223642 2021-03-23 09:43:02 -0700 [UBSan] dom/Document.cpp:2722:23: runtime error: reference binding to null pointer of type 'JSC::CallFrame' 2021-03-23 13:31:13 -0700 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=176131 InRadar P2 Normal --- 1 cdumez cdumez darin esprehn+autocc ews-watchlist ggaren kangil.han mkwst sam webkit-bug-importer oldest_to_newest 1742856 0 cdumez 2021-03-23 09:43:02 -0700 Document.cpp:2722:23: runtime error: reference binding to null pointer of type 'JSC::CallFrame'. 1742862 1 424029 cdumez 2021-03-23 09:46:49 -0700 Created attachment 424029 Patch 1742971 2 424029 darin 2021-03-23 13:10:37 -0700 Comment on attachment 424029 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424029&action=review > Source/WebCore/dom/Document.cpp:2723 > + auto* callFrame = vm.topCallFrame; > + return callFrame && callFrame != JSC::CallFrame::noCaller() && !currentWorld(*callFrame->lexicalGlobalObject(vm)).isNormal(); Would be nice to fix other places where we dereference vm.topCallFrame without checking it for nullptr; I found some others. 1742975 3 ews-feeder 2021-03-23 13:30:20 -0700 Committed r274895: <https://commits.webkit.org/r274895> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424029. 1742976 4 webkit-bug-importer 2021-03-23 13:31:13 -0700 <rdar://problem/75752414> 424029 2021-03-23 09:46:49 -0700 2021-03-23 13:30:22 -0700 Patch bug-223642-20210323094648.patch text/plain 1779 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0ODcxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNWQxNWRlNDQwZDVhMWVh NjI2ZTE0OWI5NDQ4MTZjNGY0ZWM2MmM4NC4uNGUwNWMyMDFlYzYxZDdkODc3NzBiYWY0ZDQyNTQ1 NzBlNDdiNzNhNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIxLTAzLTIzICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgW1VCU2FuXSBkb20vRG9jdW1l bnQuY3BwOjI3MjI6MjM6IHJ1bnRpbWUgZXJyb3I6IHJlZmVyZW5jZSBiaW5kaW5nIHRvIG51bGwg cG9pbnRlciBvZiB0eXBlICdKU0M6OkNhbGxGcmFtZScKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMzY0MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgIFVzZSBhIHJhdyBwb2ludGVyIGluc3RlYWQgb2YgYSBy ZWZlcmVuY2UgZm9yIHRoZSBKU0M6OkNhbGxGcmFtZSBhbmQgbnVsbCBjaGVjayBpdCB0byBtYWtl IHN1cmUKKyAgICAgICAgdGhlIGNvZGUgaXMgc2FmZSBhbmQgaXRzIGJlaGF2aW9yIGlzIGRlZmlu ZWQuCisKKyAgICAgICAgKiBkb20vRG9jdW1lbnQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RG9j dW1lbnQ6OnNob3VsZEJ5cGFzc01haW5Xb3JsZENvbnRlbnRTZWN1cml0eVBvbGljeSBjb25zdCk6 CisKIDIwMjEtMDMtMjMgIENocmlzIER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAg ICBFeHRlbmQgV2ViQXVkaW8gaGVhcCBhbGxvY2F0aW9uIGFzc2VydGlvbnMgdG8gY292ZXIgdGhl IHByZS1yZW5kZXJpbmcgcGhyYXNlCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9kb20vRG9j dW1lbnQuY3BwIGIvU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNwcAppbmRleCA4OGNkNTIx ZTdjZmUwNmJhODI1YWZjZjg5NDQ3NjRjMmQ3Yzk4YTBhLi41MzQxMzBlZTYyNmI1NmRmMzg3ZTA1 NTQxNjQ2NzU5NzFmYTllYzU0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vRG9jdW1l bnQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5jcHAKQEAgLTI3MTksOCAr MjcxOSw4IEBAIGJvb2wgRG9jdW1lbnQ6OnNob3VsZEJ5cGFzc01haW5Xb3JsZENvbnRlbnRTZWN1 cml0eVBvbGljeSgpIGNvbnN0CiB7CiAgICAgLy8gQnlwYXNzIHRoaXMgcG9saWN5IHdoZW4gdGhl IHdvcmxkIGlzIGtub3duLCBhbmQgaXQgbm90IHRoZSBub3JtYWwgd29ybGQuCiAgICAgSlNDOjpW TSYgdm0gPSBjb21tb25WTSgpOwotICAgIGF1dG8mIGNhbGxGcmFtZSA9ICp2bS50b3BDYWxsRnJh bWU7Ci0gICAgcmV0dXJuICZjYWxsRnJhbWUgIT0gSlNDOjpDYWxsRnJhbWU6Om5vQ2FsbGVyKCkg JiYgIWN1cnJlbnRXb3JsZCgqY2FsbEZyYW1lLmxleGljYWxHbG9iYWxPYmplY3Qodm0pKS5pc05v cm1hbCgpOworICAgIGF1dG8qIGNhbGxGcmFtZSA9IHZtLnRvcENhbGxGcmFtZTsKKyAgICByZXR1 cm4gY2FsbEZyYW1lICYmIGNhbGxGcmFtZSAhPSBKU0M6OkNhbGxGcmFtZTo6bm9DYWxsZXIoKSAm JiAhY3VycmVudFdvcmxkKCpjYWxsRnJhbWUtPmxleGljYWxHbG9iYWxPYmplY3Qodm0pKS5pc05v cm1hbCgpOwogfQogCiB2b2lkIERvY3VtZW50OjpwbGF0Zm9ybVN1c3BlbmRPclN0b3BBY3RpdmVE T01PYmplY3RzKCkK