222954 2021-03-08 16:31:23 -0800 Regression(r273875): Potential over-release in WKRemoteObjectCoder's decodeObjCObject() 2021-03-08 19:08:01 -0800 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://developer.apple.com/documentation/objectivec/nsobject/1417074-awakeafterusingcoder InRadar P2 Normal --- 222401 1 cdumez cdumez achristensen darin ggaren kkinnunen luming_yin sam webkit-bug-importer oldest_to_newest 1737365 0 cdumez 2021-03-08 16:31:23 -0800 Potential over-release in WKRemoteObjectCoder's decodeObjCObject(): 1 libobjc.A.dylib 0x000084af objc_release + 31 (/System/Volumes/Data/SWE/macOS/BuildRoots/2288acc43c/Library/Caches/com.apple.xbs/Sources/objc4/objc4-824/runtime/objc-runtime-new.h:1589) > 2 com.apple.WebKit 0x001aee38 decodeObjCObject(WKRemoteObjectDecoder*, objc_class*) + 0 3 com.apple.WebKit 0x001ae243 decodeObject(WKRemoteObjectDecoder*) + 0 4 com.apple.WebKit 0x001ad24a decodeObject(WKRemoteObjectDecoder*, API::Dictionary const*, WTF::HashSet<void const*, WTF::DefaultHash<void const*>, WTF::HashTraits<void const*> > const&) + 0 5 com.apple.WebKit 0x001ad12e -[WKRemoteObjectDecoder decodeObjectOfClasses:forKey:] + 0 6 com.apple.AppKit 0x000a1120 -[NSColor initWithCoder:] + 197 (/System/Volumes/Data/SWE/macOS/BuildRoots/2288acc43c/Library/Caches/com.apple.xbs/Sources/AppKit/AppKit-2022.44.149/AppKit.subproj/NSColor.m:1652) 7 com.apple.WebKit 0x001aedc5 decodeObjCObject(WKRemoteObjectDecoder*, objc_class*) + 0 8 com.apple.WebKit 0x001ae243 decodeObject(WKRemoteObjectDecoder*) + 0 9 com.apple.WebKit 0x001ad24a decodeObject(WKRemoteObjectDecoder*, API::Dictionary const*, WTF::HashSet<void const*, WTF::DefaultHash<void const*>, WTF::HashTraits<void const*> > const&) + 0 10 com.apple.WebKit 0x001ad12e -[WKRemoteObjectDecoder decodeObjectOfClasses:forKey:] + 0 11 com.apple.AppKit 0x002e886a -[NSImage initWithCoder:] + 1768 (/System/Volumes/Data/SWE/macOS/BuildRoots/2288acc43c/Library/Caches/com.apple.xbs/Sources/AppKit/AppKit-2022.44.149/AppKit.subproj/NSImage.m:2013) 12 com.apple.WebKit 0x001aedc5 decodeObjCObject(WKRemoteObjectDecoder*, objc_class*) + 0 13 com.apple.WebKit 0x001ae243 decodeObject(WKRemoteObjectDecoder*) + 0 14 com.apple.WebKit 0x001ad24a decodeObject(WKRemoteObjectDecoder*, API::Dictionary const*, WTF::HashSet<void const*, WTF::DefaultHash<void const*>, WTF::HashTraits<void const*> > const&) + 0 15 com.apple.WebKit 0x001af1a3 decodeInvocationArguments(WKRemoteObjectDecoder*, NSInvocation*, WTF::Vector<WTF::HashSet<void const*, WTF::DefaultHash<void const*>, WTF::HashTraits<void const*> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, unsigned long) + 0 16 com.apple.WebKit 0x001ae828 decodeObject(WKRemoteObjectDecoder*) + 0 17 com.apple.WebKit 0x001ad24a decodeObject(WKRemoteObjectDecoder*, API::Dictionary const*, WTF::HashSet<void const*, WTF::DefaultHash<void const*>, WTF::HashTraits<void const*> > const&) + 0 18 com.apple.WebKit 0x001ad12e -[WKRemoteObjectDecoder decodeObjectOfClasses:forKey:] + 0 19 com.apple.WebKit 0x001b24b9 -[_WKRemoteObjectRegistry _invokeMethod:] + 0 1737366 1 cdumez 2021-03-08 16:31:39 -0800 <rdar://75163359> 1737369 2 422636 cdumez 2021-03-08 16:36:04 -0800 Created attachment 422636 Patch 1737387 3 422636 darin 2021-03-08 17:20:42 -0800 Comment on attachment 422636 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=422636&action=review > Source/WebKit/Shared/API/Cocoa/WKRemoteObjectCoder.mm:314 > if (!result) Isn’t the correct fix: result = adoptNS([result.leakRef() awakeAfterUsingCoder:decoder]) and no other changes? 1737394 4 422636 cdumez 2021-03-08 17:42:04 -0800 Comment on attachment 422636 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=422636&action=review >> Source/WebKit/Shared/API/Cocoa/WKRemoteObjectCoder.mm:314 >> if (!result) > > Isn’t the correct fix: > > result = adoptNS([result.leakRef() awakeAfterUsingCoder:decoder]) > > and no other changes? Yes, it seems like this should work and it is a bit nicer. I'll switch. 1737395 5 422645 cdumez 2021-03-08 17:44:13 -0800 Created attachment 422645 Patch 1737431 6 ews-feeder 2021-03-08 19:07:57 -0800 Committed r274129: <https://commits.webkit.org/r274129> All reviewed patches have been landed. Closing bug and clearing flags on attachment 422645. 422636 2021-03-08 16:36:04 -0800 2021-03-08 17:44:09 -0800 Patch bug-222954-20210308163603.patch text/plain 2788 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0MTA4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGZmYmEyNjI5NTgzZGI1NDlh OGQ0OTE5MTUwNjkyMjY1ZTRmOTViNmYuLjUyYzMzY2M2MTg3ZDZmMzFjNWJjYjJlMzM0NTc5ZDFk NTA1MjhhNGIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjIgQEAKKzIwMjEtMDMtMDggIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBSZWdyZXNzaW9uKHIyNzM4NzUpOiBQ b3RlbnRpYWwgb3Zlci1yZWxlYXNlIGluIFdLUmVtb3RlT2JqZWN0Q29kZXIncyBkZWNvZGVPYmpD T2JqZWN0KCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTIyMjk1NAorICAgICAgICA8cmRhcjovLzc1MTYzMzU5PgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIHIyNzM4NzUgYWRkZWQgYW4gYWRvcHROUygpIGZv ciB0aGUgcmVzdWx0IG9mIGBbYWxsb2NhdGlvbiBpbml0V2l0aENvZGVyOmRlY29kZXJdYC4gVGhp cyB3b3VsZCBiZQorICAgICAgICBmaW5lIGluIGdlbmVyYWwsIGV4Y2VwdCB0aGF0IHdlIGNhbGwg YXdha2VBZnRlclVzaW5nQ29kZXIgb24gdGhlIHJlc3VsdCByaWdodCBhZnRlci4gQXMgcGVyIHRo ZQorICAgICAgICBhd2FrZUFmdGVyVXNpbmdDb2RlciBkb2N1bWVudGF0aW9uIFsxXSwgaXQgbWF5 IHJldHVybiB0aGUgcmVjZWl2ZXIgb3IgYSBuZXcgb2JqZWN0LiBXaGVuIGl0CisgICAgICAgIHJl dHVybnMgYSBuZXcgb2JqZWN0LCBpdCB0YWtlcyBjYXJlIG9mIHJlbGVhc2luZyB0aGUgcmVjZWl2 ZXIuIFRoaXMgaXMgYW4gaXNzdWUgZm9yIHVzIGhlcmUgc2luY2UKKyAgICAgICAgd2Ugd2VyZSBo b2xkaW5nIHRoZSByZWNlaXZlciBpbiBhIHNtYXJ0IHBvaW50ZXIuCisKKyAgICAgICAgWzFdIGh0 dHBzOi8vZGV2ZWxvcGVyLmFwcGxlLmNvbS9kb2N1bWVudGF0aW9uL29iamVjdGl2ZWMvbnNvYmpl Y3QvMTQxNzA3NC1hd2FrZWFmdGVydXNpbmdjb2RlcgorCisgICAgICAgICogU2hhcmVkL0FQSS9D b2NvYS9XS1JlbW90ZU9iamVjdENvZGVyLm1tOgorICAgICAgICAoZGVjb2RlT2JqQ09iamVjdCk6 CisKIDIwMjEtMDMtMDggIENocmlzIER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAg ICBbSVBDIEhhcmRlbmluZ10gUHJvdGVjdCBhZ2FpbnN0IGJhZCBpbnB1dCBpbiBXZWJQcm9jZXNz UHJveHk6OmNyZWF0ZVNwZWVjaFJlY29nbml0aW9uU2VydmVyKCkgYW5kIE1lc3NhZ2VSZWNlaXZl ck1hcApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9TaGFyZWQvQVBJL0NvY29hL1dLUmVtb3Rl T2JqZWN0Q29kZXIubW0gYi9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9BUEkvQ29jb2EvV0tSZW1vdGVP YmplY3RDb2Rlci5tbQppbmRleCA4OGFkODM4MjdhZDllNjEyNjZhMGIzZWVjZWJlYzg3NDkzN2Zh YmM2Li4yZjg0YzhkODE4NTMxZTllZThjZmY3ODRmODQ4YjYzMDRhMTllOTQxIDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9BUEkvQ29jb2EvV0tSZW1vdGVPYmplY3RDb2Rlci5tbQor KysgYi9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9BUEkvQ29jb2EvV0tSZW1vdGVPYmplY3RDb2Rlci5t bQpAQCAtMzA2LDcgKzMwNiw3IEBAIHN0YXRpYyBSZXRhaW5QdHI8aWQ+IGRlY29kZU9iakNPYmpl Y3QoV0tSZW1vdGVPYmplY3REZWNvZGVyICpkZWNvZGVyLCBDbGFzcyBvYmplCiAgICAgaWYgKCFh bGxvY2F0aW9uKQogICAgICAgICBbTlNFeGNlcHRpb24gcmFpc2U6TlNJbnZhbGlkVW5hcmNoaXZl T3BlcmF0aW9uRXhjZXB0aW9uIGZvcm1hdDpAIkNsYXNzIFwiJUBcIiByZXR1cm5lZCBuaWwgZnJv bSArYWxsb2Mgd2hpbGUgYmVpbmcgZGVjb2RlZCIsIE5TU3RyaW5nRnJvbUNsYXNzKG9iamVjdENs YXNzKV07CiAKLSAgICBSZXRhaW5QdHI8aWQ+IHJlc3VsdCA9IGFkb3B0TlMoW2FsbG9jYXRpb24g aW5pdFdpdGhDb2RlcjpkZWNvZGVyXSk7CisgICAgaWQgcmVzdWx0ID0gW2FsbG9jYXRpb24gaW5p dFdpdGhDb2RlcjpkZWNvZGVyXTsKICAgICBpZiAoIXJlc3VsdCkKICAgICAgICAgW05TRXhjZXB0 aW9uIHJhaXNlOk5TSW52YWxpZFVuYXJjaGl2ZU9wZXJhdGlvbkV4Y2VwdGlvbiBmb3JtYXQ6QCJP YmplY3Qgb2YgY2xhc3MgXCIlQFwiIHJldHVybmVkIG5pbCBmcm9tIC1pbml0V2l0aENvZGVyOiB3 aGlsZSBiZWluZyBkZWNvZGVkIiwgTlNTdHJpbmdGcm9tQ2xhc3Mob2JqZWN0Q2xhc3MpXTsKIApA QCAtMzE0LDcgKzMxNCw3IEBAIHN0YXRpYyBSZXRhaW5QdHI8aWQ+IGRlY29kZU9iakNPYmplY3Qo V0tSZW1vdGVPYmplY3REZWNvZGVyICpkZWNvZGVyLCBDbGFzcyBvYmplCiAgICAgaWYgKCFyZXN1 bHQpCiAgICAgICAgIFtOU0V4Y2VwdGlvbiByYWlzZTpOU0ludmFsaWRVbmFyY2hpdmVPcGVyYXRp b25FeGNlcHRpb24gZm9ybWF0OkAiT2JqZWN0IG9mIGNsYXNzIFwiJUBcIiByZXR1cm5lZCBuaWwg ZnJvbSAtYXdha2VBZnRlclVzaW5nQ29kZXI6IHdoaWxlIGJlaW5nIGRlY29kZWQiLCBOU1N0cmlu Z0Zyb21DbGFzcyhvYmplY3RDbGFzcyldOwogCi0gICAgcmV0dXJuIHJlc3VsdDsKKyAgICByZXR1 cm4gYWRvcHROUyhyZXN1bHQpOwogfQogCiBzdGF0aWMgY29uc3RleHByIE5TU3RyaW5nICpwZWVy Q2VydGlmaWNhdGVLZXkgPSBAIk5TRXJyb3JQZWVyQ2VydGlmaWNhdGVDaGFpbktleSI7Cg== 422645 2021-03-08 17:44:13 -0800 2021-03-08 19:07:59 -0800 Patch bug-222954-20210308174412.patch text/plain 2357 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0MTA4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGZmYmEyNjI5NTgzZGI1NDlh OGQ0OTE5MTUwNjkyMjY1ZTRmOTViNmYuLjUyYzMzY2M2MTg3ZDZmMzFjNWJjYjJlMzM0NTc5ZDFk NTA1MjhhNGIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjIgQEAKKzIwMjEtMDMtMDggIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBSZWdyZXNzaW9uKHIyNzM4NzUpOiBQ b3RlbnRpYWwgb3Zlci1yZWxlYXNlIGluIFdLUmVtb3RlT2JqZWN0Q29kZXIncyBkZWNvZGVPYmpD T2JqZWN0KCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTIyMjk1NAorICAgICAgICA8cmRhcjovLzc1MTYzMzU5PgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIHIyNzM4NzUgYWRkZWQgYW4gYWRvcHROUygpIGZv ciB0aGUgcmVzdWx0IG9mIGBbYWxsb2NhdGlvbiBpbml0V2l0aENvZGVyOmRlY29kZXJdYC4gVGhp cyB3b3VsZCBiZQorICAgICAgICBmaW5lIGluIGdlbmVyYWwsIGV4Y2VwdCB0aGF0IHdlIGNhbGwg YXdha2VBZnRlclVzaW5nQ29kZXIgb24gdGhlIHJlc3VsdCByaWdodCBhZnRlci4gQXMgcGVyIHRo ZQorICAgICAgICBhd2FrZUFmdGVyVXNpbmdDb2RlciBkb2N1bWVudGF0aW9uIFsxXSwgaXQgbWF5 IHJldHVybiB0aGUgcmVjZWl2ZXIgb3IgYSBuZXcgb2JqZWN0LiBXaGVuIGl0CisgICAgICAgIHJl dHVybnMgYSBuZXcgb2JqZWN0LCBpdCB0YWtlcyBjYXJlIG9mIHJlbGVhc2luZyB0aGUgcmVjZWl2 ZXIuIFRoaXMgaXMgYW4gaXNzdWUgZm9yIHVzIGhlcmUgc2luY2UKKyAgICAgICAgd2Ugd2VyZSBo b2xkaW5nIHRoZSByZWNlaXZlciBpbiBhIHNtYXJ0IHBvaW50ZXIuCisKKyAgICAgICAgWzFdIGh0 dHBzOi8vZGV2ZWxvcGVyLmFwcGxlLmNvbS9kb2N1bWVudGF0aW9uL29iamVjdGl2ZWMvbnNvYmpl Y3QvMTQxNzA3NC1hd2FrZWFmdGVydXNpbmdjb2RlcgorCisgICAgICAgICogU2hhcmVkL0FQSS9D b2NvYS9XS1JlbW90ZU9iamVjdENvZGVyLm1tOgorICAgICAgICAoZGVjb2RlT2JqQ09iamVjdCk6 CisKIDIwMjEtMDMtMDggIENocmlzIER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAg ICBbSVBDIEhhcmRlbmluZ10gUHJvdGVjdCBhZ2FpbnN0IGJhZCBpbnB1dCBpbiBXZWJQcm9jZXNz UHJveHk6OmNyZWF0ZVNwZWVjaFJlY29nbml0aW9uU2VydmVyKCkgYW5kIE1lc3NhZ2VSZWNlaXZl ck1hcApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9TaGFyZWQvQVBJL0NvY29hL1dLUmVtb3Rl T2JqZWN0Q29kZXIubW0gYi9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9BUEkvQ29jb2EvV0tSZW1vdGVP YmplY3RDb2Rlci5tbQppbmRleCA4OGFkODM4MjdhZDllNjEyNjZhMGIzZWVjZWJlYzg3NDkzN2Zh YmM2Li5lMThjNjQ1ZWUwM2Y4ZWE5ZmVmYmQ0NWY3NWVkODhjNDE1MGQ4YWI4IDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9BUEkvQ29jb2EvV0tSZW1vdGVPYmplY3RDb2Rlci5tbQor KysgYi9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9BUEkvQ29jb2EvV0tSZW1vdGVPYmplY3RDb2Rlci5t bQpAQCAtMzEwLDcgKzMxMCw3IEBAIHN0YXRpYyBSZXRhaW5QdHI8aWQ+IGRlY29kZU9iakNPYmpl Y3QoV0tSZW1vdGVPYmplY3REZWNvZGVyICpkZWNvZGVyLCBDbGFzcyBvYmplCiAgICAgaWYgKCFy ZXN1bHQpCiAgICAgICAgIFtOU0V4Y2VwdGlvbiByYWlzZTpOU0ludmFsaWRVbmFyY2hpdmVPcGVy YXRpb25FeGNlcHRpb24gZm9ybWF0OkAiT2JqZWN0IG9mIGNsYXNzIFwiJUBcIiByZXR1cm5lZCBu aWwgZnJvbSAtaW5pdFdpdGhDb2Rlcjogd2hpbGUgYmVpbmcgZGVjb2RlZCIsIE5TU3RyaW5nRnJv bUNsYXNzKG9iamVjdENsYXNzKV07CiAKLSAgICByZXN1bHQgPSBbcmVzdWx0IGF3YWtlQWZ0ZXJV c2luZ0NvZGVyOmRlY29kZXJdOworICAgIHJlc3VsdCA9IGFkb3B0TlMoW3Jlc3VsdC5sZWFrUmVm KCkgYXdha2VBZnRlclVzaW5nQ29kZXI6ZGVjb2Rlcl0pOwogICAgIGlmICghcmVzdWx0KQogICAg ICAgICBbTlNFeGNlcHRpb24gcmFpc2U6TlNJbnZhbGlkVW5hcmNoaXZlT3BlcmF0aW9uRXhjZXB0 aW9uIGZvcm1hdDpAIk9iamVjdCBvZiBjbGFzcyBcIiVAXCIgcmV0dXJuZWQgbmlsIGZyb20gLWF3 YWtlQWZ0ZXJVc2luZ0NvZGVyOiB3aGlsZSBiZWluZyBkZWNvZGVkIiwgTlNTdHJpbmdGcm9tQ2xh c3Mob2JqZWN0Q2xhc3MpXTsKIAo=