221786 2021-02-11 17:01:47 -0800 Nullopt crash in DOMSelection::getRangeAt 2021-02-15 18:02:40 -0800 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=221942 InRadar P2 Normal --- 1 rniwa rniwa darin webkit-bug-importer wenson_hsieh oldest_to_newest 1728369 0 rniwa 2021-02-11 17:01:47 -0800 We're somehow hitting nullptr crash in DOMSelection::getRangeAt: 0 WebCore 0x0000000192226334 WebCore::DOMSelection::getRangeAt(unsigned int) + 1332 (DOMSelection.cpp:0) 1 WebCore 0x0000000192225fa4 WebCore::DOMSelection::getRangeAt(unsigned int) + 420 (DOMSelection.cpp:370) 2 WebCore 0x0000000190d6d624 WebCore::jsDOMSelectionPrototypeFunction_getRangeAt(JSC::JSGlobalObject*, JSC::CallFrame*) + 288 (JSDOMSelection.cpp:406) 3 ??? 0x0000000e324fcb84 0 + 60973632388 <rdar://problem/73611927> 1728370 1 rniwa 2021-02-11 17:02:45 -0800 This is probably a regression from https://trac.webkit.org/changeset/266295/webkit/trunk/Source/WebCore/page/DOMSelection.cpp 1728372 2 420069 rniwa 2021-02-11 17:05:27 -0800 Created attachment 420069 Adds a nullptr check 1728402 3 420069 ap 2021-02-11 18:04:16 -0800 Comment on attachment 420069 Adds a nullptr check View in context: https://bugs.webkit.org/attachment.cgi?id=420069&action=review > Source/WebCore/ChangeLog:3 > + Nullptr crash in DOMSelection::getRangeAt I think that the crash log that I saw showed a break, not nullptr? 1728420 4 rniwa 2021-02-11 19:27:17 -0800 (In reply to Alexey Proskuryakov from comment #3) > Comment on attachment 420069 [details] > Adds a nullptr check > > View in context: > https://bugs.webkit.org/attachment.cgi?id=420069&action=review > > > Source/WebCore/ChangeLog:3 > > + Nullptr crash in DOMSelection::getRangeAt > > I think that the crash log that I saw showed a break, not nullptr? Ugh... typo. It's nullopt* crash, not nullptr. 1728423 5 420081 rniwa 2021-02-11 19:36:30 -0800 Created attachment 420081 Patch 1728492 6 420081 rniwa 2021-02-12 01:38:20 -0800 Comment on attachment 420081 Patch Clearing flags on attachment: 420081 Committed r272777: <https://trac.webkit.org/changeset/272777> 1728493 7 rniwa 2021-02-12 01:38:22 -0800 All reviewed patches have been landed. Closing bug. 1728494 8 webkit-bug-importer 2021-02-12 01:39:13 -0800 <rdar://problem/74268861> 1729497 9 rniwa 2021-02-15 17:57:43 -0800 Now I know the root cause of this bug. Fixing it in https://bugs.webkit.org/show_bug.cgi?id=221942 with a test. 420069 2021-02-11 17:05:27 -0800 2021-02-11 19:36:29 -0800 Adds a nullptr check bug-221786-20210211170526.patch text/plain 1740 rniwa U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyNTY1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTYxM2RlZmY0MmZhNjE0 OGZjN2VlNWE1NmMzOTFjOWQ5M2Y1MTMzNS4uZTIxOGE4ZDI1OTYyZjY1NGM1MWQ0Y2ZmOTMyNWE2 Y2ZmYTQ5MmM4MSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIxLTAyLTExICBSeW9z dWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2ggaW4g RE9NU2VsZWN0aW9uOjpnZXRSYW5nZUF0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0yMjE3ODYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBObyBuZXcgdGVzdHMgc2luY2Ugd2UgZG9uJ3QgaGF2ZSBhbnkgd2F5 IHRvIHJlcHJvZHVjZSB0aGlzIGNyYXNoLgorCisgICAgICAgICogcGFnZS9ET01TZWxlY3Rpb24u Y3BwOgorICAgICAgICAoV2ViQ29yZTo6RE9NU2VsZWN0aW9uOjpnZXRSYW5nZUF0KTogQWRkZWQg YSBudWxscHRyIGNoZWNrIHdpdGggYW4gYXNzZXJ0aW9uLgorCiAyMDIxLTAyLTA4ICBEb24gT2xt c3RlYWQgIDxkb24ub2xtc3RlYWRAc29ueS5jb20+CiAKICAgICAgICAgW0NNYWtlXSBDbGVhbnVw IEVOQUJMRV9FTkNSWVBURURfTUVESUEgYnVpbGQKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3Jl L3BhZ2UvRE9NU2VsZWN0aW9uLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRE9NU2VsZWN0aW9u LmNwcAppbmRleCAwZGY3ZDliNjEwNzc3YzY0ZGRhNzVhYTAyNjJmNzQ5MmJhMDBhOTIxLi40MTE2 MWM5ZjJjYzA2NDcyZDY0N2IzMjg4OTA5OGE3OWFlZmUxZTQ1IDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViQ29yZS9wYWdlL0RPTVNlbGVjdGlvbi5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcGFnZS9E T01TZWxlY3Rpb24uY3BwCkBAIC0zNjcsNyArMzY3LDExIEBAIEV4Y2VwdGlvbk9yPFJlZjxSYW5n ZT4+IERPTVNlbGVjdGlvbjo6Z2V0UmFuZ2VBdCh1bnNpZ25lZCBpbmRleCkKICAgICAgICAgcmV0 dXJuIGZyYW1lLT5zZWxlY3Rpb24oKS5hc3NvY2lhdGVkTGl2ZVJhbmdlKCkucmVsZWFzZU5vbk51 bGwoKTsKICAgICBpZiAoYXV0byBzaGFkb3dBbmNlc3RvciA9IHNlbGVjdGlvblNoYWRvd0FuY2Vz dG9yKGZyYW1lKSkKICAgICAgICAgcmV0dXJuIGNyZWF0ZUxpdmVSYW5nZShtYWtlU2ltcGxlUmFu Z2UoKm1ha2VCb3VuZGFyeVBvaW50QmVmb3JlTm9kZSgqc2hhZG93QW5jZXN0b3IpKSk7Ci0gICAg cmV0dXJuIGNyZWF0ZUxpdmVSYW5nZSgqZnJhbWUtPnNlbGVjdGlvbigpLnNlbGVjdGlvbigpLmZp cnN0UmFuZ2UoKSk7CisgICAgYXV0byBzaW1wbGVSYW5nZSA9IGZyYW1lLT5zZWxlY3Rpb24oKS5z ZWxlY3Rpb24oKS5maXJzdFJhbmdlKCk7CisgICAgQVNTRVJUKHNpbXBsZVJhbmdlKTsgLy8gc2Vs ZWN0aW9uIGlzIG9ycGhhbmVkIGJ1dCB0aGlzIHNob3VsZG4ndCBoYXBwZW4uCisgICAgaWYgKCFz aW1wbGVSYW5nZSkKKyAgICAgICAgcmV0dXJuIEV4Y2VwdGlvbiB7IEluZGV4U2l6ZUVycm9yIH07 CisgICAgcmV0dXJuIGNyZWF0ZUxpdmVSYW5nZSgqc2ltcGxlUmFuZ2UpOwogfQogCiB2b2lkIERP TVNlbGVjdGlvbjo6cmVtb3ZlQWxsUmFuZ2VzKCkK 420081 2021-02-11 19:36:30 -0800 2021-02-12 01:38:20 -0800 Patch bug-221786-20210211193630.patch text/plain 1715 rniwa U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyNzYwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggODFkZGJlNzc0NTg4YzNh NjBmMWRiZTgyZDhhZDJmODYyY2U1MTYxMi4uYWRjNzEyY2VkZWYyNDk3NjZlNzhhYmMwNmViYjFl MWY2ZmExNjM4YyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIxLTAyLTExICBSeW9z dWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIE51bGxvcHQgY3Jhc2ggaW4g RE9NU2VsZWN0aW9uOjpnZXRSYW5nZUF0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0yMjE3ODYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBObyBuZXcgdGVzdHMgc2luY2Ugd2UgZG9uJ3QgaGF2ZSBhbnkgd2F5 IHRvIHJlcHJvZHVjZSB0aGlzIGNyYXNoLgorCisgICAgICAgICogcGFnZS9ET01TZWxlY3Rpb24u Y3BwOgorICAgICAgICAoV2ViQ29yZTo6RE9NU2VsZWN0aW9uOjpnZXRSYW5nZUF0KTogQWRkZWQg YSBudWxsb3B0IGNoZWNrIHdpdGggYW4gYXNzZXJ0aW9uLgorCiAyMDIxLTAyLTExICBDaHJpcyBE dW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3IHVzYWdlIG9mIGFkb3B0 TlMoKQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9ET01TZWxlY3Rpb24uY3BwIGIv U291cmNlL1dlYkNvcmUvcGFnZS9ET01TZWxlY3Rpb24uY3BwCmluZGV4IDBkZjdkOWI2MTA3Nzdj NjRkZGE3NWFhMDI2MmY3NDkyYmEwMGE5MjEuLjQxMTYxYzlmMmNjMDY0NzJkNjQ3YjMyODg5MDk4 YTc5YWVmZTFlNDUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRE9NU2VsZWN0aW9u LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL0RPTVNlbGVjdGlvbi5jcHAKQEAgLTM2Nyw3 ICszNjcsMTEgQEAgRXhjZXB0aW9uT3I8UmVmPFJhbmdlPj4gRE9NU2VsZWN0aW9uOjpnZXRSYW5n ZUF0KHVuc2lnbmVkIGluZGV4KQogICAgICAgICByZXR1cm4gZnJhbWUtPnNlbGVjdGlvbigpLmFz c29jaWF0ZWRMaXZlUmFuZ2UoKS5yZWxlYXNlTm9uTnVsbCgpOwogICAgIGlmIChhdXRvIHNoYWRv d0FuY2VzdG9yID0gc2VsZWN0aW9uU2hhZG93QW5jZXN0b3IoZnJhbWUpKQogICAgICAgICByZXR1 cm4gY3JlYXRlTGl2ZVJhbmdlKG1ha2VTaW1wbGVSYW5nZSgqbWFrZUJvdW5kYXJ5UG9pbnRCZWZv cmVOb2RlKCpzaGFkb3dBbmNlc3RvcikpKTsKLSAgICByZXR1cm4gY3JlYXRlTGl2ZVJhbmdlKCpm cmFtZS0+c2VsZWN0aW9uKCkuc2VsZWN0aW9uKCkuZmlyc3RSYW5nZSgpKTsKKyAgICBhdXRvIHNp bXBsZVJhbmdlID0gZnJhbWUtPnNlbGVjdGlvbigpLnNlbGVjdGlvbigpLmZpcnN0UmFuZ2UoKTsK KyAgICBBU1NFUlQoc2ltcGxlUmFuZ2UpOyAvLyBzZWxlY3Rpb24gaXMgb3JwaGFuZWQgYnV0IHRo aXMgc2hvdWxkbid0IGhhcHBlbi4KKyAgICBpZiAoIXNpbXBsZVJhbmdlKQorICAgICAgICByZXR1 cm4gRXhjZXB0aW9uIHsgSW5kZXhTaXplRXJyb3IgfTsKKyAgICByZXR1cm4gY3JlYXRlTGl2ZVJh bmdlKCpzaW1wbGVSYW5nZSk7CiB9CiAKIHZvaWQgRE9NU2VsZWN0aW9uOjpyZW1vdmVBbGxSYW5n ZXMoKQo=