195741 2019-03-14 03:37:25 -0700 [Win][WK1] Null dereference in WebFrameNetworkingContext::storageSession 2019-03-17 19:18:19 -0700 1 1 1 Unclassified WebKit Tools / Tests WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 fujii fujii don.olmstead lforschler ross.kirsling webkit-bug-importer oldest_to_newest 1516477 0 fujii 2019-03-14 03:37:25 -0700 [WinCairo][WK1][curl] Null dereference in WebFrameNetworkingContext::storageSession I saw the following crash while browsing web sites with WinCairo WK1 MiniBrowser (trunk@242931). I don't know exact repro steps. frame()->page() was null in WebFrameNetworkingContext::storageSession(). Callstack: > WebKit.dll!PAL::SessionID::isEphemeral() Line 54 C++ > WebKit.dll!WebCore::Page::usesEphemeralSession() Line 602 C++ > WebKit.dll!WebFrameNetworkingContext::storageSession() Line 112 C++ > WebKit.dll!WebCore::handleCookieHeaders(WebCore::ResourceHandleInternal * d, const WebCore::ResourceRequest & request, const WebCore::CurlResponse & response) Line 92 C++ > WebKit.dll!WebCore::CurlResourceHandleDelegate::curlDidReceiveResponse(WebCore::CurlRequest & request, const WebCore::CurlResponse & receivedResponse) Line 117 C++ > WebKit.dll!WebCore::CurlRequest::invokeDidReceiveResponse::<unnamed-tag>::operator()(WebCore::CurlRequest & request, WebCore::CurlRequestClient & client) Line 558 C++ > WebKit.dll!WTF::Function<void (WebCore::CurlRequest &, WebCore::CurlRequestClient &)>::CallableWrapper<`lambda at ..\..\Source\WebCore\platform\network\curl\CurlRequest.cpp:556:16'>::call(WebCore::CurlRequest & in, WebCore::CurlRequestClient & in) Line 102 C++ > WebKit.dll!WTF::Function<void (WebCore::CurlRequest &, WebCore::CurlRequestClient &)>::operator()(WebCore::CurlRequest & in, WebCore::CurlRequestClient & in) Line 57 C++ > WebKit.dll!WebCore::CurlRequest::callClient::<unnamed-tag>::operator()() Line 165 C++ > WebKit.dll!WTF::Function<void ()>::CallableWrapper<`lambda at ..\..\Source\WebCore\platform\network\curl\CurlRequest.cpp:163:21'>::call() Line 102 C++ > WTF.dll!WTF::Function<void ()>::operator()() Line 57 C++ > WTF.dll!WTF::dispatchFunctionsFromMainThread() Line 115 C++ > WTF.dll!WTF::ThreadingWindowWndProc(HWND__ * hWnd, unsigned int message, unsigned __int64 wParam, __int64 lParam) Line 48 C++ > [External Code] > WebKit.dll!WebKitMessageLoop::run(HACCEL__ * hAccelTable) Line 94 C++ > MiniBrowserLib.dll!wWinMain(HINSTANCE__ * hInstance, HINSTANCE__ * hPrevInstance, wchar_t * lpstrCmdLine, int nCmdShow) Line 87 C++ > MiniBrowserLib.dll!dllLauncherEntryPoint(HINSTANCE__ * hInstance, HINSTANCE__ * hPrevInstance, wchar_t * lpstrCmdLine, int nCmdShow) Line 105 C++ > MiniBrowser.exe!wWinMain(HINSTANCE__ * hInstance, HINSTANCE__ * hPrevInstance, wchar_t * lpstrCmdLine, int nCmdShow) Line 232 C++ > [External Code] 1516936 1 fujii 2019-03-15 02:04:34 -0700 One of LayoutTests crashes with the same backtrace. > python ./Tools/Scripts/run-webkit-tests --debug --wincairo --no-new-test-results --no-retry-failures --dump-render-tree http/tests/ssl/ping-with-unsafe-redirect.html http/tests/ssl/referer-301.html 1516937 2 fujii 2019-03-15 02:09:26 -0700 Mac port WK1 fixed it. Windows port should do the same. Bug 183455 – Possible null dereference of the page under WebFrameNetworkingContext::storageSession() 1516939 3 fujii 2019-03-15 02:34:24 -0700 Unskpped http/tests/ssl tests. https://trac.webkit.org/changeset/242993/ 1516943 4 364784 fujii 2019-03-15 02:57:15 -0700 Created attachment 364784 Patch 1516950 5 364788 fujii 2019-03-15 03:49:10 -0700 Created attachment 364788 Patch 1517598 6 364788 fujii 2019-03-17 19:17:27 -0700 Comment on attachment 364788 Patch Clearing flags on attachment: 364788 Committed r243055: <https://trac.webkit.org/changeset/243055> 1517599 7 fujii 2019-03-17 19:17:29 -0700 All reviewed patches have been landed. Closing bug. 1517600 8 webkit-bug-importer 2019-03-17 19:18:19 -0700 <rdar://problem/48967519> 364784 2019-03-15 02:57:15 -0700 2019-03-15 03:48:52 -0700 Patch bug-195741-20190315185713.patch text/plain 3083 fujii U3VidmVyc2lvbiBSZXZpc2lvbjogMjQyOTkzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0TGVn YWN5L3dpbi9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0TGVnYWN5L3dpbi9DaGFuZ2VMb2cKaW5k ZXggNWE3MGU3ZTZmZmU3NzY1YTgxYzIzNjdlZDBhNzE3NjYxNzlhZmNlYS4uZmJlZjA2NjcyODc4 ZTdkY2VhNmFjMDdhMzY5ZTkxNWUwNGRmNTI4MCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdExl Z2FjeS93aW4vQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvd2luL0NoYW5nZUxv ZwpAQCAtMSwzICsxLDEzIEBACisyMDE5LTAzLTE1ICBGdWppaSBIaXJvbm9yaSAgPEhpcm9ub3Jp LkZ1amlpQHNvbnkuY29tPgorCisgICAgICAgIFtXaW5DYWlyb11bV0sxXVtjdXJsXSBOdWxsIGRl cmVmZXJlbmNlIGluIFdlYkZyYW1lTmV0d29ya2luZ0NvbnRleHQ6OnN0b3JhZ2VTZXNzaW9uCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTU3NDEKKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIFdlYkNvcmVT dXBwb3J0L1dlYkZyYW1lTmV0d29ya2luZ0NvbnRleHQuY3BwOgorICAgICAgICAoV2ViRnJhbWVO ZXR3b3JraW5nQ29udGV4dDo6c3RvcmFnZVNlc3Npb24gY29uc3QpOiBBZGRlZCBhIG51bGwgY2hl Y2sgb2YgZnJhbWUoKS0+cGFnZSgpIGFzIHdlbGwgYXMgTWFjIHBvcnQgZG9lcyAoQnVnIDE4MzQ1 NSkuCisKIDIwMTktMDMtMTMgIFJ5YW4gSGFkZGFkICA8cnlhbmhhZGRhZEBhcHBsZS5jb20+CiAK ICAgICAgICAgVW5yZXZpZXdlZCBhdHRlbXB0IHRvIGZpeCB0aGUgV2luZG93cyBidWlsZCBhZnRl ciByMjQyOTIwLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdExlZ2FjeS93aW4vV2ViQ29yZVN1 cHBvcnQvV2ViRnJhbWVOZXR3b3JraW5nQ29udGV4dC5jcHAgYi9Tb3VyY2UvV2ViS2l0TGVnYWN5 L3dpbi9XZWJDb3JlU3VwcG9ydC9XZWJGcmFtZU5ldHdvcmtpbmdDb250ZXh0LmNwcAppbmRleCBh NWJiOGE3OTViOWEwYWMxMzE5NWUxNWUwYzQwZDAxMDhkMmQ0NDJlLi4xMTI1MmI3YjBiNDQzYTBk YmNmZWY2OTFmZjAzNWNmMGYwMTE0OTc4IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0TGVnYWN5 L3dpbi9XZWJDb3JlU3VwcG9ydC9XZWJGcmFtZU5ldHdvcmtpbmdDb250ZXh0LmNwcAorKysgYi9T b3VyY2UvV2ViS2l0TGVnYWN5L3dpbi9XZWJDb3JlU3VwcG9ydC9XZWJGcmFtZU5ldHdvcmtpbmdD b250ZXh0LmNwcApAQCAtMTA5LDcgKzEwOSw3IEBAIE5ldHdvcmtTdG9yYWdlU2Vzc2lvbiogV2Vi RnJhbWVOZXR3b3JraW5nQ29udGV4dDo6c3RvcmFnZVNlc3Npb24oKSBjb25zdAogewogICAgIEFT U0VSVChpc01haW5UaHJlYWQoKSk7CiAKLSAgICBpZiAoZnJhbWUoKSAmJiBmcmFtZSgpLT5wYWdl KCktPnVzZXNFcGhlbWVyYWxTZXNzaW9uKCkpCisgICAgaWYgKGZyYW1lKCkgJiYgZnJhbWUoKS0+ cGFnZSgpICYmIGZyYW1lKCktPnBhZ2UoKS0+dXNlc0VwaGVtZXJhbFNlc3Npb24oKSkKICAgICAg ICAgcmV0dXJuIE5ldHdvcmtTdG9yYWdlU2Vzc2lvbk1hcDo6c3RvcmFnZVNlc3Npb24oUEFMOjpT ZXNzaW9uSUQ6OmxlZ2FjeVByaXZhdGVTZXNzaW9uSUQoKSk7CiAKICAgICByZXR1cm4gJk5ldHdv cmtTdG9yYWdlU2Vzc2lvbk1hcDo6ZGVmYXVsdFN0b3JhZ2VTZXNzaW9uKCk7CmRpZmYgLS1naXQg YS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggODM1 Nzk3MzE4ZDIwZTI4YjA5ZGYwM2YwZDJiOGVmMzA1NjcxMjdhNS4uNDdmMzQ3NDBkYjA0MTNiMmFk MzZhOWJlMTQzYmIxMDhjZDliOWNhNyAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEyIEBACisyMDE5LTAzLTE1 ICBGdWppaSBIaXJvbm9yaSAgPEhpcm9ub3JpLkZ1amlpQHNvbnkuY29tPgorCisgICAgICAgIFtX aW5DYWlyb11bV0sxXVtjdXJsXSBOdWxsIGRlcmVmZXJlbmNlIGluIFdlYkZyYW1lTmV0d29ya2lu Z0NvbnRleHQ6OnN0b3JhZ2VTZXNzaW9uCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xOTU3NDEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICAqIHBsYXRmb3JtL3dpbmNhaXJvL1Rlc3RFeHBlY3RhdGlvbnM6IFVu c2tpcHBlZCBodHRwL3Rlc3RzL3NzbC9waW5nLXdpdGgtdW5zYWZlLXJlZGlyZWN0Lmh0bWwuCisK IDIwMTktMDMtMTUgIEZ1amlpIEhpcm9ub3JpICA8SGlyb25vcmkuRnVqaWlAc29ueS5jb20+CiAK ICAgICAgICAgVW5yZXZpZXdlZCB0ZXN0IGdhcmRlbmluZyBmb3IgV2luQ2Fpcm8gcG9ydApkaWZm IC0tZ2l0IGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0vd2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9ucyBi L0xheW91dFRlc3RzL3BsYXRmb3JtL3dpbmNhaXJvL1Rlc3RFeHBlY3RhdGlvbnMKaW5kZXggNWRh OGQyMzE2NjIxZmViMjQ5YzdmMDdlNDhlMWY0ZTc4ZmZhZDY5MC4uYzA4ODk3MGFjYmY2MDg2Zjlk Y2M2NGY0OTZlMDExMzRlNTQzMTU2ZCAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0v d2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9ucworKysgYi9MYXlvdXRUZXN0cy9wbGF0Zm9ybS93aW5j YWlyby9UZXN0RXhwZWN0YXRpb25zCkBAIC05NTQsNyArOTU0LDYgQEAgaHR0cC90ZXN0cy9zZWN1 cml0eS9jb29raWVzL3RoaXJkLXBhcnR5LWNvb2tpZS1ibG9ja2luZy14c2x0LnhtbCBbIFBhc3Mg XQogCiBodHRwL3Rlc3RzL3NzbC9pZnJhbWUtdXBncmFkZS5odHRwcy5odG1sIFsgU2tpcCBdCiBo dHRwL3Rlc3RzL3NzbC9taXhlZENvbnRlbnQvaW5zZWN1cmUtd2Vic29ja2V0Lmh0bWwgWyBGYWls dXJlIF0KLXdlYmtpdC5vcmcvYi8xOTU3NDEgaHR0cC90ZXN0cy9zc2wvcGluZy13aXRoLXVuc2Fm ZS1yZWRpcmVjdC5odG1sIFsgU2tpcCBdCiBodHRwL3Rlc3RzL3NzbC91cGdyYWRlLW9yaWdpbi11 c2FnZS5odG1sIFsgRmFpbHVyZSBdCiAKIGh0dHAvdGVzdHMvc3NsL21lZGlhLXN0cmVhbSBbIFNr aXAgXQo= 364788 2019-03-15 03:49:10 -0700 2019-03-17 19:17:27 -0700 Patch bug-195741-20190315194909.patch text/plain 3061 fujii U3VidmVyc2lvbiBSZXZpc2lvbjogMjQyOTkzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0TGVn YWN5L3dpbi9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0TGVnYWN5L3dpbi9DaGFuZ2VMb2cKaW5k ZXggNWE3MGU3ZTZmZmU3NzY1YTgxYzIzNjdlZDBhNzE3NjYxNzlhZmNlYS4uMWExOTg4ZjBjYzcx ZmRmYTliNzRkY2U1NjgzZDA2YTc5NTQ2N2ZiMSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdExl Z2FjeS93aW4vQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvd2luL0NoYW5nZUxv ZwpAQCAtMSwzICsxLDEzIEBACisyMDE5LTAzLTE1ICBGdWppaSBIaXJvbm9yaSAgPEhpcm9ub3Jp LkZ1amlpQHNvbnkuY29tPgorCisgICAgICAgIFtXaW5dW1dLMV0gTnVsbCBkZXJlZmVyZW5jZSBp biBXZWJGcmFtZU5ldHdvcmtpbmdDb250ZXh0OjpzdG9yYWdlU2Vzc2lvbgorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk1NzQxCisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBXZWJDb3JlU3VwcG9ydC9XZWJG cmFtZU5ldHdvcmtpbmdDb250ZXh0LmNwcDoKKyAgICAgICAgKFdlYkZyYW1lTmV0d29ya2luZ0Nv bnRleHQ6OnN0b3JhZ2VTZXNzaW9uIGNvbnN0KTogQWRkZWQgYSBudWxsIGNoZWNrIG9mIGZyYW1l KCktPnBhZ2UoKSBhcyB3ZWxsIGFzIE1hYyBwb3J0IGRvZXMgKEJ1ZyAxODM0NTUpLgorCiAyMDE5 LTAzLTEzICBSeWFuIEhhZGRhZCAgPHJ5YW5oYWRkYWRAYXBwbGUuY29tPgogCiAgICAgICAgIFVu cmV2aWV3ZWQgYXR0ZW1wdCB0byBmaXggdGhlIFdpbmRvd3MgYnVpbGQgYWZ0ZXIgcjI0MjkyMC4K ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXRMZWdhY3kvd2luL1dlYkNvcmVTdXBwb3J0L1dlYkZy YW1lTmV0d29ya2luZ0NvbnRleHQuY3BwIGIvU291cmNlL1dlYktpdExlZ2FjeS93aW4vV2ViQ29y ZVN1cHBvcnQvV2ViRnJhbWVOZXR3b3JraW5nQ29udGV4dC5jcHAKaW5kZXggYTViYjhhNzk1Yjlh MGFjMTMxOTVlMTVlMGM0MGQwMTA4ZDJkNDQyZS4uMTEyNTJiN2IwYjQ0M2EwZGJjZmVmNjkxZmYw MzVjZjBmMDExNDk3OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdExlZ2FjeS93aW4vV2ViQ29y ZVN1cHBvcnQvV2ViRnJhbWVOZXR3b3JraW5nQ29udGV4dC5jcHAKKysrIGIvU291cmNlL1dlYktp dExlZ2FjeS93aW4vV2ViQ29yZVN1cHBvcnQvV2ViRnJhbWVOZXR3b3JraW5nQ29udGV4dC5jcHAK QEAgLTEwOSw3ICsxMDksNyBAQCBOZXR3b3JrU3RvcmFnZVNlc3Npb24qIFdlYkZyYW1lTmV0d29y a2luZ0NvbnRleHQ6OnN0b3JhZ2VTZXNzaW9uKCkgY29uc3QKIHsKICAgICBBU1NFUlQoaXNNYWlu VGhyZWFkKCkpOwogCi0gICAgaWYgKGZyYW1lKCkgJiYgZnJhbWUoKS0+cGFnZSgpLT51c2VzRXBo ZW1lcmFsU2Vzc2lvbigpKQorICAgIGlmIChmcmFtZSgpICYmIGZyYW1lKCktPnBhZ2UoKSAmJiBm cmFtZSgpLT5wYWdlKCktPnVzZXNFcGhlbWVyYWxTZXNzaW9uKCkpCiAgICAgICAgIHJldHVybiBO ZXR3b3JrU3RvcmFnZVNlc3Npb25NYXA6OnN0b3JhZ2VTZXNzaW9uKFBBTDo6U2Vzc2lvbklEOjps ZWdhY3lQcml2YXRlU2Vzc2lvbklEKCkpOwogCiAgICAgcmV0dXJuICZOZXR3b3JrU3RvcmFnZVNl c3Npb25NYXA6OmRlZmF1bHRTdG9yYWdlU2Vzc2lvbigpOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz dHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDgzNTc5NzMxOGQyMGUy OGIwOWRmMDNmMGQyYjhlZjMwNTY3MTI3YTUuLjZkYjIwZDA5Njk2N2M1NjZhZTczZWVlMjRlNGRm OWEwMDk1ZTQzMzggMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMiBAQAorMjAxOS0wMy0xNSAgRnVqaWkgSGly b25vcmkgIDxIaXJvbm9yaS5GdWppaUBzb255LmNvbT4KKworICAgICAgICBbV2luXVtXSzFdIE51 bGwgZGVyZWZlcmVuY2UgaW4gV2ViRnJhbWVOZXR3b3JraW5nQ29udGV4dDo6c3RvcmFnZVNlc3Np b24KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5NTc0 MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogcGxh dGZvcm0vd2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9uczogVW5za2lwcGVkIGh0dHAvdGVzdHMvc3Ns L3Bpbmctd2l0aC11bnNhZmUtcmVkaXJlY3QuaHRtbC4KKwogMjAxOS0wMy0xNSAgRnVqaWkgSGly b25vcmkgIDxIaXJvbm9yaS5GdWppaUBzb255LmNvbT4KIAogICAgICAgICBVbnJldmlld2VkIHRl c3QgZ2FyZGVuaW5nIGZvciBXaW5DYWlybyBwb3J0CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9w bGF0Zm9ybS93aW5jYWlyby9UZXN0RXhwZWN0YXRpb25zIGIvTGF5b3V0VGVzdHMvcGxhdGZvcm0v d2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9ucwppbmRleCA1ZGE4ZDIzMTY2MjFmZWIyNDljN2YwN2U0 OGUxZjRlNzhmZmFkNjkwLi5jMDg4OTcwYWNiZjYwODZmOWRjYzY0ZjQ5NmUwMTEzNGU1NDMxNTZk IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9wbGF0Zm9ybS93aW5jYWlyby9UZXN0RXhwZWN0YXRp b25zCisrKyBiL0xheW91dFRlc3RzL3BsYXRmb3JtL3dpbmNhaXJvL1Rlc3RFeHBlY3RhdGlvbnMK QEAgLTk1NCw3ICs5NTQsNiBAQCBodHRwL3Rlc3RzL3NlY3VyaXR5L2Nvb2tpZXMvdGhpcmQtcGFy dHktY29va2llLWJsb2NraW5nLXhzbHQueG1sIFsgUGFzcyBdCiAKIGh0dHAvdGVzdHMvc3NsL2lm cmFtZS11cGdyYWRlLmh0dHBzLmh0bWwgWyBTa2lwIF0KIGh0dHAvdGVzdHMvc3NsL21peGVkQ29u dGVudC9pbnNlY3VyZS13ZWJzb2NrZXQuaHRtbCBbIEZhaWx1cmUgXQotd2Via2l0Lm9yZy9iLzE5 NTc0MSBodHRwL3Rlc3RzL3NzbC9waW5nLXdpdGgtdW5zYWZlLXJlZGlyZWN0Lmh0bWwgWyBTa2lw IF0KIGh0dHAvdGVzdHMvc3NsL3VwZ3JhZGUtb3JpZ2luLXVzYWdlLmh0bWwgWyBGYWlsdXJlIF0K IAogaHR0cC90ZXN0cy9zc2wvbWVkaWEtc3RyZWFtIFsgU2tpcCBdCg==