228982 2021-08-10 20:27:14 -0700 WTFCrash in JSC::Lexer<char16_t>::append8 2021-08-11 00:40:57 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cathiechen ysuzuki ews-watchlist keith_miller mark.lam msaboff saam simon.fraser tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1783386 0 cathiechen 2021-08-10 20:27:14 -0700 Open https://www.drupal.org/project/eu_cookie_compliance/issues/3195373 in Debug build. Crash info: ASSERTION FAILED: isLatin1(c) ./parser/Lexer.cpp(873) : void JSC::Lexer<char16_t>::append8(const T *, size_t) [T = char16_t] 1 0x7d55a70b9 WTFCrash 2 0x7d6fa779b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x7d6dfd096 JSC::Lexer<char16_t>::append8(char16_t const*, unsigned long) 4 0x7d6dfe122 JSC::Lexer<char16_t>::parseCommentDirectiveValue() 5 0x7d6dfae4c JSC::Lexer<char16_t>::parseCommentDirective() 6 0x7d6df7bea JSC::Lexer<char16_t>::lexWithoutClearingLineTerminator(JSC::JSToken*, WTF::OptionSet<JSC::LexerFlags>, bool) 7 0x7d6df5500 JSC::Lexer<char16_t>::lex(JSC::JSToken*, WTF::OptionSet<JSC::LexerFlags>, bool) 8 0x7d6e196c8 JSC::Parser<JSC::Lexer<char16_t> >::next(WTF::OptionSet<JSC::LexerFlags>) 9 0x7d6e193a8 JSC::Parser<JSC::Lexer<char16_t> >::Parser(JSC::VM&, JSC::SourceCode const&, JSC::JSParserBuiltinMode, JSC::JSParserStrictMode, JSC::JSParserScriptMode, JSC::SourceParseMode, JSC::SuperBinding, JSC::ConstructorKind, JSC::DerivedContextType, bool, JSC::EvalContextType, JSC::DebuggerParseData*, bool) 10 0x7d6e197ef JSC::Parser<JSC::Lexer<char16_t> >::Parser(JSC::VM&, JSC::SourceCode const&, JSC::JSParserBuiltinMode, JSC::JSParserStrictMode, JSC::JSParserScriptMode, JSC::SourceParseMode, JSC::SuperBinding, JSC::ConstructorKind, JSC::DerivedContextType, bool, JSC::EvalContextType, JSC::DebuggerParseData*, bool) 11 0x7d5db9a44 std::__1::unique_ptr<JSC::ProgramNode, std::__1::default_delete<JSC::ProgramNode> > JSC::parse<JSC::ProgramNode>(JSC::VM&, JSC::SourceCode const&, JSC::Identifier const&, JSC::JSParserBuiltinMode, JSC::JSParserStrictMode, JSC::JSParserScriptMode, JSC::SourceParseMode, JSC::SuperBinding, JSC::ParserError&, JSC::JSTextPosition*, JSC::ConstructorKind, JSC::DerivedContextType, JSC::EvalContextType, JSC::DebuggerParseData*, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl, WTF::PackedPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> >, JSC::PrivateNameEntry, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl, WTF::RawPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> > >, JSC::PrivateNameEntryHashTraits, WTF::HashTableTraits> const*, WTF::FixedVector<JSC::JSTextPosition> const*, bool) 12 0x7d706c72e JSC::UnlinkedProgramCodeBlock* JSC::generateUnlinkedCodeBlockImpl<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::VM&, JSC::SourceCode const&, JSC::JSParserStrictMode, JSC::JSParserScriptMode, WTF::OptionSet<JSC::CodeGenerationMode>, JSC::ParserError&, JSC::EvalContextType, JSC::DerivedContextType, bool, WTF::HashSet<WTF::RefPtr<WTF::UniquedStringImpl, WTF::RawPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> >, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl, WTF::RawPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> > >, WTF::HashTableTraits> const*, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl, WTF::PackedPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> >, JSC::PrivateNameEntry, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl, WTF::RawPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> > >, JSC::PrivateNameEntryHashTraits, WTF::HashTableTraits> const*, JSC::ProgramExecutable*) 13 0x7d706be11 JSC::UnlinkedProgramCodeBlock* JSC::generateUnlinkedCodeBlock<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictMode, JSC::JSParserScriptMode, WTF::OptionSet<JSC::CodeGenerationMode>, JSC::ParserError&, JSC::EvalContextType, WTF::HashSet<WTF::RefPtr<WTF::UniquedStringImpl, WTF::RawPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> >, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl, WTF::RawPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> > >, WTF::HashTableTraits> const*, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl, WTF::PackedPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> >, JSC::PrivateNameEntry, JSC::IdentifierRepHash, WTF::HashTraits<WTF::RefPtr<WTF::UniquedStringImpl, WTF::RawPtrTraits<WTF::UniquedStringImpl>, WTF::DefaultRefDerefTraits<WTF::UniquedStringImpl> > >, JSC::PrivateNameEntryHashTraits, WTF::HashTableTraits> const*) 14 0x7d7015ce9 JSC::UnlinkedProgramCodeBlock* JSC::CodeCache::getUnlinkedGlobalCodeBlock<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictMode, JSC::JSParserScriptMode, WTF::OptionSet<JSC::CodeGenerationMode>, JSC::ParserError&, JSC::EvalContextType) 15 0x7d7015869 JSC::CodeCache::getUnlinkedProgramCodeBlock(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictMode, WTF::OptionSet<JSC::CodeGenerationMode>, JSC::ParserError&) 16 0x7d73dc8bf JSC::ProgramExecutable::initializeGlobalProperties(JSC::VM&, JSC::JSGlobalObject*, JSC::JSScope*) 17 0x7d6c0efba JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 18 0x7d7088a07 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 19 0x7d7088b5a JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 20 0x7b5d631fc WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 21 0x7b5d62dde WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) 22 0x7b5d62c09 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) 23 0x7b5d634e5 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) 24 0x7b65c122a WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) 25 0x7b65bf3db WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) 26 0x7b65be93e WebCore::ScriptElement::didFinishInsertingNode() 27 0x7b6a1206e WebCore::HTMLScriptElement::didFinishInsertingNode() 28 0x7b6334a40 void WebCore::executeNodeInsertionWithScriptAssertion<WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&)::$_4>(WebCore::ContainerNode&, WebCore::Node&, WebCore::ContainerNode::ChildChange::Source, WebCore::ReplacedAllChildren, WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&)::$_4) 29 0x7b63317d5 WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&) 30 0x7b63346eb WebCore::ContainerNode::appendChild(WebCore::Node&) 31 0x7b6549c9c WebCore::Node::appendChild(WebCore::Node&) 2021-08-11 11:20:57.622 MiniBrowser[14413:3527807] WebContent process crashed; reloading 1783394 1 435323 ysuzuki 2021-08-10 22:19:41 -0700 Created attachment 435323 Patch 1783403 2 435323 mark.lam 2021-08-10 23:40:59 -0700 Comment on attachment 435323 Patch r=me 1783408 3 435323 ysuzuki 2021-08-11 00:00:10 -0700 Comment on attachment 435323 Patch Thanks! 1783414 4 ews-feeder 2021-08-11 00:39:36 -0700 Committed r280886 (240423@main): <https://commits.webkit.org/240423@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 435323. 1783415 5 webkit-bug-importer 2021-08-11 00:40:57 -0700 <rdar://problem/81781139> 435323 2021-08-10 22:19:41 -0700 2021-08-11 00:39:37 -0700 Patch bug-228982-20210810221940.patch text/plain 3445 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjgwODgyCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA3 MzEzY2E0MjNlOWRhNmE4MmJlNGE1YzA3ZTYwMjc1ZTU4ZmI5N2M3Li4zNzllNWQ5YzkzMGQwMTNj OWI4NDliYWY0MjI1MWRhODU3OWQ3ZjhjIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNSBAQAorMjAyMS0wOC0xMCAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29t PgorCisgICAgICAgIFdURkNyYXNoIGluIEpTQzo6TGV4ZXI8Y2hhcjE2X3Q+OjphcHBlbmQ4Cisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjg5ODIKKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBzb3VyY2VVUkwg LyBzb3VyY2VNYXBVUkwgZGlyZWN0aXZlIHNob3VsZCBub3QgYXNzdW1lIExhdGluMSBjaGFyYWN0 ZXJzLgorCisgICAgICAgICogcGFyc2VyL0xleGVyLmNwcDoKKyAgICAgICAgKEpTQzo6TGV4ZXI8 VD46OnBhcnNlQ29tbWVudERpcmVjdGl2ZVZhbHVlKToKKwogMjAyMS0wOC0xMCAgS2VpdGggTWls bGVyICA8a2VpdGhfbWlsbGVyQGFwcGxlLmNvbT4KIAogICAgICAgICBDYWxsRnJhbWU6OnJldHVy blBDIHNob3VsZCB1bnRhZyB0aGUgcmV0dXJuIGFkZHJlc3MgYmVmb3JlIHBhc3NpbmcgaXQgdG8g UmV0dXJuQWRkcmVzc1B0cgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3BhcnNl ci9MZXhlci5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcGFyc2VyL0xleGVyLmNwcAppbmRl eCBiMjI4YzJmZjBlYmU3M2Q0YzdhYmY4OTdjNmFkYzYxZDY0MjExYTAyLi4yYjY0ZTQwYzY3NThj NzQwNmU4M2YwN2VmOWUwMmVmNjk2OWQwOTZlIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvcGFyc2VyL0xleGVyLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcGFyc2Vy L0xleGVyLmNwcApAQCAtMTg0MiwxOCArMTg0MiwzMCBAQCB0ZW1wbGF0ZSA8dHlwZW5hbWUgVD4K IEFMV0FZU19JTkxJTkUgU3RyaW5nIExleGVyPFQ+OjpwYXJzZUNvbW1lbnREaXJlY3RpdmVWYWx1 ZSgpCiB7CiAgICAgc2tpcFdoaXRlc3BhY2UoKTsKKyAgICBib29sIGhhc05vbkxhdGluMSA9IGZh bHNlOwogICAgIGNvbnN0IFQqIHN0cmluZ1N0YXJ0ID0gY3VycmVudFNvdXJjZVB0cigpOwotICAg IHdoaWxlICghaXNXaGl0ZVNwYWNlKG1fY3VycmVudCkgJiYgIWlzTGluZVRlcm1pbmF0b3IobV9j dXJyZW50KSAmJiBtX2N1cnJlbnQgIT0gJyInICYmIG1fY3VycmVudCAhPSAnXCcnICYmICFhdEVu ZCgpKQorICAgIHdoaWxlICghaXNXaGl0ZVNwYWNlKG1fY3VycmVudCkgJiYgIWlzTGluZVRlcm1p bmF0b3IobV9jdXJyZW50KSAmJiBtX2N1cnJlbnQgIT0gJyInICYmIG1fY3VycmVudCAhPSAnXCcn ICYmICFhdEVuZCgpKSB7CisgICAgICAgIGlmICghaXNMYXRpbjEobV9jdXJyZW50KSkKKyAgICAg ICAgICAgIGhhc05vbkxhdGluMSA9IHRydWU7CiAgICAgICAgIHNoaWZ0KCk7CisgICAgfQogICAg IGNvbnN0IFQqIHN0cmluZ0VuZCA9IGN1cnJlbnRTb3VyY2VQdHIoKTsKICAgICBza2lwV2hpdGVz cGFjZSgpOwogCiAgICAgaWYgKCFpc0xpbmVUZXJtaW5hdG9yKG1fY3VycmVudCkgJiYgIWF0RW5k KCkpCiAgICAgICAgIHJldHVybiBTdHJpbmcoKTsKIAotICAgIGFwcGVuZDgoc3RyaW5nU3RhcnQs IHN0cmluZ0VuZCAtIHN0cmluZ1N0YXJ0KTsKLSAgICBTdHJpbmcgcmVzdWx0ID0gU3RyaW5nKG1f YnVmZmVyOC5kYXRhKCksIG1fYnVmZmVyOC5zaXplKCkpOwotICAgIG1fYnVmZmVyOC5zaHJpbmso MCk7CisgICAgdW5zaWduZWQgbGVuZ3RoID0gc3RyaW5nRW5kIC0gc3RyaW5nU3RhcnQ7CisgICAg aWYgKGhhc05vbkxhdGluMSkgeworICAgICAgICBVQ2hhciogYnVmZmVyID0gbnVsbHB0cjsKKyAg ICAgICAgU3RyaW5nIHJlc3VsdCA9IFN0cmluZ0ltcGw6OmNyZWF0ZVVuaW5pdGlhbGl6ZWQobGVu Z3RoLCBidWZmZXIpOworICAgICAgICBTdHJpbmdJbXBsOjpjb3B5Q2hhcmFjdGVycyhidWZmZXIs IHN0cmluZ1N0YXJ0LCBsZW5ndGgpOworICAgICAgICByZXR1cm4gcmVzdWx0OworICAgIH0KKwor ICAgIExDaGFyKiBidWZmZXIgPSBudWxscHRyOworICAgIFN0cmluZyByZXN1bHQgPSBTdHJpbmdJ bXBsOjpjcmVhdGVVbmluaXRpYWxpemVkKGxlbmd0aCwgYnVmZmVyKTsKKyAgICBTdHJpbmdJbXBs Ojpjb3B5Q2hhcmFjdGVycyhidWZmZXIsIHN0cmluZ1N0YXJ0LCBsZW5ndGgpOwogICAgIHJldHVy biByZXN1bHQ7CiB9CiAKZGlmZiAtLWdpdCBhL0pTVGVzdHMvQ2hhbmdlTG9nIGIvSlNUZXN0cy9D aGFuZ2VMb2cKaW5kZXggODY3NTg5Njc2MzcxZmYxNmEwNzEzOWY2NjBiZjVkNTExZjY4ODRmOC4u MDQ5OWJkYzQ2N2M0ZDIyN2U5YzNiMjEyNmMwZWNjOThlZDczNWFiYSAxMDA2NDQKLS0tIGEvSlNU ZXN0cy9DaGFuZ2VMb2cKKysrIGIvSlNUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMiBAQAor MjAyMS0wOC0xMCAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29tPgorCisgICAgICAg IFdURkNyYXNoIGluIEpTQzo6TGV4ZXI8Y2hhcjE2X3Q+OjphcHBlbmQ4CisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjg5ODIKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIHN0cmVzcy9kaXJlY3RpdmUtaW5j bHVkZXMtbm9uLWxhdGluMS5qczogQWRkZWQuCisKIDIwMjEtMDgtMDkgIFl1c3VrZSBTdXp1a2kg IDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBbSlNDXSBzdXBlci1MYXRpbjEgd2hpdGUg c3BhY2UgYW5kIGxpbmUgdGVybWluYXRvciBhZnRlciByZWd1bGFyIGV4cHJlc3Npb24gbGl0ZXJh bCBtaXNpbnRlcnByZXRlZCBhcyBmbGFncwpkaWZmIC0tZ2l0IGEvSlNUZXN0cy9zdHJlc3MvZGly ZWN0aXZlLWluY2x1ZGVzLW5vbi1sYXRpbjEuanMgYi9KU1Rlc3RzL3N0cmVzcy9kaXJlY3RpdmUt aW5jbHVkZXMtbm9uLWxhdGluMS5qcwpuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi45OGRmYjYyMTE5MTkyM2NkMWMyNDI3 YzE3N2EwNGRjNjIzZmE2YTIxCi0tLSAvZGV2L251bGwKKysrIGIvSlNUZXN0cy9zdHJlc3MvZGly ZWN0aXZlLWluY2x1ZGVzLW5vbi1sYXRpbjEuanMKQEAgLTAsMCArMSwyIEBACisvLyMgc291cmNl VVJMPWh0dHBzOi8v5pel5pys6KqeLmNvbS8KKy8vIFJ1bm5pbmcgdGhpcyBmaWxlIHNob3VsZCBu b3QgY3Jhc2ggb24gRGVidWcgYnVpbGQuCg==