159632 2016-07-11 10:55:17 -0700 Possible null dereference under EventHandler::dispatchMouseEvent() 2016-07-11 23:32:25 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez commit-queue enrica kling rniwa oldest_to_newest 1209699 0 cdumez 2016-07-11 10:55:17 -0700 Possible null dereference under EventHandler::dispatchMouseEvent(): Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000008) [ 0] 0x00007fff9312d6e4 WebCore`WebCore::Range::compareNode(WebCore::Node&, int&) const + 36 at Range.cpp:298:9 294 // Firefox doesn't throw an exception for this case; it returns 0. 295 return NODE_BEFORE; 296 } 297 -> 298 if (&refNode.document() != &ownerDocument()) { 299 // Firefox doesn't throw an exception for this case; it returns 0. 300 return NODE_BEFORE; 301 } 302 0x00007fff9312d6d6: testb $0x1, 0x15(%rsi) 0x00007fff9312d6da: je 0xce874e ; <+142> at Range.cpp:323 0x00007fff9312d6dc: movq 0x20(%rsi), %rax 0x00007fff9312d6e0: movq 0x8(%rax), %rax -> 0x00007fff9312d6e4: cmpq 0x8(%r15), %rax 0x00007fff9312d6e8: jne 0xce874e ; <+142> at Range.cpp:323 0x00007fff9312d6ea: movq 0x18(%rsi), %r12 0x00007fff9312d6ee: movq %rsi, %rdi 0x00007fff9312d6f1: callq 0x14c240 ; WebCore::Node::computeNodeIndex at Node.cpp:781 [ 1] 0x00007fff925b46b4 WebCore`WebCore::EventHandler::dispatchMouseEvent(WTF::AtomicString const&, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&, bool) + 324 at EventHandler.cpp:2515:24 2511 // node on mouse down if it's selected and inside a focused node. It will be 2512 // focused if the user does a mouseup over it, however, because the mouseup 2513 // will set a selection inside it, which will call setFocuseNodeIfNeeded. 2514 if (m_frame.selection().isRange() -> 2515 && m_frame.selection().toNormalizedRange()->compareNode(*element, IGNORE_EXCEPTION) == Range::NODE_INSIDE 2516 && element->isDescendantOf(m_frame.document()->focusedElement())) 2517 return true; 2518 2519 break; [ 2] 0x00007fff925b83f7 WebCore`WebCore::EventHandler::handleMousePressEvent(WebCore::PlatformMouseEvent const&) + 1799 at EventHandler.cpp:1708:26 1704 } 1705 1706 m_frame.selection().setCaretBlinkingSuspended(true); 1707 -> 1708 bool swallowEvent = !dispatchMouseEvent(eventNames().mousedownEvent, mouseEvent.targetNode(), true, m_clickCount, platformMouseEvent, true); 1709 m_capturesDragging = !swallowEvent || mouseEvent.scrollbar(); 1710 1711 // If the hit testing originally determined the event was in a scrollbar, refetch the MouseEventWithHitTestResults 1712 // in case the scrollbar widget was destroyed when the mouse event was handled. [ 3] 0x00007fff926dc4bc WebCore`WebCore::EventHandler::passMousePressEventToSubframe(WebCore::MouseEventWithHitTestResults&, WebCore::Frame*) + 76 at EventHandlerMac.mm:692:5 688 if (frameHasPlatformWidget(m_frame)) 689 return passSubframeEventToSubframe(mev, subframe); 690 691 // WebKit2 code path. -> 692 subframe->eventHandler().handleMousePressEvent(mev.event()); 693 return true; 694 } 695 696 bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe, HitTestResult* hoveredNode) [ 4] 0x00007fff925b8015 WebCore`WebCore::EventHandler::handleMousePressEvent(WebCore::PlatformMouseEvent const&) + 805 at EventHandler.cpp:1661:21 1209700 1 cdumez 2016-07-11 10:55:50 -0700 <rdar://problem/27247619> 1209701 2 283323 cdumez 2016-07-11 10:57:59 -0700 Created attachment 283323 Patch 1209791 3 283323 cdumez 2016-07-11 13:54:33 -0700 Comment on attachment 283323 Patch Clearing flags on attachment: 283323 Committed r203082: <http://trac.webkit.org/changeset/203082> 1209792 4 cdumez 2016-07-11 13:54:37 -0700 All reviewed patches have been landed. Closing bug. 1209954 5 283323 ap 2016-07-11 23:32:25 -0700 Comment on attachment 283323 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=283323&action=review > Source/WebCore/ChangeLog:9 > + FrameSelection::toNormalizedRange() can return null even when FrameSelection::isRange() Test? 283323 2016-07-11 10:57:59 -0700 2016-07-11 13:54:33 -0700 Patch bug-159632-20160711105717.patch text/plain 2313 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjAzMDY1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOWI1NzUyZTQ4NjZlYzc0 MjhkNDUyYTk0ZWI5NTUyMTQ4NzFmNjA2NS4uMjBjZDU4YmNkODZkZDNhMGQ1MTgzOWQxNDE4MTVl ODY5YmIwMjVmYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE2LTA3LTExICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUG9zc2libGUgbnVsbCBkZXJl ZmVyZW5jZSB1bmRlciBFdmVudEhhbmRsZXI6OmRpc3BhdGNoTW91c2VFdmVudCgpCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTk2MzIKKyAgICAgICAg PHJkYXI6Ly9wcm9ibGVtLzI3MjQ3NjE5PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEZyYW1lU2VsZWN0aW9uOjp0b05vcm1hbGl6ZWRSYW5nZSgpIGNh biByZXR1cm4gbnVsbCBldmVuIHdoZW4gRnJhbWVTZWxlY3Rpb246OmlzUmFuZ2UoKQorICAgICAg ICByZXR1cm5zIHRydWUgc28gYWRkIGEgbnVsbCBjaGVjay4KKworICAgICAgICAqIHBhZ2UvRXZl bnRIYW5kbGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkV2ZW50SGFuZGxlcjo6ZGlzcGF0Y2hN b3VzZUV2ZW50KToKKwogMjAxNi0wNy0xMSAgTmFlbCBPdWVkcmFvZ28gIDxuYWVsLm91ZWRyYW9n b0BjcmYuY2Fub24uZnI+CiAKICAgICAgICAgdG9OYXRpdmUgZnVuY3Rpb25zIGluIEpTRE9NQmlu ZGluZy5oIHNob3VsZCB0YWtlIGFuIEV4ZWNTdGF0ZSByZWZlcmVuY2UgaW5zdGVhZCBvZiBwb2lu dGVyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL0V2ZW50SGFuZGxlci5jcHAgYi9T b3VyY2UvV2ViQ29yZS9wYWdlL0V2ZW50SGFuZGxlci5jcHAKaW5kZXggYTUyZjg5ZmQyOTgwZTYz MmZkNWE2M2JkNTY1MDA1MGQ5ODlhMGY1OC4uZjcxY2Q2NWI0YWQ3ZjUxOWY4NGUxYWQxNWEyOTFi MDk2ZmM3ZmJmMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGFnZS9FdmVudEhhbmRsZXIu Y3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRXZlbnRIYW5kbGVyLmNwcApAQCAtMjUxMSwx MCArMjUxMSwxMiBAQCBib29sIEV2ZW50SGFuZGxlcjo6ZGlzcGF0Y2hNb3VzZUV2ZW50KGNvbnN0 IEF0b21pY1N0cmluZyYgZXZlbnRUeXBlLCBOb2RlKiB0YXJnZQogICAgICAgICAgICAgICAgIC8v IG5vZGUgb24gbW91c2UgZG93biBpZiBpdCdzIHNlbGVjdGVkIGFuZCBpbnNpZGUgYSBmb2N1c2Vk IG5vZGUuIEl0IHdpbGwgYmUKICAgICAgICAgICAgICAgICAvLyBmb2N1c2VkIGlmIHRoZSB1c2Vy IGRvZXMgYSBtb3VzZXVwIG92ZXIgaXQsIGhvd2V2ZXIsIGJlY2F1c2UgdGhlIG1vdXNldXAKICAg ICAgICAgICAgICAgICAvLyB3aWxsIHNldCBhIHNlbGVjdGlvbiBpbnNpZGUgaXQsIHdoaWNoIHdp bGwgY2FsbCBzZXRGb2N1c2VOb2RlSWZOZWVkZWQuCi0gICAgICAgICAgICAgICAgaWYgKG1fZnJh bWUuc2VsZWN0aW9uKCkuaXNSYW5nZSgpCi0gICAgICAgICAgICAgICAgICAgICYmIG1fZnJhbWUu c2VsZWN0aW9uKCkudG9Ob3JtYWxpemVkUmFuZ2UoKS0+Y29tcGFyZU5vZGUoKmVsZW1lbnQsIElH Tk9SRV9FWENFUFRJT04pID09IFJhbmdlOjpOT0RFX0lOU0lERQotICAgICAgICAgICAgICAgICAg ICAmJiBlbGVtZW50LT5pc0Rlc2NlbmRhbnRPZihtX2ZyYW1lLmRvY3VtZW50KCktPmZvY3VzZWRF bGVtZW50KCkpKQotICAgICAgICAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsKKyAgICAgICAgICAg ICAgICBpZiAobV9mcmFtZS5zZWxlY3Rpb24oKS5pc1JhbmdlKCkpIHsKKyAgICAgICAgICAgICAg ICAgICAgaWYgKGF1dG8gcmFuZ2UgPSBtX2ZyYW1lLnNlbGVjdGlvbigpLnRvTm9ybWFsaXplZFJh bmdlKCkpIHsKKyAgICAgICAgICAgICAgICAgICAgICAgIGlmIChyYW5nZS0+Y29tcGFyZU5vZGUo KmVsZW1lbnQsIElHTk9SRV9FWENFUFRJT04pID09IFJhbmdlOjpOT0RFX0lOU0lERSAmJiBlbGVt ZW50LT5pc0Rlc2NlbmRhbnRPZihtX2ZyYW1lLmRvY3VtZW50KCktPmZvY3VzZWRFbGVtZW50KCkp KQorICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHVybiB0cnVlOworICAgICAgICAgICAg ICAgICAgICB9CisgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgICAgICAKICAgICAg ICAgICAgICAgICBicmVhazsKICAgICAgICAgICAgIH0K