165926 2016-12-15 15:32:51 -0800 Possible nullptr dereference when applying pagination to viewport 2016-12-16 16:49:13 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 bfulgham bfulgham bdakin bfulgham cdumez commit-queue simon.fraser zalan oldest_to_newest 1260302 0 bfulgham 2016-12-15 15:32:51 -0800 In FrameView::applyPaginationToViewport we check if documentElement is nullptr before accessing its renderer. Later, we dereference documentElement without checking for null. 1260656 1 297331 bfulgham 2016-12-16 11:10:22 -0800 Created attachment 297331 Patch 1260657 2 bfulgham 2016-12-16 11:11:00 -0800 Note: If documentElement is nullptr, documentRenderer will also be nullptr. We dereference both documentElement and documentRenderer without checking for null. 1260790 3 297366 zalan 2016-12-16 15:54:42 -0800 Created attachment 297366 Patch 1260823 4 297366 commit-queue 2016-12-16 16:49:09 -0800 Comment on attachment 297366 Patch Clearing flags on attachment: 297366 Committed r209951: <http://trac.webkit.org/changeset/209951> 1260824 5 commit-queue 2016-12-16 16:49:13 -0800 All reviewed patches have been landed. Closing bug. 297331 2016-12-16 11:10:22 -0800 2016-12-16 15:54:38 -0800 Patch bug-165926-20161216110928.patch text/plain 1534 bfulgham SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwOTkyNykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE2LTEyLTE2ICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIFBvc3NpYmxlIG51bGxwdHIg ZGVyZWZlcmVuY2Ugd2hlbiBhcHBseWluZyBwYWdpbmF0aW9uIHRvIHZpZXdwb3J0CisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjU5MjYKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBTdGF0aWMgYW5hbHlzaXMg Zm91bmQgYSBjb2RlIHBhdGggd2hlcmUgYSBudWxsIGRlcmVmZXJlbmNlIGNvdWxkIG9jY3VyLiBU aGlzIGNoYW5nZQorICAgICAgICBjb3JyZWN0cyB0aGlzIHBvc3NpYmxlIGVycm9yLgorCisgICAg ICAgICogcGFnZS9GcmFtZVZpZXcuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RnJhbWVWaWV3Ojph cHBseVBhZ2luYXRpb25Ub1ZpZXdwb3J0KToKKwogMjAxNi0xMi0xNCAgU2FtIFdlaW5pZyAgPHNh bUB3ZWJraXQub3JnPgogCiAgICAgICAgIFtBcHBsZVBheV0gUmVtb3ZlIHJlbWFpbmluZyBjdXN0 b20gYmluZGluZ3MgZnJvbSB0aGUgQXBwbGVQYXkgY29kZQpJbmRleDogU291cmNlL1dlYkNvcmUv cGFnZS9GcmFtZVZpZXcuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BhZ2UvRnJh bWVWaWV3LmNwcAkocmV2aXNpb24gMjA5OTIzKQorKysgU291cmNlL1dlYkNvcmUvcGFnZS9GcmFt ZVZpZXcuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC03NTIsNyArNzUyLDcgQEAgdm9pZCBGcmFtZVZp ZXc6OmFwcGx5UGFnaW5hdGlvblRvVmlld3BvcgogICAgIFJlbmRlckVsZW1lbnQqIGRvY3VtZW50 UmVuZGVyZXIgPSBkb2N1bWVudEVsZW1lbnQgPyBkb2N1bWVudEVsZW1lbnQtPnJlbmRlcmVyKCkg OiBudWxscHRyOwogICAgIFJlbmRlckVsZW1lbnQqIGRvY3VtZW50T3JCb2R5UmVuZGVyZXIgPSBk b2N1bWVudFJlbmRlcmVyOwogICAgIGF1dG8qIGJvZHkgPSBkb2N1bWVudC0+Ym9keSgpOwotICAg IGlmIChib2R5ICYmIGJvZHktPnJlbmRlcmVyKCkpCisgICAgaWYgKGJvZHkgJiYgYm9keS0+cmVu ZGVyZXIoKSAmJiBkb2N1bWVudFJlbmRlcmVyKQogICAgICAgICBkb2N1bWVudE9yQm9keVJlbmRl cmVyID0gZG9jdW1lbnRSZW5kZXJlci0+c3R5bGUoKS5vdmVyZmxvd1goKSA9PSBPVklTSUJMRSAm JiBpczxIVE1MSHRtbEVsZW1lbnQ+KCpkb2N1bWVudEVsZW1lbnQpID8gYm9keS0+cmVuZGVyZXIo KSA6IGRvY3VtZW50UmVuZGVyZXI7CiAKICAgICBQYWdpbmF0aW9uIHBhZ2luYXRpb247Cg== 297366 2016-12-16 15:54:42 -0800 2016-12-16 16:49:09 -0800 Patch bug-165926-20161216155348.patch text/plain 2837 zalan U3VidmVyc2lvbiBSZXZpc2lvbjogMjA5OTM0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggODczZWY1ZTVkOWJlNWVh MWU0ODFlMDZhMGRjZTRlNDAxZDI1NmM2MC4uOWNhMzhlZTc4NGUwMjJkNTYyYTg4OGE1Y2Q3NDM5 N2NmMmRiMTkyNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDE2LTEyLTE2ICBaYWxh biBCdWp0YXMgIDx6YWxhbkBhcHBsZS5jb20+CisKKyAgICAgICAgUG9zc2libGUgbnVsbHB0ciBk ZXJlZmVyZW5jZSB3aGVuIGFwcGx5aW5nIHBhZ2luYXRpb24gdG8gdmlld3BvcnQKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2NTkyNgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFN0YXRpYyBhbmFseXNpcyBm b3VuZCBhIGNvZGUgcGF0aCB3aGVyZSBhIG51bGwgZGVyZWZlcmVuY2UgY291bGQgb2NjdXIuCisg ICAgICAgIAorICAgICAgICAqIHBhZ2UvRnJhbWVWaWV3LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6 OkZyYW1lVmlldzo6YXBwbHlQYWdpbmF0aW9uVG9WaWV3cG9ydCk6CisKIDIwMTYtMTItMTYgIEFu ZHJlYXMgS2xpbmcgIDxha2xpbmdAYXBwbGUuY29tPgogCiAgICAgICAgIFN1YmZyYW1lcyBnb2lu ZyBpbnRvIHBhZ2UgY2FjaGUgZG9uJ3QgbmVlZCB0byByZXNldFNjcm9sbGJhcnMoKS4KZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRnJhbWVWaWV3LmNwcCBiL1NvdXJjZS9XZWJDb3Jl L3BhZ2UvRnJhbWVWaWV3LmNwcAppbmRleCBmZjc5NzQyYjhhNDBiMjcyYjA1OGUyNWQyYWY2MDBl MTdmZGVlODg3Li5kMDY0ODg1ZGQ0MmZkNzA4OTQ2YzRhMDI1ODRmM2U1MzkxNWNmMzJmIDEwMDY0 NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lVmlldy5jcHAKKysrIGIvU291cmNlL1dl YkNvcmUvcGFnZS9GcmFtZVZpZXcuY3BwCkBAIC03NDcsMjcgKzc0NywyOCBAQCB2b2lkIEZyYW1l Vmlldzo6YXBwbHlPdmVyZmxvd1RvVmlld3BvcnQoY29uc3QgUmVuZGVyRWxlbWVudCYgcmVuZGVy ZXIsIFNjcm9sbGJhcgogCiB2b2lkIEZyYW1lVmlldzo6YXBwbHlQYWdpbmF0aW9uVG9WaWV3cG9y dCgpCiB7Ci0gICAgRG9jdW1lbnQqIGRvY3VtZW50ID0gZnJhbWUoKS5kb2N1bWVudCgpOwotICAg IGF1dG8qIGRvY3VtZW50RWxlbWVudCA9IGRvY3VtZW50LT5kb2N1bWVudEVsZW1lbnQoKTsKLSAg ICBSZW5kZXJFbGVtZW50KiBkb2N1bWVudFJlbmRlcmVyID0gZG9jdW1lbnRFbGVtZW50ID8gZG9j dW1lbnRFbGVtZW50LT5yZW5kZXJlcigpIDogbnVsbHB0cjsKLSAgICBSZW5kZXJFbGVtZW50KiBk b2N1bWVudE9yQm9keVJlbmRlcmVyID0gZG9jdW1lbnRSZW5kZXJlcjsKLSAgICBhdXRvKiBib2R5 ID0gZG9jdW1lbnQtPmJvZHkoKTsKLSAgICBpZiAoYm9keSAmJiBib2R5LT5yZW5kZXJlcigpKQot ICAgICAgICBkb2N1bWVudE9yQm9keVJlbmRlcmVyID0gZG9jdW1lbnRSZW5kZXJlci0+c3R5bGUo KS5vdmVyZmxvd1goKSA9PSBPVklTSUJMRSAmJiBpczxIVE1MSHRtbEVsZW1lbnQ+KCpkb2N1bWVu dEVsZW1lbnQpID8gYm9keS0+cmVuZGVyZXIoKSA6IGRvY3VtZW50UmVuZGVyZXI7CisgICAgYXV0 byogZG9jdW1lbnQgPSBmcmFtZSgpLmRvY3VtZW50KCk7CisgICAgYXV0byogZG9jdW1lbnRFbGVt ZW50ID0gZG9jdW1lbnQgPyBkb2N1bWVudC0+ZG9jdW1lbnRFbGVtZW50KCkgOiBudWxscHRyOwor ICAgIGlmICghZG9jdW1lbnRFbGVtZW50IHx8ICFkb2N1bWVudEVsZW1lbnQtPnJlbmRlcmVyKCkp IHsKKyAgICAgICAgc2V0UGFnaW5hdGlvbihQYWdpbmF0aW9uKCkpOworICAgICAgICByZXR1cm47 CisgICAgfQogCi0gICAgUGFnaW5hdGlvbiBwYWdpbmF0aW9uOworICAgIGF1dG8mIGRvY3VtZW50 UmVuZGVyZXIgPSAqZG9jdW1lbnRFbGVtZW50LT5yZW5kZXJlcigpOworICAgIGF1dG8qIGRvY3Vt ZW50T3JCb2R5UmVuZGVyZXIgPSAmZG9jdW1lbnRSZW5kZXJlcjsKIAotICAgIGlmICghZG9jdW1l bnRPckJvZHlSZW5kZXJlcikgewotICAgICAgICBzZXRQYWdpbmF0aW9uKHBhZ2luYXRpb24pOwot ICAgICAgICByZXR1cm47CisgICAgYXV0byogYm9keSA9IGRvY3VtZW50LT5ib2R5KCk7CisgICAg aWYgKGJvZHkgJiYgYm9keS0+cmVuZGVyZXIoKSkgeworICAgICAgICBkb2N1bWVudE9yQm9keVJl bmRlcmVyID0gZG9jdW1lbnRSZW5kZXJlci5zdHlsZSgpLm92ZXJmbG93WCgpID09IE9WSVNJQkxF ICYmIGlzPEhUTUxIdG1sRWxlbWVudD4oKmRvY3VtZW50RWxlbWVudCkgPworICAgICAgICAgICAg Ym9keS0+cmVuZGVyZXIoKSA6ICZkb2N1bWVudFJlbmRlcmVyOwogICAgIH0KIAorICAgIFBhZ2lu YXRpb24gcGFnaW5hdGlvbjsKICAgICBFT3ZlcmZsb3cgb3ZlcmZsb3dZID0gZG9jdW1lbnRPckJv ZHlSZW5kZXJlci0+c3R5bGUoKS5vdmVyZmxvd1koKTsKICAgICBpZiAob3ZlcmZsb3dZID09IE9Q QUdFRFggfHwgb3ZlcmZsb3dZID09IE9QQUdFRFkpIHsKICAgICAgICAgcGFnaW5hdGlvbi5tb2Rl ID0gV2ViQ29yZTo6cGFnaW5hdGlvbk1vZGVGb3JSZW5kZXJTdHlsZShkb2N1bWVudE9yQm9keVJl bmRlcmVyLT5zdHlsZSgpKTsKICAgICAgICAgcGFnaW5hdGlvbi5nYXAgPSBzdGF0aWNfY2FzdDx1 bnNpZ25lZD4oZG9jdW1lbnRPckJvZHlSZW5kZXJlci0+c3R5bGUoKS5jb2x1bW5HYXAoKSk7CiAg ICAgfQotCiAgICAgc2V0UGFnaW5hdGlvbihwYWdpbmF0aW9uKTsKIH0KIAo=