172846 2017-06-01 18:58:29 -0700 REGRESSION (r206386): Xactimate Website Crashes @ com.apple.WebKit: WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant + 255 2017-06-02 12:15:59 -0700 1 1 1 Unclassified WebKit Printing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 162521 1 cdumez cdumez commit-queue ggaren kling koivisto mark.lam saam webkit-bug-importer oldest_to_newest 1314922 0 cdumez 2017-06-01 18:58:29 -0700 Xactimate Website Crashes @ com.apple.WebKit: WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant + 255: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebKit 0x00000001041ffe8c JSC::JSCell::isString() const + 12 1 com.apple.WebKit 0x00000001041fd48e JSC::JSValue::isString() const + 62 2 com.apple.WebKit 0x00000001041fd0e7 WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant(JSC::ExecState*, JSC::JSValue, _NPVariant&) + 375 3 com.apple.WebKit 0x00000001041e05b9 WebKit::NPJSObject::invoke(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSValue, _NPVariant const*, unsigned int, _NPVariant*) + 537 4 com.apple.WebKit 0x00000001041e037b WebKit::NPJSObject::invoke(void*, _NPVariant const*, unsigned int, _NPVariant*) + 315 5 com.apple.WebKit 0x00000001041e1b2b WebKit::NPJSObject::NP_Invoke(NPObject*, void*, _NPVariant const*, unsigned int, _NPVariant*) + 59 6 com.apple.WebKit 0x00000001041e5cde WebKit::NPObjectMessageReceiver::invoke(WebKit::NPIdentifierData const&, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool&, WebKit::NPVariantData&) + 398 7 com.apple.WebKit 0x00000001041eac9c void IPC::callMemberFunctionImpl<WebKit::NPObjectMessageReceiver, void (WebKit::NPObjectMessageReceiver::*)(WebKit::NPIdentifierData const&, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool&, WebKit::NPVariantData&), std::__1::tuple<WebKit::NPIdentifierData, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> >, 0ul, 1ul, std::__1::tuple<bool, WebKit::NPVariantData>, 0ul, 1ul>(WebKit::NPObjectMessageReceiver*, void (WebKit::NPObjectMessageReceiver::*)(WebKit::NPIdentifierData const&, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool&, WebKit::NPVariantData&), std::__1::tuple<WebKit::NPIdentifierData, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> >&&, std::__1::tuple<bool, WebKit::NPVariantData>&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 284 8 com.apple.WebKit 0x00000001041e9800 void IPC::callMemberFunction<WebKit::NPObjectMessageReceiver, void (WebKit::NPObjectMessageReceiver::*)(WebKit::NPIdentifierData const&, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool&, WebKit::NPVariantData&), std::__1::tuple<WebKit::NPIdentifierData, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> >, std::__1::integer_sequence<unsigned long, 0ul, 1ul>, std::__1::tuple<bool, WebKit::NPVariantData>, std::__1::integer_sequence<unsigned long, 0ul, 1ul> >(std::__1::tuple<WebKit::NPIdentifierData, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> >&&, std::__1::tuple<bool, WebKit::NPVariantData>&, WebKit::NPObjectMessageReceiver*, void (WebKit::NPObjectMessageReceiver::*)(WebKit::NPIdentifierData const&, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool&, WebKit::NPVariantData&)) + 96 9 com.apple.WebKit 0x00000001041e85f4 void IPC::handleMessage<Messages::NPObjectMessageReceiver::Invoke, WebKit::NPObjectMessageReceiver, void (WebKit::NPObjectMessageReceiver::*)(WebKit::NPIdentifierData const&, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool&, WebKit::NPVariantData&)>(IPC::Decoder&, IPC::Encoder&, WebKit::NPObjectMessageReceiver*, void (WebKit::NPObjectMessageReceiver::*)(WebKit::NPIdentifierData const&, WTF::Vector<WebKit::NPVariantData, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool&, WebKit::NPVariantData&)) + 388 10 com.apple.WebKit 0x00000001041e7c91 WebKit::NPObjectMessageReceiver::didReceiveSyncNPObjectMessageReceiverMessage(IPC::Connection&, IPC::Decoder&, std::__1::unique_ptr<IPC::Encoder, std::__1::default_delete<IPC::Encoder> >&) + 561 11 com.apple.WebKit 0x00000001041f5d67 WebKit::NPRemoteObjectMap::didReceiveSyncMessage(IPC::Connection&, IPC::Decoder&, std::__1::unique_ptr<IPC::Encoder, std::__1::default_delete<IPC::Encoder> >&) + 103 1314923 1 cdumez 2017-06-01 18:58:46 -0700 <rdar://problem/31093005> 1314924 2 311791 cdumez 2017-06-01 19:01:25 -0700 Created attachment 311791 Patch 1314957 3 311791 cdumez 2017-06-01 21:35:31 -0700 Comment on attachment 311791 Patch Clearing flags on attachment: 311791 Committed r217695: <http://trac.webkit.org/changeset/217695> 1314958 4 cdumez 2017-06-01 21:35:33 -0700 All reviewed patches have been landed. Closing bug. 1315073 5 311791 mark.lam 2017-06-02 09:46:17 -0700 Comment on attachment 311791 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=311791&action=review > Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp:-316 > - scope.clearException(); After thinking about this some more, I wonder if convertJSValueToNPVariant() can produce an exception too. If so, you will need the above exception treatment here as well. What do you think? 1315075 6 cdumez 2017-06-02 09:51:07 -0700 (In reply to Mark Lam from comment #5) > Comment on attachment 311791 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=311791&action=review > > > Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp:-316 > > - scope.clearException(); > > After thinking about this some more, I wonder if convertJSValueToNPVariant() > can produce an exception too. If so, you will need the above exception > treatment here as well. What do you think? I believe you are right. I believe convertJSValueToNPVariant() can indeed throw. 1315078 7 311834 cdumez 2017-06-02 09:54:00 -0700 Created attachment 311834 Follow-up fix 1315144 8 311834 mark.lam 2017-06-02 11:46:42 -0700 Comment on attachment 311834 Follow-up fix r=me 1315158 9 311834 commit-queue 2017-06-02 12:15:57 -0700 Comment on attachment 311834 Follow-up fix Clearing flags on attachment: 311834 Committed r217729: <http://trac.webkit.org/changeset/217729> 1315159 10 commit-queue 2017-06-02 12:15:59 -0700 All reviewed patches have been landed. Closing bug. 311791 2017-06-01 19:01:25 -0700 2017-06-01 21:35:31 -0700 Patch bug-172846-20170601190123.patch text/plain 1805 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjE3NjgzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXggMmRjMWEwNTliZDNlNzFh N2M2MGMwMjdlMzdhMGNjYWZjYzQ1MmQ2Zi4uNzIxODgyMzAzZTA0NDM0YjhmZjhlMjE3Y2FlN2Zl MDkzYjBlZDhlMCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE3LTA2LTAxICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lPTiAocjIwNjM4 Nik6IFhhY3RpbWF0ZSBXZWJzaXRlIENyYXNoZXMgQCBjb20uYXBwbGUuV2ViS2l0OiBXZWJLaXQ6 Ok5QUnVudGltZU9iamVjdE1hcDo6Y29udmVydEpTVmFsdWVUb05QVmFyaWFudCArIDI1NQorICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTcyODQ2CisgICAg ICAgIDxyZGFyOi8vcHJvYmxlbS8zMTA5MzAwNT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBJbiBOUEpTT2JqZWN0OjppbnZva2UoKSwgcmV0dXJuIGVh cmx5IGlmIHRoZXJlIHdhcyBhbiBleGNlcHRpb24gd2hlbiBjYWxsaW5nIEpTQzo6Y2FsbCgpLgor ICAgICAgICBVc2luZyB0aGUgdmFsdWUgcmV0dXJuZWQgYnkgSlNDOjpjYWxsKCkgd2hlbiBhbiBl eGNlcHRpb24gb2NjdXJyZWQgaXMgdW5zYWZlLgorCisgICAgICAgICogV2ViUHJvY2Vzcy9QbHVn aW5zL05ldHNjYXBlL05QSlNPYmplY3QuY3BwOgorICAgICAgICAoV2ViS2l0OjpOUEpTT2JqZWN0 OjppbnZva2UpOgorCiAyMDE3LTA2LTAxICBKb24gTGVlICA8am9ubGVlQGFwcGxlLmNvbT4KIAog ICAgICAgICBSZW5hbWUgYW4gZXhwZXJpbWVudGFsIGZlYXR1cmUgaXRlbQpkaWZmIC0tZ2l0IGEv U291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9QbHVnaW5zL05ldHNjYXBlL05QSlNPYmplY3QuY3Bw IGIvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9QbHVnaW5zL05ldHNjYXBlL05QSlNPYmplY3Qu Y3BwCmluZGV4IGYyYzA2MDAwMWJjMzEzNDU1NGY2M2JiZjllZWJhMjlhYjcxNGI0MTguLjYwMjU2 NWJiYzJjNGNkZmZhOTQyOTQzNjQyZTI1OWQ3ZmZmNGZmNDkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJLaXQyL1dlYlByb2Nlc3MvUGx1Z2lucy9OZXRzY2FwZS9OUEpTT2JqZWN0LmNwcAorKysgYi9T b3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1BsdWdpbnMvTmV0c2NhcGUvTlBKU09iamVjdC5jcHAK QEAgLTMxMSw5ICszMTEsMTMgQEAgYm9vbCBOUEpTT2JqZWN0OjppbnZva2UoRXhlY1N0YXRlKiBl eGVjLCBKU0dsb2JhbE9iamVjdCogZ2xvYmFsT2JqZWN0LCBKU1ZhbHVlIGYKIAogICAgIEpTVmFs dWUgdmFsdWUgPSBKU0M6OmNhbGwoZXhlYywgZnVuY3Rpb24sIGNhbGxUeXBlLCBjYWxsRGF0YSwg bV9qc09iamVjdC5nZXQoKSwgYXJndW1lbnRMaXN0KTsKIAorICAgIGlmIChVTkxJS0VMWShzY29w ZS5leGNlcHRpb24oKSkpIHsKKyAgICAgICAgc2NvcGUuY2xlYXJFeGNlcHRpb24oKTsKKyAgICAg ICAgcmV0dXJuIGZhbHNlOworICAgIH0KKwogICAgIC8vIENvbnZlcnQgYW5kIHJldHVybiB0aGUg cmVzdWx0IG9mIHRoZSBmdW5jdGlvbiBjYWxsLgogICAgIG1fb2JqZWN0TWFwLT5jb252ZXJ0SlNW YWx1ZVRvTlBWYXJpYW50KGV4ZWMsIHZhbHVlLCAqcmVzdWx0KTsKLSAgICBzY29wZS5jbGVhckV4 Y2VwdGlvbigpOwogICAgIAogICAgIHJldHVybiB0cnVlOwogfQo= 311834 2017-06-02 09:54:00 -0700 2017-06-02 12:15:57 -0700 Follow-up fix 172846_follow-up-.patch text/plain 1557 cdumez ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQyL0No YW5nZUxvZwppbmRleCAzMmU0YjhlZTQ5Yy4uZWM1M2M3ZjE5MWEgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XZWJLaXQyL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNyBAQAorMjAxNy0wNi0wMiAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgor CisgICAgICAgIFJFR1JFU1NJT04gKHIyMDYzODYpOiBYYWN0aW1hdGUgV2Vic2l0ZSBDcmFzaGVz IEAgY29tLmFwcGxlLldlYktpdDogV2ViS2l0OjpOUFJ1bnRpbWVPYmplY3RNYXA6OmNvbnZlcnRK U1ZhbHVlVG9OUFZhcmlhbnQgKyAyNTUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTE3Mjg0NgorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMzEwOTMwMDU+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgRm9sbG93 LXVwIHRvIHIyMTc2OTUgdG8gZGVhbCB3aXRoIGV4Y2VwdGlvbnMgcG90ZW50aWFsbHkgdGhyb3du IGJ5CisgICAgICAgIE5QUnVudGltZU9iamVjdE1hcDo6Y29udmVydEpTVmFsdWVUb05QVmFyaWFu dCgpIGFzIHdlbGwuCisKKyAgICAgICAgKiBXZWJQcm9jZXNzL1BsdWdpbnMvTmV0c2NhcGUvTlBK U09iamVjdC5jcHA6CisgICAgICAgIChXZWJLaXQ6Ok5QSlNPYmplY3Q6Omludm9rZSk6CisKIDIw MTctMDYtMDIgIEd3YW5nIFlvb24gSHdhbmcgIDx5b29uQGlnYWxpYS5jb20+CiAKICAgICAgICAg UkVHUkVTU0lPTihyMjE3MjE0KTogW0Nvb3JkaW5hdGVkIEdyYXBoaWNzXSBVcGRhdGVBdGxhcyBk aWRuJ3QgcmVsZWFzZWQgd2hpbGUgcmVzZXR0aW5nIHRlc3RydW5uZXIKZGlmZiAtLWdpdCBhL1Nv dXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvUGx1Z2lucy9OZXRzY2FwZS9OUEpTT2JqZWN0LmNwcCBi L1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvUGx1Z2lucy9OZXRzY2FwZS9OUEpTT2JqZWN0LmNw cAppbmRleCA2MDI1NjViYmMyYy4uYWE3NWE5MjBkZDggMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJL aXQyL1dlYlByb2Nlc3MvUGx1Z2lucy9OZXRzY2FwZS9OUEpTT2JqZWN0LmNwcAorKysgYi9Tb3Vy Y2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1BsdWdpbnMvTmV0c2NhcGUvTlBKU09iamVjdC5jcHAKQEAg LTMxOCw2ICszMTgsMTEgQEAgYm9vbCBOUEpTT2JqZWN0OjppbnZva2UoRXhlY1N0YXRlKiBleGVj LCBKU0dsb2JhbE9iamVjdCogZ2xvYmFsT2JqZWN0LCBKU1ZhbHVlIGYKIAogICAgIC8vIENvbnZl cnQgYW5kIHJldHVybiB0aGUgcmVzdWx0IG9mIHRoZSBmdW5jdGlvbiBjYWxsLgogICAgIG1fb2Jq ZWN0TWFwLT5jb252ZXJ0SlNWYWx1ZVRvTlBWYXJpYW50KGV4ZWMsIHZhbHVlLCAqcmVzdWx0KTsK KworICAgIGlmIChVTkxJS0VMWShzY29wZS5leGNlcHRpb24oKSkpIHsKKyAgICAgICAgc2NvcGUu Y2xlYXJFeGNlcHRpb24oKTsKKyAgICAgICAgcmV0dXJuIGZhbHNlOworICAgIH0KICAgICAKICAg ICByZXR1cm4gdHJ1ZTsKIH0K