182409 2018-02-01 15:50:26 -0800 REGRESSION (r222824): UI process crashes in WebKit::WebBackForwardList::backItem const 2018-02-01 16:40:38 -0800 1 1 1 Unclassified WebKit WebKit2 Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 177843 1 ddkilzer ddkilzer achristensen bfulgham commit-queue webkit-bug-importer oldest_to_newest 1395674 0 ddkilzer 2018-02-01 15:50:26 -0800 The UI process crashes in WebKit::WebBackForwardList::backItem const during a programmatic back navigation. In a Debug build, this assertion in WebKit::WebBackForwardList::goToItem fires instead: ASSERT(targetIndex != notFound); Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000116506834 WTFCrash + 36 (Assertions.cpp:272) 1 com.apple.WebKit 0x000000011137d13c WebKit::WebBackForwardList::goToItem(WebKit::WebBackForwardListItem&) + 892 (WebBackForwardList.cpp:207) 2 com.apple.WebKit 0x000000011168788e WebKit::WebPageProxy::backForwardGoToItem(unsigned long long, WebKit::SandboxExtension::Handle&) + 254 (WebPageProxy.cpp:4547) 3 com.apple.WebKit 0x000000011174efe1 void IPC::callMemberFunctionImpl<WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(unsigned long long, WebKit::SandboxExtension::Handle&), std::__1::tuple<unsigned long long>, 0ul, std::__1::tuple<WebKit::SandboxExtension::Handle>, 0ul>(WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(unsigned long long, WebKit::SandboxExtension::Handle&), std::__1::tuple<unsigned long long>&&, std::__1::tuple<WebKit::SandboxExtension::Handle>&, std::__1::integer_sequence<unsigned long, 0ul>, std::__1::integer_sequence<unsigned long, 0ul>) + 193 (HandleMessage.h:55) [...] The debug assertion crash is due to a typo in a for loop that causes `targetIndex` to be left at the value -1, which then causes unsigned integer overflow using checked arithmetic (resulting in the release crash): Thread 0 Crashed ↩:: Dispatch queue: com.apple.main-thread 0 com.apple.WebKit 0x00007fff372572cd WTF::CrashOnOverflow::crash() + 5 1 com.apple.WebKit 0x00007fff3724ea81 WTF::CrashOnOverflow::overflowed() + 9 2 com.apple.WebKit 0x00007fff373ed706 WebKit::WebBackForwardList::backItem() const + 60 3 com.apple.WebKit 0x00007fff3747f3fd WebKit::WebPageProxy::didChangeBackForwardList(WebKit::WebBackForwardListItem*, WTF::Vector<WTF::Ref<WebKit::WebBackForwardListItem, WTF::DumbPtrTraits<WebKit::WebBackForwardListItem> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&) + 143 4 com.apple.WebKit 0x00007fff373ed67a WebKit::WebBackForwardList::goToItem(WebKit::WebBackForwardListItem&) + 496 5 com.apple.WebKit 0x00007fff372239b3 WebKit::WebPageProxy::backForwardGoToItem(unsigned long long, WebKit::SandboxExtension::Handle&) + 201 6 com.apple.WebKit 0x00007fff374a713f void IPC::handleMessage<Messages::WebPageProxy::BackForwardGoToItem, WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(unsigned long long, WebKit::SandboxExtension::Handle&)>(IPC::Decoder&, IPC::Encoder&, WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(unsigned long long, WebKit::SandboxExtension::Handle&)) + 90 [...] 1395675 1 ddkilzer 2018-02-01 15:50:35 -0800 <rdar://problem/35495094> 1395678 2 332920 ddkilzer 2018-02-01 15:58:29 -0800 Created attachment 332920 Patch v1 1395693 3 332920 commit-queue 2018-02-01 16:40:36 -0800 Comment on attachment 332920 Patch v1 Clearing flags on attachment: 332920 Committed r227990: <https://trac.webkit.org/changeset/227990> 1395695 4 commit-queue 2018-02-01 16:40:38 -0800 All reviewed patches have been landed. Closing bug. 332920 2018-02-01 15:58:29 -0800 2018-02-01 16:40:36 -0800 Patch v1 bug-182409-20180201155828.patch text/plain 1514 ddkilzer U3VidmVyc2lvbiBSZXZpc2lvbjogMjI3OTczCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGYzMWQ3YjRjODk3MDA2MDFm NjRlNDM2YjhiZWY5MGZjODIzODFlMjkuLjJhMWI4YTJkZDcyZjQ1YjU1N2IwZGJjODQyZDkyNjUy YWM2NThlZTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTgtMDItMDEgIERhdmlkIEtp bHplciAgPGRka2lsemVyQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMjIyODI0 KTogVUkgcHJvY2VzcyBjcmFzaGVzIGluIFdlYktpdDo6V2ViQmFja0ZvcndhcmRMaXN0OjpiYWNr SXRlbSBjb25zdAorICAgICAgICA8aHR0cHM6Ly93ZWJraXQub3JnL2IvMTgyNDA5PgorICAgICAg ICA8cmRhcjovL3Byb2JsZW0vMzU0OTUwOTQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgKiBVSVByb2Nlc3MvV2ViQmFja0ZvcndhcmRMaXN0LmNwcDoK KyAgICAgICAgKFdlYktpdDo6V2ViQmFja0ZvcndhcmRMaXN0Ojpnb1RvSXRlbSk6IEZpeCB0eXBv IHNvIHRoZSBmb3IgbG9vcAorICAgICAgICBhY3R1YWxseSBjaGVja3MgZWFjaCB2YWx1ZSBpbiBt X2VudHJpZXMuCisKIDIwMTgtMDItMDEgIENhcmxvcyBHYXJjaWEgQ2FtcG9zICA8Y2dhcmNpYUBp Z2FsaWEuY29tPgogCiAgICAgICAgIFtHVEtdIFNoaWZ0ICsgbW91c2Ugc2Nyb2xsIHNob3VsZCBz Y3JvbGwgaG9yaXpvbnRhbGx5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9X ZWJCYWNrRm9yd2FyZExpc3QuY3BwIGIvU291cmNlL1dlYktpdC9VSVByb2Nlc3MvV2ViQmFja0Zv cndhcmRMaXN0LmNwcAppbmRleCAxZDFiODNlNTFmNjUxOGZmZGMyMDRiYzA1YjUyMGEzZjEyNmMw Y2M4Li45OTgyZDgxNjM3MGJmYmFlYjEwMWE4N2I5ZTRhOTk4MGRiNmY3NjY1IDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9XZWJCYWNrRm9yd2FyZExpc3QuY3BwCisrKyBiL1Nv dXJjZS9XZWJLaXQvVUlQcm9jZXNzL1dlYkJhY2tGb3J3YXJkTGlzdC5jcHAKQEAgLTE5OSw3ICsx OTksNyBAQCB2b2lkIFdlYkJhY2tGb3J3YXJkTGlzdDo6Z29Ub0l0ZW0oV2ViQmFja0ZvcndhcmRM aXN0SXRlbSYgaXRlbSkKICAgICAgICAgbV9lbnRyaWVzLnJlbW92ZShtX2N1cnJlbnRJbmRleCk7 CiAgICAgICAgIHRhcmdldEluZGV4ID0gbm90Rm91bmQ7CiAgICAgICAgIGZvciAoc2l6ZV90IGkg PSAwOyBpIDwgbV9lbnRyaWVzLnNpemUoKTsgKytpKSB7Ci0gICAgICAgICAgICBpZiAobV9lbnRy aWVzWzBdLnB0cigpID09ICZpdGVtKSB7CisgICAgICAgICAgICBpZiAobV9lbnRyaWVzW2ldLnB0 cigpID09ICZpdGVtKSB7CiAgICAgICAgICAgICAgICAgdGFyZ2V0SW5kZXggPSBpOwogICAgICAg ICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgfQo=