159640 2016-07-11 12:57:23 -0700 Potential null dereference under DocumentLoader::mainReceivedError() 2016-07-11 15:36:40 -0700 1 1 1 Unclassified WebKit Page Loading WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez beidson commit-queue ddkilzer japhet webkit-bug-importer oldest_to_newest 1209758 0 cdumez 2016-07-11 12:57:23 -0700 Potential null dereference under DocumentLoader::mainReceivedError(): Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000008) [ 0] 0x0000000108e9128e WebCore`WebCore::DocumentLoader::mainReceivedError(WebCore::ResourceError const&) [inlined] WebCore::FrameLoader::client() const at FrameLoader.h:205:48 201 202 static void addHTTPOriginIfNeeded(ResourceRequest&, const String& origin); 203 static void addHTTPUpgradeInsecureRequestsIfNeeded(ResourceRequest&); 204 -> 205 FrameLoaderClient& client() const { return m_client; } 206 207 void setDefersLoading(bool); 208 209 void didExplicitOpen(); 0x0000000108e9127c: movq 0x10(%rbx), %rax 0x0000000108e91280: leaq 0x90(%rax), %rcx 0x0000000108e91287: testq %rax, %rax 0x0000000108e9128a: cmoveq %rax, %rcx -> 0x0000000108e9128e: movq 0x8(%rcx), %rdi 0x0000000108e91292: movq (%rdi), %rax 0x0000000108e91295: movq %rbx, %rsi 0x0000000108e91298: movq %r14, %rcx 0x0000000108e9129b: callq *0x90(%rax) [ 0] 0x0000000108e9128e WebCore`WebCore::DocumentLoader::mainReceivedError(WebCore::ResourceError const&) + 46 at DocumentLoader.cpp:255 251 ASSERT(!error.isNull()); 252 253 if (m_identifierForLoadWithoutResourceLoader) { 254 ASSERT(!mainResourceLoader()); -> 255 frameLoader()->client().dispatchDidFailLoading(this, m_identifierForLoadWithoutResourceLoader, error); 256 } 257 258 // There is a bug in CFNetwork where callbacks can be dispatched even when loads are deferred. 259 // See <rdar://problem/6304600> for more details. [ 1] 0x0000000108ed2238 WebCore`WebCore::DocumentLoader::cancelMainResourceLoad(WebCore::ResourceError const&) + 296 at DocumentLoader.cpp:1583:5 1579 mainResourceLoader()->cancel(error); 1580 1581 clearMainResource(); 1582 -> 1583 mainReceivedError(error); 1584 } 1585 1586 void DocumentLoader::clearMainResource() 1587 { [ 2] 0x0000000108fad1c2 WebCore`WebCore::DocumentLoader::stopLoadingForPolicyChange() + 82 at DocumentLoader.cpp:858:5 854 void DocumentLoader::stopLoadingForPolicyChange() 855 { 856 ResourceError error = interruptedForPolicyChangeError(); 857 error.setType(ResourceError::Type::Cancellation); -> 858 cancelMainResourceLoad(error); 859 } 860 861 void DocumentLoader::commitData(const char* bytes, size_t length) 862 { [ 3] 0x00000001091f0c5b WebCore`std::__1::__function::__func<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0, std::__1::allocator<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0>, void (WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>::operator()(WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>&&, bool&&) [inlined] WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0::operator()(WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool) const + 7 at DocumentLoader.cpp:587:9 [ 3] 0x00000001091f0c54 WebCore`std::__1::__function::__func<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0, std::__1::allocator<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0>, void (WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>::operator()(WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>&&, bool&&) [inlined] decltype(std::__1::forward<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0&>(fp)(std::__1::forward<WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool>(fp0))) std::__1::__invoke<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0&, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool>(WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0&&&, WebCore::ResourceRequest const&&&, WTF::PassRefPtr<WebCore::FormState>&&, bool&&) + 16 at __functional_base:416 [ 3] 0x00000001091f0c44 WebCore`std::__1::__function::__func<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0, std::__1::allocator<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0>, void (WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>::operator()(WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>&&, bool&&) [inlined] void std::__1::__invoke_void_return_wrapper<void>::__call<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0&, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool>(WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0&&&, WebCore::ResourceRequest const&&&, WTF::PassRefPtr<WebCore::FormState>&&, bool&&) at __functional_base:468 [ 3] 0x00000001091f0c44 WebCore`std::__1::__function::__func<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0, std::__1::allocator<WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&)::$_0>, void (WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>::operator()(WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>&&, bool&&) + 4 at functional:1437 [ 4] 0x0000000108d867f5 WebCore`WebCore::PolicyCallback::call(bool) [inlined] std::__1::function<void (WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>::operator()(WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool) const + 16 at functional:1817:12 [ 4] 0x0000000108d867e5 WebCore`WebCore::PolicyCallback::call(bool) + 53 at PolicyCallback.cpp:95 [ 5] 0x0000000108d8677b WebCore`WebCore::PolicyChecker::continueAfterNavigationPolicy(WebCore::PolicyAction) + 731 at PolicyChecker.cpp:222:5 [ 6] 0x0000000107861703 WebKit`WebKit::WebFrame::didReceivePolicyDecision(unsigned long long, WebCore::PolicyAction, unsigned long long, WebKit::DownloadID) [inlined] std::__1::function<void (WebCore::PolicyAction)>::operator()(WebCore::PolicyAction) const + 13 at functional:1817:12 [ 6] 0x00000001078616f6 WebKit`WebKit::WebFrame::didReceivePolicyDecision(unsigned long long, WebCore::PolicyAction, unsigned long long, WebKit::DownloadID) + 178 at WebFrame.cpp:247 [ 7] 0x00000001078636d3 WebKit`WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(WebCore::NavigationAction const&, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, std::__1::function<void (WebCore::PolicyAction)>) + 1559 at WebFrameLoaderClient.cpp:815:9 [ 8] 0x00000001099ea685 WebCore`WebCore::PolicyChecker::checkNavigationPolicy(WebCore::ResourceRequest const&, bool, WebCore::DocumentLoader*, WTF::PassRefPtr<WebCore::FormState>, std::__1::function<void (WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>) + 2485 at PolicyChecker.cpp:138:5 [ 9] 0x00000001099e9c56 WebCore`WebCore::PolicyChecker::checkNavigationPolicy(WebCore::ResourceRequest const&, bool, std::__1::function<void (WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>) + 150 at PolicyChecker.cpp:73:5 [ 10] 0x0000000108d88523 WebCore`WebCore::DocumentLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 1747 at DocumentLoader.cpp:586:5 [ 11] 0x00000001090761b4 WebCore`WebCore::CachedRawResource::redirectReceived(WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 244 at CachedRawResource.cpp:172:13 [ 12] 0x0000000109ca4d42 WebCore`WebCore::SubresourceLoader::willSendRequestInternal(WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 994 at SubresourceLoader.cpp:214:9 [ 13] 0x0000000109b5af35 WebCore`WebCore::ResourceLoader::willSendRequest(WebCore::ResourceRequest&&, WebCore::ResourceResponse const&, std::__1::function<void (WebCore::ResourceRequest&&)>&&) + 21 at ResourceLoader.cpp:389:5 [ 14] 0x000000010790fe73 WebKit`WebKit::WebResourceLoader::willSendRequest(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&) + 243 at WebResourceLoader.cpp:88:5 [ 15] 0x00000001079106bb WebKit`void IPC::handleMessage<Messages::WebResourceLoader::WillSendRequest, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&)>(IPC::MessageDecoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&)) [inlined] void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&), std::__1::tuple<WebCore::ResourceRequest, WebCore::ResourceResponse>, 0ul, 1ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&), std::__1::tuple<WebCore::ResourceRequest, WebCore::ResourceResponse>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 2 at HandleMessage.h:16:5 [ 15] 0x00000001079106b9 WebKit`void IPC::handleMessage<Messages::WebResourceLoader::WillSendRequest, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&)>(IPC::MessageDecoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&)) [inlined] void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&), std::__1::tuple<WebCore::ResourceRequest, WebCore::ResourceResponse>, std::__1::integer_sequence<unsigned long, 0ul, 1ul> >(std::__1::tuple<WebCore::ResourceRequest, WebCore::ResourceResponse>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&)) at HandleMessage.h:22 [ 15] 0x00000001079106b9 WebKit`void IPC::handleMessage<Messages::WebResourceLoader::WillSendRequest, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&)>(IPC::MessageDecoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::ResourceRequest&&, WebCore::ResourceResponse&&)) + 141 at HandleMessage.h:92 [ 16] 0x0000000107753a98 WebKit`IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) [inlined] IPC::Connection::dispatchMessage(IPC::MessageDecoder&) + 12 at Connection.cpp:887:5 1209759 1 webkit-bug-importer 2016-07-11 12:58:17 -0700 <rdar://problem/27283372> 1209762 2 283335 cdumez 2016-07-11 13:00:53 -0700 Created attachment 283335 Patch 1209834 3 283335 cdumez 2016-07-11 15:36:35 -0700 Comment on attachment 283335 Patch Clearing flags on attachment: 283335 Committed r203088: <http://trac.webkit.org/changeset/203088> 1209835 4 cdumez 2016-07-11 15:36:40 -0700 All reviewed patches have been landed. Closing bug. 283335 2016-07-11 13:00:53 -0700 2016-07-11 15:36:35 -0700 Patch bug-159640-20160711130011.patch text/plain 1894 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjAzMDY1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOWI1NzUyZTQ4NjZlYzc0 MjhkNDUyYTk0ZWI5NTUyMTQ4NzFmNjA2NS4uMTNhYWUyMmQ4YWE1NWZhNWFiYmEzMTFiYTJiOGQz ZTZiMTg3MDdlNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE2LTA3LTExICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUG90ZW50aWFsIG51bGwgZGVy ZWZlcmVuY2UgdW5kZXIgRG9jdW1lbnRMb2FkZXI6Om1haW5SZWNlaXZlZEVycm9yKCkKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1OTY0MAorICAgICAg ICA8cmRhcjovL3Byb2JsZW0vMjcyODMzNzI+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgTW92ZSBmcmFtZUxvYWRlcigpIG51bGwgY2hlY2sgYSBiaXQg ZWFybGllciBpbiBEb2N1bWVudExvYWRlcjo6bWFpblJlY2VpdmVkRXJyb3IoKQorICAgICAgICBh cyBpdCB3YXMgZGVyZWZlcmVuY2VkIGJlZm9yZSB0aGUgY2hlY2suCisKKyAgICAgICAgKiBsb2Fk ZXIvRG9jdW1lbnRMb2FkZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RG9jdW1lbnRMb2FkZXI6 Om1haW5SZWNlaXZlZEVycm9yKToKKwogMjAxNi0wNy0xMSAgTmFlbCBPdWVkcmFvZ28gIDxuYWVs Lm91ZWRyYW9nb0BjcmYuY2Fub24uZnI+CiAKICAgICAgICAgdG9OYXRpdmUgZnVuY3Rpb25zIGlu IEpTRE9NQmluZGluZy5oIHNob3VsZCB0YWtlIGFuIEV4ZWNTdGF0ZSByZWZlcmVuY2UgaW5zdGVh ZCBvZiBwb2ludGVyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvRG9jdW1lbnRM b2FkZXIuY3BwIGIvU291cmNlL1dlYkNvcmUvbG9hZGVyL0RvY3VtZW50TG9hZGVyLmNwcAppbmRl eCA3NmMyMDFjNTczYzdiNGNiMjFkMmNhMTE5ZjY4NTg3MTg1OTU5NWNlLi44MDE4MTdiYjViYTA1 NDljZmFiOTVjYjU4ZWRhNTdkNGZiM2FmYjA5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9s b2FkZXIvRG9jdW1lbnRMb2FkZXIuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9Eb2N1 bWVudExvYWRlci5jcHAKQEAgLTI0OSw2ICsyNDksOSBAQCB2b2lkIERvY3VtZW50TG9hZGVyOjpt YWluUmVjZWl2ZWRFcnJvcihjb25zdCBSZXNvdXJjZUVycm9yJiBlcnJvcikKIHsKICAgICBBU1NF UlQoIWVycm9yLmlzTnVsbCgpKTsKIAorICAgIGlmICghZnJhbWVMb2FkZXIoKSkKKyAgICAgICAg cmV0dXJuOworCiAgICAgaWYgKG1faWRlbnRpZmllckZvckxvYWRXaXRob3V0UmVzb3VyY2VMb2Fk ZXIpIHsKICAgICAgICAgQVNTRVJUKCFtYWluUmVzb3VyY2VMb2FkZXIoKSk7CiAgICAgICAgIGZy YW1lTG9hZGVyKCktPmNsaWVudCgpLmRpc3BhdGNoRGlkRmFpbExvYWRpbmcodGhpcywgbV9pZGVu dGlmaWVyRm9yTG9hZFdpdGhvdXRSZXNvdXJjZUxvYWRlciwgZXJyb3IpOwpAQCAtMjYyLDggKzI2 NSw2IEBAIHZvaWQgRG9jdW1lbnRMb2FkZXI6Om1haW5SZWNlaXZlZEVycm9yKGNvbnN0IFJlc291 cmNlRXJyb3ImIGVycm9yKQogCiAgICAgbV9hcHBsaWNhdGlvbkNhY2hlSG9zdC0+ZmFpbGVkTG9h ZGluZ01haW5SZXNvdXJjZSgpOwogCi0gICAgaWYgKCFmcmFtZUxvYWRlcigpKQotICAgICAgICBy ZXR1cm47CiAgICAgc2V0TWFpbkRvY3VtZW50RXJyb3IoZXJyb3IpOwogICAgIGNsZWFyTWFpblJl c291cmNlTG9hZGVyKCk7CiAgICAgZnJhbWVMb2FkZXIoKS0+cmVjZWl2ZWRNYWluUmVzb3VyY2VF cnJvcihlcnJvcik7Cg==