218491 2020-11-03 02:20:27 -0800 Nullptr dereference in DeleteSelectionCommand::mergeParagraphs() 2020-11-17 00:22:33 -0800 1 1 1 Unclassified WebKit HTML Editing WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 iang webkit-unassigned bfulgham cgarcia ews-feeder product-security rbuis rniwa svillar webkit-bug-importer wenson_hsieh oldest_to_newest 1703878 0 iang 2020-11-03 02:20:27 -0800 Description: Crash found by fuzzing. Reproduces on WebKit revision 265497. #0 WebCore::Node::getFlag(WebCore::Node::NodeFlags) const #1 WebCore::DeleteSelectionCommand::mergeParagraphs() #2 WebCore::DeleteSelectionCommand::doApply() #3 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::EditCommand, WTF::DumbPtrTraits<WebCore::EditCommand> >&&) #4 WebCore::CompositeEditCommand::deleteSelection(WebCore::VisibleSelection const&, bool, bool, bool, bool, bool) #5 WebCore::TypingCommand::deleteKeyPressed(WebCore::TextGranularity, bool) #6 WebCore::CompositeEditCommand::apply() #7 WebCore::TypingCommand::deleteKeyPressed(WebCore::Document&, unsigned int, WebCore::TextGranularity) #8 WebCore::executeDelete(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) #9 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) #10 WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) 1703879 1 webkit-bug-importer 2020-11-03 02:20:40 -0800 <rdar://problem/70986855> 1703880 2 413025 iang 2020-11-03 02:21:17 -0800 Created attachment 413025 Crashing input 1704164 3 rniwa 2020-11-03 13:06:32 -0800 <rdar://problem/66842923> 1704508 4 rniwa 2020-11-04 10:55:34 -0800 Something like this is supposed to work but there are some test failures: Index: Source/WebCore/editing/CompositeEditCommand.cpp =================================================================== --- Source/WebCore/editing/CompositeEditCommand.cpp (revision 268963) +++ Source/WebCore/editing/CompositeEditCommand.cpp (working copy) @@ -1456,8 +1456,9 @@ ASSERT(destination.deepEquivalent().anchorNode()->isConnected()); cleanupAfterDeletion(destination); + auto newEndingSelection = VisibleSelection(destination, originalIsDirectional); // FIXME (Bug 211793): We should redesign cleanupAfterDeletion or find another destination when it is removed. - if (!destination.deepEquivalent().anchorNode()->isConnected()) + if (!destination.deepEquivalent().anchorNode()->isConnected() || newEndingSelection.isNone()) return; // Add a br if pruning an empty block level element caused a collapse. For example: @@ -1482,7 +1483,7 @@ auto destinationIndex = characterCount({ { *editableRoot, 0 }, *makeBoundaryPoint(destination) }, TextIteratorEmitsCharactersBetweenAllVisiblePositions); - setEndingSelection(VisibleSelection(destination, originalIsDirectional)); + setEndingSelection(newEndingSelection); ASSERT(endingSelection().isCaretOrRange()); OptionSet<ReplaceSelectionCommand::CommandOption> options { ReplaceSelectionCommand::SelectReplacement, ReplaceSelectionCommand::MovingParagraph }; if (!preserveStyle) 1707606 5 414166 rbuis 2020-11-15 08:38:37 -0800 Created attachment 414166 Patch 1707753 6 414212 rbuis 2020-11-16 02:56:30 -0800 Created attachment 414212 Patch 1707814 7 414212 rbuis 2020-11-16 07:47:47 -0800 Comment on attachment 414212 Patch There is probably some overlap with 218492. 1708130 8 rniwa 2020-11-16 22:29:26 -0800 (In reply to Rob Buis from comment #7) > Comment on attachment 414212 [details] > Patch > > There is probably some overlap with 218492. In that case, can we re-land the fix for the bug 218492 first and check if it also fixes this bug or not? 1708135 9 rbuis 2020-11-16 22:59:52 -0800 (In reply to Ryosuke Niwa from comment #8) > (In reply to Rob Buis from comment #7) > > Comment on attachment 414212 [details] > > Patch > > > > There is probably some overlap with 218492. > > In that case, can we re-land the fix for the bug 218492 first and check if > it also fixes this bug or not? I *think* this is happening (sorry my wording was a bit imprecise): - 218492 bt is specific to Mac. GTK instead has the bt from 218491 for the test case in 218492. - so the 218492 fix for Mac had a test case that fixes 218492 on Mac and thus equals it to GTK status, i.e. still hitting 218491. Hope that clears things up. If I am right fixing 218491 first and then relanding the 218492 fix should fix both bugs. 1708142 10 rniwa 2020-11-17 00:05:10 -0800 Ah ok. 1708145 11 ews-feeder 2020-11-17 00:22:32 -0800 Committed r269894: <https://trac.webkit.org/changeset/269894> All reviewed patches have been landed. Closing bug and clearing flags on attachment 414212. 413025 2020-11-03 02:21:17 -0800 2020-11-03 02:21:17 -0800 Crashing input bug218491.html text/html 435 iang PHNjcmlwdD4KCndpbmRvdy5vbmxvYWQgPSAoKSA9PiB7CiAgICBjb250YWluZXIuY29udGVudEVk aXRhYmxlID0gdHJ1ZTsKICAgIGdldFNlbGVjdGlvbigpLnNldFBvc2l0aW9uKGR0LCAwKTsKICAg IGRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoJ3NwYW4nKS5hcHBlbmRDaGlsZChkb2N1bWVudC5jcmVh dGVFbGVtZW50KCJ2aWRlbyIpKTsKICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJkZWxldGUiLCBm YWxzZSk7Cn0KPC9zY3JpcHQ+CjxkaXYgaWQ9ImNvbnRhaW5lciIgc3R5bGU9Ii13ZWJraXQtYm9y ZGVyLWZpdDogbGluZXM7Ij4KPGRpdiBpZD0iayIgc3R5bGU9Ii13ZWJraXQtbWFyZ2luLXN0YXJ0 OiA0MHB4OyI+PHE+PHNwYW4+PC9zcGFuPiA8L3E+PC9kaXY+CjxkaXYgaWQ9ImR0Ij48ZGV0YWls cyBvcGVuPSJ0cnVlIj5oZWxsbzwvZGV0YWlscz48L2Rpdj4K 414166 2020-11-15 08:38:37 -0800 2020-11-16 02:56:25 -0800 Patch bug-218491-20201115173835.patch text/plain 1709 rbuis U3VidmVyc2lvbiBSZXZpc2lvbjogMjY5ODE3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDIxOTY2MWM2MGZkNTkw ODZlM2JiMGI1YWRlODdkZGZiMWJmNzI0Ny4uYzZkNjIzYjU0NGE1M2M0ZWVmZmE3YjI5NTg0MDNj YWVkNTI0M2NjMCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTExLTE1ICBSb2Ig QnVpcyAgPHJidWlzQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ2hlY2sgZm9yIG5vIGVuZGluZyBz ZWxlY3Rpb24KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTIxODQ5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IFdJUC4KKworICAgICAgICAqIGVkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwOgorICAg ICAgICAoV2ViQ29yZTo6Q29tcG9zaXRlRWRpdENvbW1hbmQ6Om1vdmVQYXJhZ3JhcGhzKToKKwog MjAyMC0xMS0xNCAgWmFsYW4gQnVqdGFzICA8emFsYW5AYXBwbGUuY29tPgogCiAgICAgICAgIFtM RkNdW0lGQ10gRGlzcGxheSBydW5zIGdlbmVyYXRlZCBieSBib3hlcyBzaG91bGQgaGF2ZSBib3Jk ZXIgYm94IGdlb21ldHJpZXMKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQ29t cG9zaXRlRWRpdENvbW1hbmQuY3BwIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9Db21wb3NpdGVF ZGl0Q29tbWFuZC5jcHAKaW5kZXggN2JiYmZmNGUxODkwOGEyMDE3NTRkZmI3Y2YwODMyMWI1ZmJj ZDVjZi4uMjQ3OTczOGYyZGMyOWMwYzYxNmVkMDUxMmYwM2Q5Nzg4YTk0OTJiOCAxMDA2NDQKLS0t IGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9Db21wb3NpdGVFZGl0Q29tbWFuZC5jcHAKKysrIGIv U291cmNlL1dlYkNvcmUvZWRpdGluZy9Db21wb3NpdGVFZGl0Q29tbWFuZC5jcHAKQEAgLTE0NTcs OCArMTQ1Nyw5IEBAIHZvaWQgQ29tcG9zaXRlRWRpdENvbW1hbmQ6Om1vdmVQYXJhZ3JhcGhzKGNv bnN0IFZpc2libGVQb3NpdGlvbiYgc3RhcnRPZlBhcmFncmFwCiAgICAgQVNTRVJUKGRlc3RpbmF0 aW9uLmRlZXBFcXVpdmFsZW50KCkuYW5jaG9yTm9kZSgpLT5pc0Nvbm5lY3RlZCgpKTsKICAgICBj bGVhbnVwQWZ0ZXJEZWxldGlvbihkZXN0aW5hdGlvbik7CiAKKyAgICBhdXRvIG5ld0VuZGluZ1Nl bGVjdGlvbiA9IFZpc2libGVTZWxlY3Rpb24oZGVzdGluYXRpb24sIG9yaWdpbmFsSXNEaXJlY3Rp b25hbCk7CiAgICAgLy8gRklYTUUgKEJ1ZyAyMTE3OTMpOiBXZSBzaG91bGQgcmVkZXNpZ24gY2xl YW51cEFmdGVyRGVsZXRpb24gb3IgZmluZCBhbm90aGVyIGRlc3RpbmF0aW9uIHdoZW4gaXQgaXMg cmVtb3ZlZC4KLSAgICBpZiAoIWRlc3RpbmF0aW9uLmRlZXBFcXVpdmFsZW50KCkuYW5jaG9yTm9k ZSgpLT5pc0Nvbm5lY3RlZCgpKQorICAgIGlmICghZGVzdGluYXRpb24uZGVlcEVxdWl2YWxlbnQo KS5hbmNob3JOb2RlKCktPmlzQ29ubmVjdGVkKCkgfHwgbmV3RW5kaW5nU2VsZWN0aW9uLmlzTm9u ZSgpKQogICAgICAgICByZXR1cm47CiAKICAgICAvLyBBZGQgYSBiciBpZiBwcnVuaW5nIGFuIGVt cHR5IGJsb2NrIGxldmVsIGVsZW1lbnQgY2F1c2VkIGEgY29sbGFwc2UuIEZvciBleGFtcGxlOgo= 414212 2020-11-16 02:56:30 -0800 2020-11-17 00:22:33 -0800 Patch bug-218491-20201116115628.patch text/plain 3679 rbuis U3VidmVyc2lvbiBSZXZpc2lvbjogMjY5ODE3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDIxOTY2MWM2MGZkNTkw ODZlM2JiMGI1YWRlODdkZGZiMWJmNzI0Ny4uYjRkYTA3OWYwNzAyM2MyNDI2MDI3OTQ2Y2Q2NzNk Mzg1ZTkxZmM0MCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDIwLTExLTE2ICBSb2Ig QnVpcyAgPHJidWlzQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ2hlY2sgd2hldGhlciBkZXN0aW5h dGlvbiBzdGlsbCBjYW4gYmUgc2VsZWN0ZWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTIxODQ5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIENoZWNrIHdoZXRoZXIgZGVzdGluYXRpb24gc3RpbGwgY2FuIGJl IHNlbGVjdGVkCisgICAgICAgIGFmdGVyIGRlbGV0aW9uLgorCisgICAgICAgIFRlc3Q6IGVkaXRp bmcvZGVsZXRpbmcvZGVsZXRlLXNlbGVjdGlvbi1jcmFzaC5odG1sCisKKyAgICAgICAgKiBlZGl0 aW5nL0NvbXBvc2l0ZUVkaXRDb21tYW5kLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNvbXBvc2l0 ZUVkaXRDb21tYW5kOjptb3ZlUGFyYWdyYXBocyk6CisKIDIwMjAtMTEtMTQgIFphbGFuIEJ1anRh cyAgPHphbGFuQGFwcGxlLmNvbT4KIAogICAgICAgICBbTEZDXVtJRkNdIERpc3BsYXkgcnVucyBn ZW5lcmF0ZWQgYnkgYm94ZXMgc2hvdWxkIGhhdmUgYm9yZGVyIGJveCBnZW9tZXRyaWVzCmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0NvbXBvc2l0ZUVkaXRDb21tYW5kLmNwcCBi L1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwCmluZGV4IDdi YmJmZjRlMTg5MDhhMjAxNzU0ZGZiN2NmMDgzMjFiNWZiY2Q1Y2YuLjQ1YmE5NmU5OGU3OWE0NTUy NDg4MjNhMGE4N2NkYTM2M2RkZWRkM2QgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2VkaXRp bmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcv Q29tcG9zaXRlRWRpdENvbW1hbmQuY3BwCkBAIC0xNDU4LDcgKzE0NTgsNyBAQCB2b2lkIENvbXBv c2l0ZUVkaXRDb21tYW5kOjptb3ZlUGFyYWdyYXBocyhjb25zdCBWaXNpYmxlUG9zaXRpb24mIHN0 YXJ0T2ZQYXJhZ3JhcAogICAgIGNsZWFudXBBZnRlckRlbGV0aW9uKGRlc3RpbmF0aW9uKTsKIAog ICAgIC8vIEZJWE1FIChCdWcgMjExNzkzKTogV2Ugc2hvdWxkIHJlZGVzaWduIGNsZWFudXBBZnRl ckRlbGV0aW9uIG9yIGZpbmQgYW5vdGhlciBkZXN0aW5hdGlvbiB3aGVuIGl0IGlzIHJlbW92ZWQu Ci0gICAgaWYgKCFkZXN0aW5hdGlvbi5kZWVwRXF1aXZhbGVudCgpLmFuY2hvck5vZGUoKS0+aXND b25uZWN0ZWQoKSkKKyAgICBpZiAoIWRlc3RpbmF0aW9uLmRlZXBFcXVpdmFsZW50KCkuYW5jaG9y Tm9kZSgpLT5pc0Nvbm5lY3RlZCgpIHx8IFZpc2libGVTZWxlY3Rpb24oZGVzdGluYXRpb24sIG9y aWdpbmFsSXNEaXJlY3Rpb25hbCkuaXNOb25lKCkpCiAgICAgICAgIHJldHVybjsKIAogICAgIC8v IEFkZCBhIGJyIGlmIHBydW5pbmcgYW4gZW1wdHkgYmxvY2sgbGV2ZWwgZWxlbWVudCBjYXVzZWQg YSBjb2xsYXBzZS4gRm9yIGV4YW1wbGU6CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggNzVmNGMxZDdlMDBkZmU5MzBiZDM5ZTgw OTUxNzQ4ZDVmMjgxNjc0OS4uYjExNzYzYmZkMGY3MmEwMzQ3ZjkyY2Y1ZDliZDA5ZGIwYjdkYzc3 MyAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3RzL0No YW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTExLTE2ICBSb2IgQnVpcyAgPHJidWlzQGln YWxpYS5jb20+CisKKyAgICAgICAgQ2hlY2sgd2hldGhlciBkZXN0aW5hdGlvbiBzdGlsbCBjYW4g YmUgc2VsZWN0ZWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTIxODQ5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIEFkZCB0ZXN0Y2FzZS4KKworICAgICAgICAqIGVkaXRpbmcvZGVsZXRpbmcvZGVsZXRlLXNl bGVjdGlvbi1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGVkaXRpbmcvZGVs ZXRpbmcvZGVsZXRlLXNlbGVjdGlvbi1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAyMC0xMS0xMyAg TGF1cm8gTW91cmEgIDxsbW91cmFAaWdhbGlhLmNvbT4KIAogICAgICAgICBbR0xJQl0gR2FyZGVu aW5nIHNvbWUgZmFpbHVyZXMKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2VkaXRpbmcvZGVsZXRp bmcvZGVsZXRlLXNlbGVjdGlvbi1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9lZGl0 aW5nL2RlbGV0aW5nL2RlbGV0ZS1zZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0Cm5ldyBmaWxl IG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAuLjAzODMxNjIwZjY0ODA0NTM4ZTIwZTk2YTExMzNiYWU5MWQ2YjRjZWQKLS0tIC9kZXYvbnVs bAorKysgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2RlbGV0aW5nL2RlbGV0ZS1zZWxlY3Rpb24tY3Jh c2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEgQEAKK1Rlc3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90 IGNyYXNoLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZWRpdGluZy9kZWxldGluZy9kZWxldGUt c2VsZWN0aW9uLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2RlbGV0aW5nL2RlbGV0 ZS1zZWxlY3Rpb24tY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5mNWU4ZjdjNzMwNmExNWI3ODFlMjc3 MTMyODk2YTMzOThkOTNlYjgxCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZWRpdGlu Zy9kZWxldGluZy9kZWxldGUtc2VsZWN0aW9uLWNyYXNoLmh0bWwKQEAgLTAsMCArMSwxNSBAQAor PHNjcmlwdD4KK3dpbmRvdy5vbmxvYWQgPSAoKSA9PiB7CisgICAgaWYgKHdpbmRvdy50ZXN0UnVu bmVyKQorICAgICAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKworICAgIGdldFNlbGVjdGlv bigpLnNldFBvc2l0aW9uKHN0YXJ0LCAwKTsKKyAgICBkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdz cGFuJykuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgidmlkZW8iKSk7CisgICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoImRlbGV0ZSIsIGZhbHNlKTsKKyAgICBkb2N1bWVudC53cml0 ZSgiVGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guIikKK30KKzwvc2NyaXB0PgorPGRp diBjb250ZW50RWRpdGFibGU9InRydWUiIHN0eWxlPSItd2Via2l0LWJvcmRlci1maXQ6IGxpbmVz OyI+CisgICAgPGRpdiBzdHlsZT0iLXdlYmtpdC1tYXJnaW4tc3RhcnQ6IDQwcHg7Ij48c3Bhbj48 L3NwYW4+IDwvZGl2PgorICAgIDxkaXYgaWQ9InN0YXJ0Ij48ZGV0YWlscyBvcGVuPSJ0cnVlIj5j b250ZW50PC9kZXRhaWxzPjwvZGl2PgorPC9kaXY+Cg==