229272 2021-08-18 20:07:33 -0700 Nullptr crash in CSSFontFaceSet::ensureLocalFontFacesForFamilyRegistered 2021-08-24 12:35:12 -0700 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa rbuis bfulgham cgarcia ews-feeder fred.wang gpoo koivisto mmaxfield product-security rbuis simon.fraser svillar webkit-bug-importer oldest_to_newest 1785335 0 435830 rniwa 2021-08-18 20:07:33 -0700 Created attachment 435830 Test This crashes: <script> onload = () => { let div0 = document.createElement('div'); let progress0 = document.createElement('progress'); div0.appendChild(progress0); let document2 = new Document(); document2.appendChild(div0); progress0.cloneNode(); let fontFace = new FontFace('a', 'url()'); let fontFaceSet = document2.fonts; queueMicrotask(() => { window.GCController?.collect(); fontFaceSet.add(fontFace); }); }; </script> e.g. #0 0x3fd2ac133 in WebCore::CSSFontFaceSet::ensureLocalFontFacesForFamilyRegistered(WTF::String const&)+0x203 (WebCore.framework/Versions/A/WebCore:x86_64+0x322e133) #1 0x3fd2ad0ec in WebCore::CSSFontFaceSet::addToFacesLookupTable(WebCore::CSSFontFace&)+0x3ac (WebCore.framework/Versions/A/WebCore:x86_64+0x322f0ec) #2 0x3fd2ad84c in WebCore::CSSFontFaceSet::add(WebCore::CSSFontFace&)+0x22c (WebCore.framework/Versions/A/WebCore:x86_64+0x322f84c) #3 0x3fd401067 in WebCore::FontFaceSet::add(WebCore::FontFace&)+0x57 (WebCore.framework/Versions/A/WebCore:x86_64+0x3383067) #4 0x3faceb1b2 in WebCore::jsFontFaceSetPrototypeFunction_addBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSFontFaceSet*)+0x1a2 (WebCore.framework/Versions/A/WebCore:x86_64+0xc6d1b2) #5 0x3faceaf70 in long long WebCore::IDLOperation<WebCore::JSFontFaceSet>::call<&(WebCore::jsFontFaceSetPrototypeFunction_addBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSFontFaceSet*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)+0x100 (WebCore.framework/Versions/A/WebCore:x86_64+0xc6cf70) #6 0x3facea6b8 in WebCore::jsFontFaceSetPrototypeFunction_add(JSC::JSGlobalObject*, JSC::CallFrame*)+0x8 (WebCore.framework/Versions/A/WebCore:x86_64+0xc6c6b8) #7 0x2aa182c011d7 (<unknown module>) #8 0x41806f8d6 in llint_entry+0x1b5c6 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xe318d6) #9 0x418054108 in vmEntryToJavaScript+0xd7 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xe16108) #10 0x419a75084 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)+0x5e4 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x2837084) #11 0x41a375b84 in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)+0x64 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x3137b84) #12 0x41a375e97 in JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)+0x107 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x3137e97) #13 0x41a69c3fa in JSC::JSMicrotask::run(JSC::JSGlobalObject*)+0x25a (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x345e3fa) #14 0x3fcedf8c7 in WebCore::JSExecState::runTask(JSC::JSGlobalObject*, JSC::Microtask&)+0xf7 (WebCore.framework/Versions/A/WebCore:x86_64+0x2e618c7) #15 0x3fcee603a in WebCore::JSMicrotaskCallback::call()+0x10a (WebCore.framework/Versions/A/WebCore:x86_64+0x2e6803a) #16 0x3fcee5d9f in WebCore::JSDOMWindowBase::queueMicrotaskToEventLoop(JSC::JSGlobalObject&, WTF::Ref<JSC::Microtask, WTF::RawPtrTraits<JSC::Microtask> >&&)::$_40::operator()()+0xcf (WebCore.framework/Versions/A/WebCore:x86_64+0x2e67d9f) #17 0x3fcee5c2c in WTF::Detail::CallableWrapper<WebCore::JSDOMWindowBase::queueMicrotaskToEventLoop(JSC::JSGlobalObject&, WTF::Ref<JSC::Microtask, WTF::RawPtrTraits<JSC::Microtask> >&&)::$_40, void>::call()+0xc (WebCore.framework/Versions/A/WebCore:x86_64+0x2e67c2c) #18 0x3fa096ebe in WTF::Function<void ()>::operator()() const+0x3e (WebCore.framework/Versions/A/WebCore:x86_64+0x18ebe) #19 0x3fd865fac in WebCore::EventLoopFunctionDispatchTask::execute()+0xc (WebCore.framework/Versions/A/WebCore:x86_64+0x37e7fac) #20 0x3fd8aa649 in WebCore::MicrotaskQueue::performMicrotaskCheckpoint()+0x699 (WebCore.framework/Versions/A/WebCore:x86_64+0x382c649) #21 0x3fd85413c in WebCore::EventLoop::performMicrotaskCheckpoint()+0x3c (WebCore.framework/Versions/A/WebCore:x86_64+0x37d613c) #22 0x3fd8560b8 in WebCore::EventLoopTaskGroup::performMicrotaskCheckpoint()+0x28 (WebCore.framework/Versions/A/WebCore:x86_64+0x37d80b8) #23 0x3fce7803e in WebCore::JSExecState::didLeaveScriptContext(JSC::JSGlobalObject*)+0x4e (WebCore.framework/Versions/A/WebCore:x86_64+0x2dfa03e) 1785336 1 rniwa 2021-08-18 20:07:50 -0700 <rdar://80578044> 1785337 2 rniwa 2021-08-18 20:08:12 -0700 I can reproduce this use after free with ASAN release build of WebKitTestRunner at r281219. 1785340 3 rniwa 2021-08-18 20:13:49 -0700 (In reply to Ryosuke Niwa from comment #2) > I can reproduce this use after free with ASAN release build of > WebKitTestRunner at r281219. I meant to say this *crash*, not use after free. 1786365 4 436171 rbuis 2021-08-23 02:35:29 -0700 Created attachment 436171 Patch 1786588 5 436171 rniwa 2021-08-23 15:24:48 -0700 Comment on attachment 436171 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=436171&action=review > Source/WebCore/css/CSSFontFaceSet.cpp:114 > + if (!m_owningFontSelector->scriptExecutionContext()) > + return; > + AllowUserInstalledFonts allowUserInstalledFonts = m_owningFontSelector->scriptExecutionContext()->settingsValues().shouldAllowUserInstalledFonts ? AllowUserInstalledFonts::Yes : AllowUserInstalledFonts::No; Hm... ideally, we'd use the context document as the script execution context in this case but I guess there isn't much harm for now. 1786664 6 ews-feeder 2021-08-23 22:07:39 -0700 Committed r281487 (240861@main): <https://commits.webkit.org/240861@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 436171. 435830 2021-08-18 20:07:33 -0700 2021-08-18 20:07:33 -0700 Test repro_704.html text/html 466 rniwa PHNjcmlwdD4KICBvbmxvYWQgPSAoKSA9PiB7CiAgICBsZXQgZGl2MCA9IGRvY3VtZW50LmNyZWF0 ZUVsZW1lbnQoJ2RpdicpOwogICAgbGV0IHByb2dyZXNzMCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1l bnQoJ3Byb2dyZXNzJyk7CiAgICBkaXYwLmFwcGVuZENoaWxkKHByb2dyZXNzMCk7CiAgICBsZXQg ZG9jdW1lbnQyID0gbmV3IERvY3VtZW50KCk7CiAgICBkb2N1bWVudDIuYXBwZW5kQ2hpbGQoZGl2 MCk7CiAgICBwcm9ncmVzczAuY2xvbmVOb2RlKCk7CiAgICBsZXQgZm9udEZhY2UgPSBuZXcgRm9u dEZhY2UoJ2EnLCAndXJsKCknKTsKICAgIGxldCBmb250RmFjZVNldCA9IGRvY3VtZW50Mi5mb250 czsKICAgIHF1ZXVlTWljcm90YXNrKCgpID0+IHsKICAgICAgd2luZG93LkdDQ29udHJvbGxlcj8u Y29sbGVjdCgpOwogICAgICBmb250RmFjZVNldC5hZGQoZm9udEZhY2UpOwogICAgfSk7CiAgfTsK PC9zY3JpcHQ+Cg== 436171 2021-08-23 02:35:29 -0700 2021-08-23 22:07:40 -0700 Patch bug-229272-20210823113527.patch text/plain 4038 rbuis U3VidmVyc2lvbiBSZXZpc2lvbjogMjgxMjk2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzg5M2U4NGIzNDAxMzE5 MDYxYmY4NjZhZDhkZTY5YTY2NTYwNmY2MC4uZTk5ZWNjYWU2ZmEzZjdjNGY5ZjkzZWI0ZDVlNWRk MWY3NjQxNTFhNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDIxLTA4LTIzICBSb2Ig QnVpcyAgPHJidWlzQGlnYWxpYS5jb20+CisKKyAgICAgICAgTnVsbCBjaGVjayBzY3JpcHRFeGVj dXRpb25Db250ZXh0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0yMjkyNzIKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg ICAgICBOdWxsIGNoZWNrIHNjcmlwdEV4ZWN1dGlvbkNvbnRleHQgaW4gZW5zdXJlTG9jYWxGb250 RmFjZXNGb3JGYW1pbHlSZWdpc3RlcmVkLgorCisgICAgICAgIFRlc3RzOiBmYXN0L3RleHQvZm9u dC1mYWNlLXNldC1hZGQtY3Jhc2guaHRtbAorCisgICAgICAgICogY3NzL0NTU0ZvbnRGYWNlU2V0 LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNTU0ZvbnRGYWNlU2V0OjplbnN1cmVMb2NhbEZvbnRG YWNlc0ZvckZhbWlseVJlZ2lzdGVyZWQpOgorCiAyMDIxLTA4LTE5ICBUaW0gTmd1eWVuICA8bnRp bUBhcHBsZS5jb20+CiAKICAgICAgICAgSW1wbGVtZW50IHRvcCBsYXllciByZW5kZXJpbmcgYml0 cwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvY3NzL0NTU0ZvbnRGYWNlU2V0LmNwcCBiL1Nv dXJjZS9XZWJDb3JlL2Nzcy9DU1NGb250RmFjZVNldC5jcHAKaW5kZXggZjE1OGM2MDA2OWMzZmNh OTlmMWUzMWNmMWY1YmI3NGMxYTE2ZjFkMC4uNmE3ZjI2NmMyMzJmNzUzMWU4YmFjZmJkNWExMjI2 MzU1NDI3MDljMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvY3NzL0NTU0ZvbnRGYWNlU2V0 LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9jc3MvQ1NTRm9udEZhY2VTZXQuY3BwCkBAIC0xMDks OSArMTA5LDkgQEAgdm9pZCBDU1NGb250RmFjZVNldDo6ZW5zdXJlTG9jYWxGb250RmFjZXNGb3JG YW1pbHlSZWdpc3RlcmVkKGNvbnN0IFN0cmluZyYgZmFtaWwKICAgICBpZiAobV9sb2NhbGx5SW5z dGFsbGVkRmFjZXNMb29rdXBUYWJsZS5jb250YWlucyhmYW1pbHlOYW1lKSkKICAgICAgICAgcmV0 dXJuOwogCi0gICAgQWxsb3dVc2VySW5zdGFsbGVkRm9udHMgYWxsb3dVc2VySW5zdGFsbGVkRm9u dHMgPSBBbGxvd1VzZXJJbnN0YWxsZWRGb250czo6WWVzOwotICAgIGlmIChtX293bmluZ0ZvbnRT ZWxlY3Rvci0+c2NyaXB0RXhlY3V0aW9uQ29udGV4dCgpKQotICAgICAgICBhbGxvd1VzZXJJbnN0 YWxsZWRGb250cyA9IG1fb3duaW5nRm9udFNlbGVjdG9yLT5zY3JpcHRFeGVjdXRpb25Db250ZXh0 KCktPnNldHRpbmdzVmFsdWVzKCkuc2hvdWxkQWxsb3dVc2VySW5zdGFsbGVkRm9udHMgPyBBbGxv d1VzZXJJbnN0YWxsZWRGb250czo6WWVzIDogQWxsb3dVc2VySW5zdGFsbGVkRm9udHM6Ok5vOwor ICAgIGlmICghbV9vd25pbmdGb250U2VsZWN0b3ItPnNjcmlwdEV4ZWN1dGlvbkNvbnRleHQoKSkK KyAgICAgICAgcmV0dXJuOworICAgIEFsbG93VXNlckluc3RhbGxlZEZvbnRzIGFsbG93VXNlcklu c3RhbGxlZEZvbnRzID0gbV9vd25pbmdGb250U2VsZWN0b3ItPnNjcmlwdEV4ZWN1dGlvbkNvbnRl eHQoKS0+c2V0dGluZ3NWYWx1ZXMoKS5zaG91bGRBbGxvd1VzZXJJbnN0YWxsZWRGb250cyA/IEFs bG93VXNlckluc3RhbGxlZEZvbnRzOjpZZXMgOiBBbGxvd1VzZXJJbnN0YWxsZWRGb250czo6Tm87 CiAgICAgVmVjdG9yPEZvbnRTZWxlY3Rpb25DYXBhYmlsaXRpZXM+IGNhcGFiaWxpdGllcyA9IG1f b3duaW5nRm9udFNlbGVjdG9yLT5zY3JpcHRFeGVjdXRpb25Db250ZXh0KCktPmZvbnRDYWNoZSgp LmdldEZvbnRTZWxlY3Rpb25DYXBhYmlsaXRpZXNJbkZhbWlseShmYW1pbHlOYW1lLCBhbGxvd1Vz ZXJJbnN0YWxsZWRGb250cyk7CiAgICAgaWYgKGNhcGFiaWxpdGllcy5pc0VtcHR5KCkpCiAgICAg ICAgIHJldHVybjsKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRl c3RzL0NoYW5nZUxvZwppbmRleCBhNTljMWUwNjcxYzE3YWI4NmJkOGVjZWFjYmYzYmVjYzc5ZWI2 ZjQzLi5kY2M3YjBkZDA5ODUyMGNjY2MyYTNhOGYxYWFmMjc2ODJjODU4YzEyIDEwMDY0NAotLS0g YS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0x LDMgKzEsMTMgQEAKKzIwMjEtMDgtMjMgIFJvYiBCdWlzICA8cmJ1aXNAaWdhbGlhLmNvbT4KKwor ICAgICAgICBOdWxsIGNoZWNrIHNjcmlwdEV4ZWN1dGlvbkNvbnRleHQKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyOTI3MgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogZmFzdC90ZXh0L2ZvbnQtZmFjZS1z ZXQtYWRkLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC90ZXh0L2Zv bnQtZmFjZS1zZXQtYWRkLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDIxLTA4LTE5ICBUaW0gTmd1 eWVuICA8bnRpbUBhcHBsZS5jb20+CiAKICAgICAgICAgSW1wbGVtZW50IHRvcCBsYXllciByZW5k ZXJpbmcgYml0cwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC90ZXh0L2ZvbnQtZmFjZS1z ZXQtYWRkLWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvdGV4dC9mb250LWZh Y2Utc2V0LWFkZC1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXgg MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uMDM4MzE2MjBmNjQ4MDQ1 MzhlMjBlOTZhMTEzM2JhZTkxZDZiNGNlZAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3Rz L2Zhc3QvdGV4dC9mb250LWZhY2Utc2V0LWFkZC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCAr MSBAQAorVGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guCmRpZmYgLS1naXQgYS9MYXlv dXRUZXN0cy9mYXN0L3RleHQvZm9udC1mYWNlLXNldC1hZGQtY3Jhc2guaHRtbCBiL0xheW91dFRl c3RzL2Zhc3QvdGV4dC9mb250LWZhY2Utc2V0LWFkZC1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUg MTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjkx ZDU1ZDhkYzhhYWI5NDZmM2ZmZjdhMjE2MTlmODAzMzUyMmI2NmQKLS0tIC9kZXYvbnVsbAorKysg Yi9MYXlvdXRUZXN0cy9mYXN0L3RleHQvZm9udC1mYWNlLXNldC1hZGQtY3Jhc2guaHRtbApAQCAt MCwwICsxLDE5IEBACis8c2NyaXB0PgorICBpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgd2lu ZG93LnRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworICBvbmxvYWQgPSAoKSA9PiB7CisgICAgbGV0 IGRpdjAgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKTsKKyAgICBsZXQgcHJvZ3Jlc3Mw ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgncHJvZ3Jlc3MnKTsKKyAgICBkaXYwLmFwcGVuZENo aWxkKHByb2dyZXNzMCk7CisgICAgbGV0IGRvY3VtZW50MiA9IG5ldyBEb2N1bWVudCgpOworICAg IGRvY3VtZW50Mi5hcHBlbmRDaGlsZChkaXYwKTsKKyAgICBwcm9ncmVzczAuY2xvbmVOb2RlKCk7 CisgICAgbGV0IGZvbnRGYWNlID0gbmV3IEZvbnRGYWNlKCdhJywgJ3VybCgpJyk7CisgICAgbGV0 IGZvbnRGYWNlU2V0ID0gZG9jdW1lbnQyLmZvbnRzOworICAgIHF1ZXVlTWljcm90YXNrKCgpID0+ IHsKKyAgICAgIHdpbmRvdy5HQ0NvbnRyb2xsZXI/LmNvbGxlY3QoKTsKKyAgICAgIGZvbnRGYWNl U2V0LmFkZChmb250RmFjZSk7CisgICAgICBkb2N1bWVudC53cml0ZSgiVGVzdCBwYXNzZXMgaWYg aXQgZG9lcyBub3QgY3Jhc2guIik7CisgICAgfSk7CisgIH07Cis8L3NjcmlwdD4K