212427 2020-05-27 11:54:18 -0700 REGRESSION (r254541): Valid mime types can only be added to the HashSet of the supported types for encoding 2020-05-27 12:48:57 -0700 1 1 1 Unclassified WebKit Images WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 sabouhallawa sabouhallawa darin webkit-bug-importer oldest_to_newest 1656495 0 sabouhallawa 2020-05-27 11:54:18 -0700 Sometimes we hit this crash when calling toDataURL on canvas: Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000010) [ 0] 0x00007fff3b6f2667 WebCore`unsigned int WTF::IdentityHashTranslator<WTF::HashTraits<WTF::String>, WTF::ASCIICaseInsensitiveHash>::hash<WTF::String>(WTF::String const&) [inlined] WTF::StringImpl::is8Bit() const at StringImpl.h:285:34 0x00007fff3b6f2660: pushq %rbp 0x00007fff3b6f2661: movq %rsp, %rbp 0x00007fff3b6f2664: movq (%rdi), %rcx -> 0x00007fff3b6f2667: testb $0x4, 0x10(%rcx) 0x00007fff3b6f266b: jne 0x25f67a ; <+26> [inlined] WTF::StringImpl::characters8() const at StringHash.h:112 0x00007fff3b6f266d: movq 0x8(%rcx), %rdi 0x00007fff3b6f2671: movl 0x4(%rcx), %esi 0x00007fff3b6f2674: popq %rbp [ 0] 0x00007fff3b6f2667 WebCore`unsigned int WTF::IdentityHashTranslator<WTF::HashTraits<WTF::String>, WTF::ASCIICaseInsensitiveHash>::hash<WTF::String>(WTF::String const&) [inlined] WTF::ASCIICaseInsensitiveHash::hash(WTF::StringImpl&) at StringHash.h:111 [ 0] 0x00007fff3b6f2667 WebCore`unsigned int WTF::IdentityHashTranslator<WTF::HashTraits<WTF::String>, WTF::ASCIICaseInsensitiveHash>::hash<WTF::String>(WTF::String const&) [inlined] WTF::ASCIICaseInsensitiveHash::hash(WTF::StringImpl*) at StringHash.h:118 [ 0] 0x00007fff3b6f2667 WebCore`unsigned int WTF::IdentityHashTranslator<WTF::HashTraits<WTF::String>, WTF::ASCIICaseInsensitiveHash>::hash<WTF::String>(WTF::String const&) [inlined] WTF::ASCIICaseInsensitiveHash::hash(WTF::String const&) + 3 at StringHash.h:164 [ 0] 0x00007fff3b6f2664 WebCore`unsigned int WTF::IdentityHashTranslator<WTF::HashTraits<WTF::String>, WTF::ASCIICaseInsensitiveHash>::hash<WTF::String>(WTF::String const&) + 4 at HashTable.h:289 [ 1] 0x00007fff3b6f249a WebCore`WTF::HashTable<WTF::String, WTF::String, WTF::IdentityExtractor, WTF::ASCIICaseInsensitiveHash, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String> >::add(WTF::String const&) [inlined] WTF::HashTableAddResult<WTF::HashTableIterator<WTF::String, WTF::String, WTF::IdentityExtractor, WTF::ASCIICaseInsensitiveHash, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String> > > WTF::HashTable<WTF::String, WTF::String, WTF::IdentityExtractor, WTF::ASCIICaseInsensitiveHash, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String> >::add<WTF::IdentityHashTranslator<WTF::HashTraits<WTF::String>, WTF::ASCIICaseInsensitiveHash>, WTF::String const&, WTF::String const&>(WTF::String const&, WTF::String const&) + 62 at HashTable.h:938:22 [ 1] 0x00007fff3b6f245c WebCore`WTF::HashTable<WTF::String, WTF::String, WTF::IdentityExtractor, WTF::ASCIICaseInsensitiveHash, WTF::HashTraits<WTF::String>, WTF::HashTraits<WTF::String> >::add(WTF::String const&) + 28 at HashTable.h:466 [ 2] 0x00007fff3ce1fee4 WebCore`WebCore::MIMETypeRegistry::createMIMETypeRegistryThreadGlobalData() [inlined] WTF::HashSet<WTF::String, WTF::ASCIICaseInsensitiveHash, WTF::HashTraits<WTF::String> >::add(WTF::String const&) + 15 at HashSet.h:239:19 [ 2] 0x00007fff3ce1fed5 WebCore`WebCore::MIMETypeRegistry::createMIMETypeRegistryThreadGlobalData() + 245 at MIMETypeRegistry.cpp:464 [ 3] 0x00007fff3ce368d1 WebCore`WebCore::ThreadGlobalData::mimeTypeRegistryThreadGlobalData() + 49 at ThreadGlobalData.cpp:124:46 [ 4] 0x00007fff3b6bd5e4 WebCore`WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(WTF::String const&) + 52 at MIMETypeRegistry.cpp:493:31 [ 5] 0x00007fff3c9e57fb WebCore`WebCore::HTMLCanvasElement::toDataURL(WTF::String const&, JSC::JSValue) [inlined] WebCore::toEncodingMimeType(WTF::String const&) + 7 at HTMLCanvasElement.cpp:662:10 [ 5] 0x00007fff3c9e57f4 WebCore`WebCore::HTMLCanvasElement::toDataURL(WTF::String const&, JSC::JSValue) + 164 at HTMLCanvasElement.cpp:690 [ 6] 0x00007fff3bb5a944 WebCore`WebCore::jsHTMLCanvasElementPrototypeFunctionToDataURL(JSC::JSGlobalObject*, JSC::CallFrame*) [inlined] WebCore::jsHTMLCanvasElementPrototypeFunctionToDataURLBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSHTMLCanvasElement*, JSC::ThrowScope&) + 111 at JSHTMLCanvasElement.cpp:333:93 [ 6] 0x00007fff3bb5a8d5 WebCore`WebCore::jsHTMLCanvasElementPrototypeFunctionToDataURL(JSC::JSGlobalObject*, JSC::CallFrame*) [inlined] long long WebCore::IDLOperation<WebCore::JSHTMLCanvasElement>::call<&(WebCore::jsHTMLCanvasElementPrototypeFunctionToDataURLBody(JSC::JSGl There might be a bug or a behavior change in the underlying frameworks when converting a UTI to a mime type. But WebKit has to check the validity of the mime type before adding it to the HashSet. 1656498 1 sabouhallawa 2020-05-27 11:55:12 -0700 <rdar://problem/63540492> 1656502 2 400362 sabouhallawa 2020-05-27 11:59:22 -0700 Created attachment 400362 Patch 1656522 3 ews-feeder 2020-05-27 12:48:57 -0700 Committed r262208: <https://trac.webkit.org/changeset/262208> All reviewed patches have been landed. Closing bug and clearing flags on attachment 400362. 400362 2020-05-27 11:59:22 -0700 2020-05-27 12:48:57 -0700 Patch bug-212427-20200527115921.patch text/plain 1965 sabouhallawa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI2MjIwNCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA1LTI3ICBTYWlkIEFi b3UtSGFsbGF3YSAgPHNhYm91aGFsbGF3YUBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lP TiAocjI1NDU0MSk6IFZhbGlkIG1pbWUgdHlwZXMgY2FuIG9ubHkgYmUgYWRkZWQgdG8gdGhlIEhh c2hTZXQgb2YgdGhlIHN1cHBvcnRlZCB0eXBlcyBmb3IgZW5jb2RpbmcKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxMjQyNworCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCBiYWNrIGEgY2hlY2sgZm9yIHRo ZSBtaW1lIHR5cGUgdmFsaWRpdHkgd2hpY2ggd2FzIHJlbW92ZWQgaW4gcjI1NDU0MS4KKworICAg ICAgICAqIHBsYXRmb3JtL01JTUVUeXBlUmVnaXN0cnkuY3BwOgorICAgICAgICAoV2ViQ29yZTo6 TUlNRVR5cGVSZWdpc3RyeTo6Y3JlYXRlTUlNRVR5cGVSZWdpc3RyeVRocmVhZEdsb2JhbERhdGEp OgorCiAyMDIwLTA1LTI3ICBEZXZpbiBSb3Vzc28gIDxkcm91c3NvQGFwcGxlLmNvbT4KIAogICAg ICAgICBXZWIgSW5zcGVjdG9yOiByZXBsYWNlIGBmZWF0dXJlR3VhcmRgIGFuZCBgYXZhaWxhYmls aXR5YCB3aXRoIGEgY29tYmluZWQgYGNvbmRpdGlvbmAgdGhhdCBhY2NlcHRzIGFueSBtYWNybwpJ bmRleDogU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vTUlNRVR5cGVSZWdpc3RyeS5jcHAKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vTUlNRVR5cGVSZWdpc3RyeS5jcHAJKHJl dmlzaW9uIDI2MjE4MykKKysrIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL01JTUVUeXBlUmVnaXN0 cnkuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00NTYsMTAgKzQ1NiwxMiBAQCBzdGQ6OnVuaXF1ZV9w dHI8TUlNRVR5cGVSZWdpc3RyeVRocmVhZEdsCiAgICAgQ0ZJbmRleCBjb3VudCA9IENGQXJyYXlH ZXRDb3VudChzdXBwb3J0ZWRUeXBlcy5nZXQoKSk7CiAgICAgZm9yIChDRkluZGV4IGkgPSAwOyBp IDwgY291bnQ7IGkrKykgewogICAgICAgICBDRlN0cmluZ1JlZiBzdXBwb3J0ZWRUeXBlID0gcmVp bnRlcnByZXRfY2FzdDxDRlN0cmluZ1JlZj4oQ0ZBcnJheUdldFZhbHVlQXRJbmRleChzdXBwb3J0 ZWRUeXBlcy5nZXQoKSwgaSkpOwotICAgICAgICBpZiAoaXNTdXBwb3J0ZWRJbWFnZVR5cGUoc3Vw cG9ydGVkVHlwZSkpIHsKLSAgICAgICAgICAgIFN0cmluZyBtaW1lVHlwZSA9IE1JTUVUeXBlRm9y SW1hZ2VUeXBlKHN1cHBvcnRlZFR5cGUpOwotICAgICAgICAgICAgc3VwcG9ydGVkSW1hZ2VNSU1F VHlwZXNGb3JFbmNvZGluZy5hZGQobWltZVR5cGUpOwotICAgICAgICB9CisgICAgICAgIGlmICgh aXNTdXBwb3J0ZWRJbWFnZVR5cGUoc3VwcG9ydGVkVHlwZSkpCisgICAgICAgICAgICBjb250aW51 ZTsKKyAgICAgICAgU3RyaW5nIG1pbWVUeXBlID0gTUlNRVR5cGVGb3JJbWFnZVR5cGUoc3VwcG9y dGVkVHlwZSk7CisgICAgICAgIGlmIChtaW1lVHlwZS5pc0VtcHR5KCkpCisgICAgICAgICAgICBj b250aW51ZTsKKyAgICAgICAgc3VwcG9ydGVkSW1hZ2VNSU1FVHlwZXNGb3JFbmNvZGluZy5hZGQo bWltZVR5cGUpOwogICAgIH0KICNlbHNlCiAgICAgSGFzaFNldDxTdHJpbmcsIEFTQ0lJQ2FzZUlu c2Vuc2l0aXZlSGFzaD4gc3VwcG9ydGVkSW1hZ2VNSU1FVHlwZXNGb3JFbmNvZGluZyA9IHN0ZDo6 aW5pdGlhbGl6ZXJfbGlzdDxTdHJpbmc+IHsK