgICBTdHJpbmcgbWFya2VkVGV4 dEJlZm9yZTsKICAgICAgICAgaWYgKHJhbmdlKQogICAgICAgICAgICAgbWFya2VkVGV4dEJlZm9y ZSA9IHBsYWluVGV4dFJlcGxhY2luZ05vQnJlYWtTcGFjZShyYW5nZS5nZXQoKSk7Ci0gICAgICAg IHJhbmdlID0gUmFuZ2U6OmNyZWF0ZSgqZnJhbWUuZG9jdW1lbnQoKSwgZW5kUG9zaXRpb24sIGZy YW1lLmVkaXRvcigpLmNvbXBvc2l0aW9uUmFuZ2UoKS0+ZW5kUG9zaXRpb24oKSk7CisgICAgICAg IHJhbmdlID0gUmFuZ2U6OmNyZWF0ZSgqZnJhbWUuZG9jdW1lbnQoKSwgZW5kUG9zaXRpb24sIGNv bXBvc2l0aW9uUmFuZ2UtPmVuZFBvc2l0aW9uKCkpOwogICAgICAgICBTdHJpbmcgbWFya2VkVGV4 dEFmdGVyOwogICAgICAgICBpZiAocmFuZ2UpCiAgICAgICAgICAgICBtYXJrZWRUZXh0QWZ0ZXIg PSBwbGFpblRleHRSZXBsYWNpbmdOb0JyZWFrU3BhY2UocmFuZ2UuZ2V0KCkpOwo=