223719 2021-03-24 16:57:20 -0700 bindings/js/JSEventListener.cpp:281:91: runtime error: reference binding to null pointer of type 'WebCore::ScriptExecutionContext' 2021-03-24 18:49:15 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=176131 InRadar P2 Normal --- 1 cdumez cdumez darin ddkilzer ggaren sam webkit-bug-importer oldest_to_newest 1743603 0 cdumez 2021-03-24 16:57:20 -0700 Fix bug in JSEventListener's eventHandlerAttribute() found by UBSan. 1743606 1 424203 cdumez 2021-03-24 17:04:58 -0700 Created attachment 424203 Patch 1743621 2 424203 darin 2021-03-24 17:36:52 -0700 Comment on attachment 424203 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424203&action=review > Source/WebCore/bindings/js/JSEventListener.cpp:281 > - return eventHandlerAttribute(target.attributeEventListener(eventType, isolatedWorld), *target.scriptExecutionContext()); > + return eventHandlerAttribute(target.attributeEventListener(eventType, isolatedWorld), target.scriptExecutionContext()); Why not just add the null check here? This is the only place where it can be null. auto context = target.scriptExecutionContext(); if (!context) return jsNull(); 1743622 3 cdumez 2021-03-24 17:38:04 -0700 (In reply to Darin Adler from comment #2) > Comment on attachment 424203 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=424203&action=review > > > Source/WebCore/bindings/js/JSEventListener.cpp:281 > > - return eventHandlerAttribute(target.attributeEventListener(eventType, isolatedWorld), *target.scriptExecutionContext()); > > + return eventHandlerAttribute(target.attributeEventListener(eventType, isolatedWorld), target.scriptExecutionContext()); > > Why not just add the null check here? This is the only place where it can be > null. > > auto context = target.scriptExecutionContext(); > if (!context) > return jsNull(); I hesitated. I went the other way because this was the place where we had the other checks and jsNull() returns. That said, it is true that we only need it for this particular call site. I'll make the change. 1743624 4 424208 cdumez 2021-03-24 17:40:36 -0700 Created attachment 424208 Patch 1743636 5 ews-feeder 2021-03-24 18:48:24 -0700 Committed r274996: <https://commits.webkit.org/r274996> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424208. 1743637 6 webkit-bug-importer 2021-03-24 18:49:15 -0700 <rdar://problem/75816500> 424203 2021-03-24 17:04:58 -0700 2021-03-24 17:40:34 -0700 Patch bug-223719-20210324170457.patch text/plain 3910 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0OTgzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWI2ZDQwZTBjMTA2NjRm YjgzZDQyOWIwM2E2ODgzNzdjZTM3NjAwYS4uN2NmNzVmYTk3MjgzZTM1NDAyYzg1YzJmYTRlYjVl YTg2Mzc5YzBkYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIxLTAzLTI0ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgYmluZGluZ3MvanMvSlNFdmVu dExpc3RlbmVyLmNwcDoyODE6OTE6IHJ1bnRpbWUgZXJyb3I6IHJlZmVyZW5jZSBiaW5kaW5nIHRv IG51bGwgcG9pbnRlciBvZiB0eXBlICdXZWJDb3JlOjpTY3JpcHRFeGVjdXRpb25Db250ZXh0Jwor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIzNzE5CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTWFrZSBzdXJl IHdlIG51bGwgY2hlY2sgdGhlIHNjcmlwdEV4ZWN1dGlvbkNvbnRleHQgYmVmb3JlIHdlIGRlcmVm ZXJlbmNlIGl0LgorCisgICAgICAgICogYmluZGluZ3MvanMvSlNFdmVudExpc3RlbmVyLmNwcDoK KyAgICAgICAgKFdlYkNvcmU6OmV2ZW50SGFuZGxlckF0dHJpYnV0ZSk6CisgICAgICAgIChXZWJD b3JlOjp3aW5kb3dFdmVudEhhbmRsZXJBdHRyaWJ1dGUpOgorCiAyMDIxLTAzLTI0ICBFcmljIENh cmxzb24gIDxlcmljLmNhcmxzb25AYXBwbGUuY29tPgogCiAgICAgICAgIFtDb2NvYV0gQWRkIEV4 cGVyaW1lbnRhbCBNZWRpYVNlc3Npb24gY29vcmRpbmF0b3IKZGlmZiAtLWdpdCBhL1NvdXJjZS9X ZWJDb3JlL2JpbmRpbmdzL2pzL0pTRXZlbnRMaXN0ZW5lci5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9i aW5kaW5ncy9qcy9KU0V2ZW50TGlzdGVuZXIuY3BwCmluZGV4IDAxZjE1ZjhiODBmOGUxNzE4YmU3 ZDZlMTYwMzBhZWFhMmE1OWE4YWIuLjlmOTRkMWUzYWVmMTI4MGViMTRhNmI2MzI3YTNmNmY3ZGYz YTA3YzMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRXZlbnRMaXN0 ZW5lci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNFdmVudExpc3RlbmVy LmNwcApAQCAtMjU3LDEyICsyNTcsMTIgQEAgU3RyaW5nIEpTRXZlbnRMaXN0ZW5lcjo6ZnVuY3Rp b25OYW1lKCkgY29uc3QKICAgICByZXR1cm4gaGFuZGxlckZ1bmN0aW9uLT5uYW1lKHZtKTsKIH0K IAotc3RhdGljIGlubGluZSBKU0M6OkpTVmFsdWUgZXZlbnRIYW5kbGVyQXR0cmlidXRlKEV2ZW50 TGlzdGVuZXIqIGFic3RyYWN0TGlzdGVuZXIsIFNjcmlwdEV4ZWN1dGlvbkNvbnRleHQmIGNvbnRl eHQpCitzdGF0aWMgaW5saW5lIEpTQzo6SlNWYWx1ZSBldmVudEhhbmRsZXJBdHRyaWJ1dGUoRXZl bnRMaXN0ZW5lciogYWJzdHJhY3RMaXN0ZW5lciwgU2NyaXB0RXhlY3V0aW9uQ29udGV4dCogY29u dGV4dCkKIHsKLSAgICBpZiAoIWlzPEpTRXZlbnRMaXN0ZW5lcj4oYWJzdHJhY3RMaXN0ZW5lcikp CisgICAgaWYgKCFjb250ZXh0IHx8ICFpczxKU0V2ZW50TGlzdGVuZXI+KGFic3RyYWN0TGlzdGVu ZXIpKQogICAgICAgICByZXR1cm4ganNOdWxsKCk7CiAKLSAgICBhdXRvKiBmdW5jdGlvbiA9IGRv d25jYXN0PEpTRXZlbnRMaXN0ZW5lcj4oKmFic3RyYWN0TGlzdGVuZXIpLmVuc3VyZUpTRnVuY3Rp b24oY29udGV4dCk7CisgICAgYXV0byogZnVuY3Rpb24gPSBkb3duY2FzdDxKU0V2ZW50TGlzdGVu ZXI+KCphYnN0cmFjdExpc3RlbmVyKS5lbnN1cmVKU0Z1bmN0aW9uKCpjb250ZXh0KTsKICAgICBp ZiAoIWZ1bmN0aW9uKQogICAgICAgICByZXR1cm4ganNOdWxsKCk7CiAKQEAgLTI3OCw3ICsyNzgs NyBAQCBzdGF0aWMgaW5saW5lIFJlZlB0cjxKU0V2ZW50TGlzdGVuZXI+IGNyZWF0ZUV2ZW50TGlz dGVuZXJGb3JFdmVudEhhbmRsZXJBdHRyaWJ1dAogCiBKU0M6OkpTVmFsdWUgZXZlbnRIYW5kbGVy QXR0cmlidXRlKEV2ZW50VGFyZ2V0JiB0YXJnZXQsIGNvbnN0IEF0b21TdHJpbmcmIGV2ZW50VHlw ZSwgRE9NV3JhcHBlcldvcmxkJiBpc29sYXRlZFdvcmxkKQogewotICAgIHJldHVybiBldmVudEhh bmRsZXJBdHRyaWJ1dGUodGFyZ2V0LmF0dHJpYnV0ZUV2ZW50TGlzdGVuZXIoZXZlbnRUeXBlLCBp c29sYXRlZFdvcmxkKSwgKnRhcmdldC5zY3JpcHRFeGVjdXRpb25Db250ZXh0KCkpOworICAgIHJl dHVybiBldmVudEhhbmRsZXJBdHRyaWJ1dGUodGFyZ2V0LmF0dHJpYnV0ZUV2ZW50TGlzdGVuZXIo ZXZlbnRUeXBlLCBpc29sYXRlZFdvcmxkKSwgdGFyZ2V0LnNjcmlwdEV4ZWN1dGlvbkNvbnRleHQo KSk7CiB9CiAKIHZvaWQgc2V0RXZlbnRIYW5kbGVyQXR0cmlidXRlKEpTQzo6SlNHbG9iYWxPYmpl Y3QmIGxleGljYWxHbG9iYWxPYmplY3QsIEpTQzo6SlNPYmplY3QmIHdyYXBwZXIsIEV2ZW50VGFy Z2V0JiB0YXJnZXQsIGNvbnN0IEF0b21TdHJpbmcmIGV2ZW50VHlwZSwgSlNDOjpKU1ZhbHVlIHZh bHVlKQpAQCAtMjg5LDcgKzI4OSw3IEBAIHZvaWQgc2V0RXZlbnRIYW5kbGVyQXR0cmlidXRlKEpT Qzo6SlNHbG9iYWxPYmplY3QmIGxleGljYWxHbG9iYWxPYmplY3QsIEpTQzo6SlNPCiBKU0M6OkpT VmFsdWUgd2luZG93RXZlbnRIYW5kbGVyQXR0cmlidXRlKEhUTUxFbGVtZW50JiBlbGVtZW50LCBj b25zdCBBdG9tU3RyaW5nJiBldmVudFR5cGUsIERPTVdyYXBwZXJXb3JsZCYgaXNvbGF0ZWRXb3Js ZCkKIHsKICAgICBhdXRvJiBkb2N1bWVudCA9IGVsZW1lbnQuZG9jdW1lbnQoKTsKLSAgICByZXR1 cm4gZXZlbnRIYW5kbGVyQXR0cmlidXRlKGRvY3VtZW50LmdldFdpbmRvd0F0dHJpYnV0ZUV2ZW50 TGlzdGVuZXIoZXZlbnRUeXBlLCBpc29sYXRlZFdvcmxkKSwgZG9jdW1lbnQpOworICAgIHJldHVy biBldmVudEhhbmRsZXJBdHRyaWJ1dGUoZG9jdW1lbnQuZ2V0V2luZG93QXR0cmlidXRlRXZlbnRM aXN0ZW5lcihldmVudFR5cGUsIGlzb2xhdGVkV29ybGQpLCAmZG9jdW1lbnQpOwogfQogCiB2b2lk IHNldFdpbmRvd0V2ZW50SGFuZGxlckF0dHJpYnV0ZShKU0M6OkpTR2xvYmFsT2JqZWN0JiBsZXhp Y2FsR2xvYmFsT2JqZWN0LCBKU0M6OkpTT2JqZWN0JiB3cmFwcGVyLCBIVE1MRWxlbWVudCYgZWxl bWVudCwgY29uc3QgQXRvbVN0cmluZyYgZXZlbnRUeXBlLCBKU0M6OkpTVmFsdWUgdmFsdWUpCkBA IC0zMTEsNyArMzExLDcgQEAgdm9pZCBzZXRXaW5kb3dFdmVudEhhbmRsZXJBdHRyaWJ1dGUoSlND OjpKU0dsb2JhbE9iamVjdCYgbGV4aWNhbEdsb2JhbE9iamVjdCwgSlMKIEpTQzo6SlNWYWx1ZSBk b2N1bWVudEV2ZW50SGFuZGxlckF0dHJpYnV0ZShIVE1MRWxlbWVudCYgZWxlbWVudCwgY29uc3Qg QXRvbVN0cmluZyYgZXZlbnRUeXBlLCBET01XcmFwcGVyV29ybGQmIGlzb2xhdGVkV29ybGQpCiB7 CiAgICAgYXV0byYgZG9jdW1lbnQgPSBlbGVtZW50LmRvY3VtZW50KCk7Ci0gICAgcmV0dXJuIGV2 ZW50SGFuZGxlckF0dHJpYnV0ZShkb2N1bWVudC5hdHRyaWJ1dGVFdmVudExpc3RlbmVyKGV2ZW50 VHlwZSwgaXNvbGF0ZWRXb3JsZCksIGRvY3VtZW50KTsKKyAgICByZXR1cm4gZXZlbnRIYW5kbGVy QXR0cmlidXRlKGRvY3VtZW50LmF0dHJpYnV0ZUV2ZW50TGlzdGVuZXIoZXZlbnRUeXBlLCBpc29s YXRlZFdvcmxkKSwgJmRvY3VtZW50KTsKIH0KIAogdm9pZCBzZXREb2N1bWVudEV2ZW50SGFuZGxl ckF0dHJpYnV0ZShKU0M6OkpTR2xvYmFsT2JqZWN0JiBsZXhpY2FsR2xvYmFsT2JqZWN0LCBKU0M6 OkpTT2JqZWN0JiB3cmFwcGVyLCBIVE1MRWxlbWVudCYgZWxlbWVudCwgY29uc3QgQXRvbVN0cmlu ZyYgZXZlbnRUeXBlLCBKU0M6OkpTVmFsdWUgdmFsdWUpCg== 424208 2021-03-24 17:40:36 -0700 2021-03-24 18:48:25 -0700 Patch bug-223719-20210324174035.patch text/plain 1902 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0OTg4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzQ1MmI5OTdlMDAyNjNh ZGI5MGY3MDQ3MmNkZTdlZTU0NDc2ZDVmOC4uMGZiZjgwMzZjMWRjOTJlYWMxODc4ZjgzODRkN2E3 Yjk3NzMzNGFkNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIxLTAzLTI0ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgYmluZGluZ3MvanMvSlNFdmVu dExpc3RlbmVyLmNwcDoyODE6OTE6IHJ1bnRpbWUgZXJyb3I6IHJlZmVyZW5jZSBiaW5kaW5nIHRv IG51bGwgcG9pbnRlciBvZiB0eXBlICdXZWJDb3JlOjpTY3JpcHRFeGVjdXRpb25Db250ZXh0Jwor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIzNzE5CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIuCisKKyAgICAgICAgTWFrZSBzdXJlIHdl IG51bGwgY2hlY2sgdGhlIHNjcmlwdEV4ZWN1dGlvbkNvbnRleHQgYmVmb3JlIHdlIGRlcmVmZXJl bmNlIGl0LgorCisgICAgICAgICogYmluZGluZ3MvanMvSlNFdmVudExpc3RlbmVyLmNwcDoKKyAg ICAgICAgKFdlYkNvcmU6OmV2ZW50SGFuZGxlckF0dHJpYnV0ZSk6CisgICAgICAgIChXZWJDb3Jl Ojp3aW5kb3dFdmVudEhhbmRsZXJBdHRyaWJ1dGUpOgorCiAyMDIxLTAzLTI0ICBDaHJpcyBEdW1l eiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAgVW5yZXZpZXdlZCBidWlsZCBmaXggYWZ0 ZXIgcjI3NDk4My4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRXZl bnRMaXN0ZW5lci5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0V2ZW50TGlzdGVu ZXIuY3BwCmluZGV4IDAxZjE1ZjhiODBmOGUxNzE4YmU3ZDZlMTYwMzBhZWFhMmE1OWE4YWIuLmMw OGY1ZjFkMjQyZWU0MWE0NTI3N2M0NmM4MmUwZDRkOTA3ZDI0MWMgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRXZlbnRMaXN0ZW5lci5jcHAKKysrIGIvU291cmNlL1dl YkNvcmUvYmluZGluZ3MvanMvSlNFdmVudExpc3RlbmVyLmNwcApAQCAtMjc4LDcgKzI3OCwxMCBA QCBzdGF0aWMgaW5saW5lIFJlZlB0cjxKU0V2ZW50TGlzdGVuZXI+IGNyZWF0ZUV2ZW50TGlzdGVu ZXJGb3JFdmVudEhhbmRsZXJBdHRyaWJ1dAogCiBKU0M6OkpTVmFsdWUgZXZlbnRIYW5kbGVyQXR0 cmlidXRlKEV2ZW50VGFyZ2V0JiB0YXJnZXQsIGNvbnN0IEF0b21TdHJpbmcmIGV2ZW50VHlwZSwg RE9NV3JhcHBlcldvcmxkJiBpc29sYXRlZFdvcmxkKQogewotICAgIHJldHVybiBldmVudEhhbmRs ZXJBdHRyaWJ1dGUodGFyZ2V0LmF0dHJpYnV0ZUV2ZW50TGlzdGVuZXIoZXZlbnRUeXBlLCBpc29s YXRlZFdvcmxkKSwgKnRhcmdldC5zY3JpcHRFeGVjdXRpb25Db250ZXh0KCkpOworICAgIGF1dG8q IGNvbnRleHQgPSB0YXJnZXQuc2NyaXB0RXhlY3V0aW9uQ29udGV4dCgpOworICAgIGlmICghY29u dGV4dCkKKyAgICAgICAgcmV0dXJuIGpzTnVsbCgpOworICAgIHJldHVybiBldmVudEhhbmRsZXJB dHRyaWJ1dGUodGFyZ2V0LmF0dHJpYnV0ZUV2ZW50TGlzdGVuZXIoZXZlbnRUeXBlLCBpc29sYXRl ZFdvcmxkKSwgKmNvbnRleHQpOwogfQogCiB2b2lkIHNldEV2ZW50SGFuZGxlckF0dHJpYnV0ZShK U0M6OkpTR2xvYmFsT2JqZWN0JiBsZXhpY2FsR2xvYmFsT2JqZWN0LCBKU0M6OkpTT2JqZWN0JiB3 cmFwcGVyLCBFdmVudFRhcmdldCYgdGFyZ2V0LCBjb25zdCBBdG9tU3RyaW5nJiBldmVudFR5cGUs IEpTQzo6SlNWYWx1ZSB2YWx1ZSkK