208314 2020-02-27 08:21:30 -0800 Crash in Document::textNodesMerged 2020-03-04 19:44:46 -0800 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 207875 InRadar P2 Normal --- 1 ajuma webkit-unassigned bfulgham product-security rniwa rohitrao webkit-bug-importer oldest_to_newest 1623488 0 391874 ajuma 2020-02-27 08:21:30 -0800 Created attachment 391874 Minimal test case Filing this as a security bug since it was found using a fuzzer; there's no disclosure deadline for this bug. Crash stack: ================================================================= ==45635==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x0003304db9b4 bp 0x7ffee96d9350 sp 0x7ffee96d9350 T0) ==45635==The signal is caused by a WRITE memory access. ==45635==Hint: address points to the zero page. ==45635==WARNING: invalid path to external symbolizer! ==45635==WARNING: Failed to use and restart external symbolizer! #0 0x3304db9b3 in WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >::Ref(WebCore::Node&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x4db9b3) #1 0x33313af25 in WebCore::boundaryTextNodesMerged(WebCore::RangeBoundaryPoint&, WebCore::NodeWithIndex&, unsigned int) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x313af25) #2 0x332f4cb9d in WebCore::Document::textNodesMerged(WebCore::Text&, unsigned int) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f4cb9d) #3 0x3330dcbba in WebCore::Node::normalize() (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x30dcbba) #4 0x33110eafd in WebCore::jsNodePrototypeFunctionNormalizeBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSNode*, JSC::ThrowScope&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x110eafd) #5 0x33108e94b in long long WebCore::IDLOperation<WebCore::JSNode>::call<&(WebCore::jsNodePrototypeFunctionNormalizeBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSNode*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x108e94b) #6 0x28fb55c01177 (<unknown module>) #7 0x34ab6145b in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xa8c45b) #8 0x34ab4a3d8 in vmEntryToJavaScript (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xa753d8) #9 0x34c172937 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x209d937) #10 0x34c79e140 in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x26c9140) #11 0x34c79e242 in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x26c9242) #12 0x34c79e61f in JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x26c961f) #13 0x33289a01b in WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x289a01b) #14 0x332964fa8 in WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2964fa8) #15 0x33296495a in WebCore::ScheduledAction::execute(WebCore::Document&) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x296495a) #16 0x333ddeaaa in WebCore::DOMTimer::fired() (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3ddeaaa) #17 0x33413cf06 in WebCore::ThreadTimers::sharedTimerFiredInternal() (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x413cf06) #18 0x3341b440e in WebCore::timerFired(__CFRunLoopTimer*, void*) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x41b440e) #19 0x7fff3d7fee14 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x59e14) #20 0x7fff3d7fe9c0 in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x599c0) #21 0x7fff3d7fe4f9 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x594f9) #22 0x7fff3d7dfb33 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x3ab33) #23 0x7fff3d7df084 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x3a084) #24 0x7fff3fa53a9e in -[NSRunLoop(NSRunLoop) runMode:beforeDate:] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x1ca9e) #25 0x7fff3fa53973 in -[NSRunLoop(NSRunLoop) run] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x1c973) #26 0x7fff69ecb1d6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x111d6) #27 0x7fff69ecacd8 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0x10cd8) #28 0x106e33465 in WebKit::XPCServiceMain(int, char const**) (/Users/chrome-bot/clusterfuzz/bot/builds/mac_asan_webkit/custom/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x904465) #29 0x7fff69c983d4 in start (/usr/lib/system/libdyld.dylib:x86_64+0x163d4) ==45635==Register values: rax = 0x0000100000000000 rbx = 0x00007ffee96d93c0 rcx = 0x0000100000000002 rdx = 0x00001c0c00032626 rdi = 0x00007ffee96d93a0 rsi = 0x0000000000000010 rbp = 0x00007ffee96d9350 rsp = 0x00007ffee96d9350 r8 = 0x0000100000000000 r9 = 0x00000fffffffffff r10 = 0x0000000000000000 r11 = 0x0000000000000128 r12 = 0x00001fffdd2db26c r13 = 0x00007ffee96d9460 r14 = 0x00007ffee96d9360 r15 = 0x00007ffee96d93a0 1623489 1 webkit-bug-importer 2020-02-27 08:21:41 -0800 <rdar://problem/59847754> 1625922 2 rniwa 2020-03-04 19:44:31 -0800 *** This bug has been marked as a duplicate of bug 207875 *** 391874 2020-02-27 08:21:30 -0800 2020-02-27 08:21:30 -0800 Minimal test case text-nodes-merged.html text/html 4259 ajuma PHN0eWxlIHR5cGU9InRleHQvY3NzIj4NCip7Ym9yZGVyLWJvdHRvbTppbmhlcml0IHJnYigxMjAl LDAlLCsxMzElKTtkaXNwbGF5Omxpc3QtaXRlbSAhaW1wb3J0YW50O2NvbnRlbnQ6dXJsKCI/Iiks ZGF0ZSgiR0N5PjIlP1xEeyZKfnxWXFx9UFwpXCJ7NGExLCUgSi5GOVt+VUdqP2xfIFBGWDRHQ1xc SmQwLTI1W1AlMCNxbn4vfVwpfGtOVkFcRURxeUhnXERDeEV5X2h5QGcwMGxacntITjU5RFwoIVxC NnI3d3BqQ2lIJThlSls3ZjIrfDgmQmx9XEEgNV9KcXAjQ2M0PC9tVU9hVzpgY1onNyFOOX5WVkJS PCxiZV0qPGMjKjlcXFV3Pi4kWm1FRFwoQUFdXCh6XU8sMntrXCg5XiVtNGEtRERcXE9iXDk1dSdE SGp2QEt1NHBhMCAtNT0hXChibDF5bXlOJjIkMSVzLD4yP2g3fWAwYT5cXG9yZi18LWM0LTpOUSc4 SFMmXChCMiZAcEZOQU57XEF5ICIpO2JvcmRlci10b3AtY29sb3I6dHJhbnNwYXJlbnQ7Y2xlYXI6 bm9uZTstd2Via2l0LWJvcmRlci1lbmQtc3R5bGU6cmlkZ2U7LXdlYmtpdC1wYWRkaW5nLWVuZDph dXRvO3RleHQtYWxpZ246aW5oZXJpdDt3aGl0ZS1zcGFjZS1jb2xsYXBzaW5nOmRpc2NhcmQ7Ym9y ZGVyLWJvdHRvbS1zdHlsZTppbmhlcml0O30NCjwvc3R5bGU+PHNjcmlwdCB0eXBlPSJ0ZXh0L2ph dmFzY3JpcHQiPg0KdmFyIGFvU2NyaXB0RWxlbWVudHMgPSBkb2N1bWVudC5nZXRFbGVtZW50c0J5 VGFnTmFtZSgic2NyaXB0Iik7DQpmb3IodmFyIGkgPSAwOyBpIDwgYW9TY3JpcHRFbGVtZW50cy5s ZW5ndGg7IGkrKykgew0KICBhb1NjcmlwdEVsZW1lbnRzW2ldLnBhcmVudE5vZGUucmVtb3ZlQ2hp bGQoYW9TY3JpcHRFbGVtZW50c1tpXSk7DQp9DQp2YXIgZXZlbnRfaGFuZGxlcl9FQjdfRE9NU3Vi dHJlZU1vZGlmaWVkX2FjdGl2ZSA9IGZhbHNlOw0KZnVuY3Rpb24gZXZlbnRfaGFuZGxlcl9FQjdf RE9NU3VidHJlZU1vZGlmaWVkKCkgew0KICBpZiAoZXZlbnRfaGFuZGxlcl9FQjdfRE9NU3VidHJl ZU1vZGlmaWVkX2FjdGl2ZSkgcmV0dXJuIDsNCiAgZXZlbnRfaGFuZGxlcl9FQjdfRE9NU3VidHJl ZU1vZGlmaWVkX2FjdGl2ZSA9IHRydWU7DQogIHZhciBvRWxlbWVudCA9IGV2ZW50LnNyY0VsZW1l bnQ7DQogIGRvY3VtZW50LmRlc2lnbk1vZGUgPSBkb2N1bWVudC5kZXNpZ25Nb2RlID09ICJvbiIg PyAib2ZmIiA6ICJvbiI7DQpvRWxlbWVudC5pbm5lckhUTUwgPSAnPHN2Zz4qNl1dXV1dXV1dXV1d XV1dPSI+RC8vLy8vLy8vLyN8XCc8ZmVDb21wb25lbnRUcmFuc2Zlcj4wJHNzc3NbfHx8fHx8fHx8 fGVlZWU6JFZWVlZWVlZWLzwvZmVDb21wb25lbnRUcmFuc2Zlcj48L3N2Zz48c3ZnPk1NTU1NTU1N TU1NWWVbc3Nzc3Nzc3NzX09cJy4uLjRSKzwvc3ZnPjxzdmc+KXtFRUVFRUVFRUUvZHsjJkxMTExM TExMTExMTExMTCs8Zm9yZWlnbk9iamVjdD4pKSkpKSkpKSl1TU1NIiIiIitWZCkpKSkpKT4+PkZl XCc8L2ZvcmVpZ25PYmplY3Q+PC9zdmc+Jw0KICB2YXIgb1NlbGVjdGlvbj13aW5kb3cuZ2V0U2Vs ZWN0aW9uKCk7DQpvU2VsZWN0aW9uLmNvbGxhcHNlVG9TdGFydCgpDQpvRWxlbWVudC5wYXJlbnRO b2RlLnJlbW92ZUNoaWxkKG9FbGVtZW50KQ0KICBldmVudF9oYW5kbGVyX0VCN19ET01TdWJ0cmVl TW9kaWZpZWRfYWN0aXZlID0gZmFsc2U7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJE T01TdWJ0cmVlTW9kaWZpZWQiLCBldmVudF9oYW5kbGVyX0VCN19ET01TdWJ0cmVlTW9kaWZpZWQp Ow0Kc2V0VGltZW91dChmdW5jdGlvbigpew0KICBkb2N1bWVudC5leGVjQ29tbWFuZCgnU2VsZWN0 QWxsJyk7DQogIHZhciBvU2VsZWN0aW9uPXdpbmRvdy5nZXRTZWxlY3Rpb24oKTsNCiAgdmFyIG9S YW5nZSA9IG9TZWxlY3Rpb24ucmFuZ2VDb3VudCA/IG9TZWxlY3Rpb24uZ2V0UmFuZ2VBdCg3OCAl IG9TZWxlY3Rpb24ucmFuZ2VDb3VudCkgOiBudWxsOw0KICB2YXIgb0VsZW1lbnQgPWZ1bmN0aW9u KCl7DQogICAgdmFyIGFvRWxlbWVudHMgPSBkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgi KiIpOw0KICAgIGlmIChhb0VsZW1lbnRzLmxlbmd0aCkgcmV0dXJuIGFvRWxlbWVudHNbODkgJSBh b0VsZW1lbnRzLmxlbmd0aF07DQogIH0oKTsNCm9FbGVtZW50Lm91dGVySFRNTCA9ICIiDQogIGRv Y3VtZW50LmV4ZWNDb21tYW5kKCdJbnNlcnRJbWFnZScpOw0KICBkb2N1bWVudC5leGVjQ29tbWFu ZCgnSnVzdGlmeVJpZ2h0Jyk7DQogIHZhciBvRWxlbWVudCA9ZnVuY3Rpb24oKXsNCiAgICB2YXIg YW9FbGVtZW50cyA9IGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCIqIik7DQogICAgaWYg KGFvRWxlbWVudHMubGVuZ3RoKSByZXR1cm4gYW9FbGVtZW50c1s3NCAlIGFvRWxlbWVudHMubGVu Z3RoXTsNCiAgfSgpOw0Kb0VsZW1lbnQuaW5uZXJIVE1MID0gJzxzdmc+byZ1VkhISEhITjY2NjY2 NjY2NjZ1c3NKaz8/Pz8/PyI8L3N2Zz48ZnJhbWVzZXQ+fn5+fkZGRkZGRkZGRkZGRkZqMX0kOjo6 OlVgb1Bra2s8L2ZyYW1lc2V0Pjxzdmc+PGVsbGlwc2U+NDQ1NSNkZGRkZGRkZEgiIiIiIiIiIno6 L0pKdnZ2dn08L2VsbGlwc2U+MzIpKSkpKSkpKSkpKSkpKWBFRUVFRUVFRSQ4XFxBQTBXPC9zdmc+ PHN2Zz4zLG4sbVpaWlplZWVlZWV8Q0NDQ0NDQ0NDS3phSG9vbzwvc3ZnPicNCiAgdmFyIG9FbGVt ZW50ID1mdW5jdGlvbigpew0KICAgIHZhciBhb0VsZW1lbnRzID0gZG9jdW1lbnQuZ2V0RWxlbWVu dHNCeVRhZ05hbWUoIioiKTsNCiAgICBpZiAoYW9FbGVtZW50cy5sZW5ndGgpIHJldHVybiBhb0Vs ZW1lbnRzWzE3ICUgYW9FbGVtZW50cy5sZW5ndGhdOw0KICB9KCk7DQpvRWxlbWVudC5wYXJlbnRO b2RlLnJlbW92ZUNoaWxkKG9FbGVtZW50KQ0KICB2YXIgb0VsZW1lbnQgPWZ1bmN0aW9uKCl7DQog ICAgdmFyIGFvRWxlbWVudHMgPSBkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgiKiIpOw0K ICAgIGlmIChhb0VsZW1lbnRzLmxlbmd0aCkgcmV0dXJuIGFvRWxlbWVudHNbNDUgJSBhb0VsZW1l bnRzLmxlbmd0aF07DQogIH0oKTsNCm9FbGVtZW50Lm5vcm1hbGl6ZSgpDQp9KTsNCjwvc2NyaXB0 Pg0KPG1ldGEgPSJydGwiLz4NCjxib2R5IGNsYXNzPSJDTEFTUzgiIHhtbDpsYW5nPSJlbiwgbmwi Pg0KPGJsb2NrcXVvdGUgY2xhc3M+DQo8Zm9ybSA+DQo8ZmllbGRzZXQgPSJBIEFBQUFBQUFBQUFB QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB QUFBQUFBQUFBQUFBIj4NCjxxIGNsYXNzPSJDTEFTUzEyInhtbDpzcGFjZT0icHJlc2VydmUiPg0K PHJ1YnkgY2xhc3M9IHhtbDpzcGFjZT0icHJlc2VydmUiPg0KPGkgY2xhc3M+DQo8aW5wdXQgInBy ZXNlcnZlIi8+DQo8L2k+DQo8L2ZpZWxkc2V0Pg0KPC9mb3JtPg0KPHRhYmxlIGNsYXNzPSJDTEFT UzkgQ0xBU1MxMCIgPSJBIEF4QnhDIj4NCjxjYXB0aW9uIGNsYXNzPSJDTEFTUzE0IENMQVNTMTIi ZGlyPSJydGwiPg0KPHR0IGNsYXNzPSB0aXRsZT0iQyBiIj4NCjxidXR0b24gY2xhc3M+DQo8c3Zn ICBzdHJva2UtbGluZWNhcD0iaW5oZXJpdCI+DQo8YW5pbWF0ZUNvbG9yIHhsaW5rOmFjdHVhdGUi bm9uZSI+DQo8Zz0iaW5oZXJpdCI+DQo8Zm9yZWlnbk9iamVjdCBjbGFzcz0iQ0xBU1M5IiJmYWxz ZSI+DQo8dXNlImhpZGRlbiI+DQo8c2V0eGxpbms6dHlwZT0ic2ltcGxlIj4NCjwvY2FwdGlvbj4N CjxoNiBjbGFzcz0+DQo8aDEgIkF4QnhDIEF4QnhDIj4NCjx0ZXh0YXJlYT4NCjwvdGV4dGFyZWE+ DQo8dGV4dGFyZWEgPg0KPC90ZXh0YXJlYT4NCjwvaDE+DQo8cCAiZW4iPg0KPHNhbXA9InJ0bCI+ DQo8eG1sOnNwYWNlPSJwcmVzZXJ2ZSI+DQo8c3VwIGNsYXNzPSB4bWw6bGFuZz0iZW4iPg0KPHN1 YiBjbGFzcz4NCjxzcGFuICJBeEJ4QyI+DQo8cnVieXRpdGxlPSJBeEJ4QyI+DQo8cmJjIGNsYXNz PSB4bWw6c3BhY2U9InByZXNlcnZlIj4NCjxyYiBjbGFzcz4NCjwvcmJjPg0KPHJ1YnkgImVuLCBu bCI+DQo8cmI9Im5sIj4NCjxzaXplPSItMTAwIj4NCjxvcHRncm91cCBjbGFzcz0gbGFiZWw9IkFB QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB QUFBQUFBQUFBQUFBQUFBQUFBQUFBIEFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBIj4NCjxvcHRncm91 cCBjbGFzcyB4bWw6c3BhY2U9InByZXNlcnZlIj4NCjx0YWJsZSBjbGFzcz4NCjwvdGFibGU+DQo8 ZGl2ICJsdHIiPg0KPHVsZGlyPSJsdHIiPg0KPC9ibG9ja3F1b3RlPg0=