230121 2021-09-09 13:26:04 -0700 Potential crash under CachedRawResource::didAddClient() 2021-12-22 16:24:25 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=228108 https://bugs.webkit.org/show_bug.cgi?id=232424 InRadar P2 Normal --- 1 cdumez cdumez achristensen ews-watchlist japhet jean-yves.avenard webkit-bug-importer oldest_to_newest 1792064 0 cdumez 2021-09-09 13:26:04 -0700 Potential crash under CachedRawResource::didAddClient(): 50 WebCore: WebCore::SharedBuffer::forEachSegment(WTF::Function<void (WTF::Span<unsigned char const, 18446744073709551615ul> const&)> const&) const <== 50 WebCore: WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&)::$_0::operator()(WebCore::ResourceRequest&&)::'lambda'()::operator()() const 50 WebCore: WTF::Detail::CallableWrapper<WebCore::DocumentLoader::responseReceived(WebCore::ResourceResponse const&, WTF::CompletionHandler<void ()>&&)::$_4, void, WebCore::PolicyAction, WebCore::PolicyCheckIdentifier>::call(WebCore::PolicyAction, WebCore::PolicyCheckIdentifier) 50 WebKit: WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse(WebCore::ResourceResponse const&, WebCore::ResourceRequest const&, WebCore::PolicyCheckIdentifier, WTF::String const&, WTF::Function<void (WebCore::PolicyAction, WebCore::PolicyCheckIdentifier)>&&) 1792065 1 cdumez 2021-09-09 13:26:19 -0700 <rdar://82936913> 1792067 2 437776 cdumez 2021-09-09 13:32:07 -0700 Created attachment 437776 Patch 1792113 3 ews-feeder 2021-09-09 15:24:49 -0700 Committed r282241 (241524@main): <https://commits.webkit.org/241524@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 437776. 1826430 4 jean-yves.avenard 2021-12-22 16:05:45 -0800 We can probably revert this following bug 233442. The inner Vector can't be modified while a SharedBuffer is in use anymore. 437776 2021-09-09 13:32:07 -0700 2021-09-09 15:24:50 -0700 Patch bug-230121-20210909133206.patch text/plain 2922 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjgyMTU2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzJlNzA2MDk0MmEwNjkw ODY0MTFiNmRhYmEzNDE4ZGMwOTc1MDQ1ZC4uODgxY2QwOTJmMTRkMjgwNzAwNmNhN2RhN2UyN2I2 MTNiMWU1MmFjMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI3IEBACisyMDIxLTA5LTA5ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUG90ZW50aWFsIGNyYXNoIHVu ZGVyIENhY2hlZFJhd1Jlc291cmNlOjpkaWRBZGRDbGllbnQoKQorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjMwMTIxCisgICAgICAgIDxyZGFyOi8vODI5 MzY5MTM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg SW4gcjI4MDA4MywgSSB0cmllZCB0byBhZGRyZXNzIHRoaXMgY3Jhc2ggYnkgaG9sZGluZyBhIHN0 cm9uZyByZWZlcmVuY2UKKyAgICAgICAgdG8gdGhlIFNoYXJlZEJ1ZmZlciBiZWZvcmUgY2FsbGlu ZyBmb3JFYWNoU2VnbWVudCgpIG9uIGl0LiBIb3dldmVyLCB0aGUKKyAgICAgICAgY3Jhc2ggaXMg c3RpbGwgaGFwcGVuaW5nIGFmdGVyIHRoaXMgZml4LgorCisgICAgICAgIE15IHN1c3BpY2lvbiBp cyB0aGF0IHRoZSBTaGFyZWRCdWZmZXIncyBpbnRlcm5hbCBtX3NlZ21lbnRzIHZlY3RvciBnZXRz CisgICAgICAgIG1vZGlmaWVkIGFzIHdlIGl0ZXJhdGUgb3ZlciBpdC4gQXMgYSByZXN1bHQsIEkg YW0gcmV2ZXJ0aW5nIHIyODAwODMgYW5kCisgICAgICAgIGl0ZXJhdGluZyBvdmVyIGEgY29weSBv ZiBtX3NlZ21lbnRzIGluIGZvckVhY2hTZWdtZW50KCkgaW5zdGVhZC4KKworICAgICAgICBObyBu ZXcgdGVzdHMsIHdlIGhhdmVuJ3QgYmVlbiBhYmxlIHRvIHJlcHJvZHVjZS4KKworICAgICAgICAq IFdlYkNvcmUueGNvZGVwcm9qL3Byb2plY3QucGJ4cHJvajoKKyAgICAgICAgKiBsb2FkZXIvY2Fj aGUvQ2FjaGVkUmF3UmVzb3VyY2UuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Q2FjaGVkUmF3UmVz b3VyY2U6OmRpZEFkZENsaWVudCk6CisgICAgICAgICogcGxhdGZvcm0vU2hhcmVkQnVmZmVyLmNw cDoKKyAgICAgICAgKFdlYkNvcmU6OlNoYXJlZEJ1ZmZlcjo6Zm9yRWFjaFNlZ21lbnQgY29uc3Qp OgorCiAyMDIxLTA5LTA5ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAg ICAgSW1wbGVtZW50IG5hdmlnYXRpb24gcmVwb3J0aW5nIGZvciBDcm9zcy1PcmlnaW4tT3BlbmVy LVBvbGljeQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hlL0NhY2hlZFJh d1Jlc291cmNlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9DYWNoZWRSYXdSZXNv dXJjZS5jcHAKaW5kZXggZTlhYjlkNjQ1OTA0NWVhOWM1MmZjYjI3NWFkNzAzZWM3NmUxYzExYy4u OTAwOWEzOWI3NWM3NWExMjE2YTdlYmE3ZDZjZmFiOWY5Njc3ZWVmZSAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hlL0NhY2hlZFJhd1Jlc291cmNlLmNwcAorKysgYi9Tb3Vy Y2UvV2ViQ29yZS9sb2FkZXIvY2FjaGUvQ2FjaGVkUmF3UmVzb3VyY2UuY3BwCkBAIC0xNjcsOCAr MTY3LDggQEAgdm9pZCBDYWNoZWRSYXdSZXNvdXJjZTo6ZGlkQWRkQ2xpZW50KENhY2hlZFJlc291 cmNlQ2xpZW50JiBjKQogICAgICAgICBhdXRvIHJlc3BvbnNlUHJvY2Vzc2VkSGFuZGxlciA9IFt0 aGlzLCBwcm90ZWN0ZWRUaGlzID0gV1RGTW92ZShwcm90ZWN0ZWRUaGlzKSwgY2xpZW50XSB7CiAg ICAgICAgICAgICBpZiAoIWhhc0NsaWVudCgqY2xpZW50KSkKICAgICAgICAgICAgICAgICByZXR1 cm47Ci0gICAgICAgICAgICBpZiAoYXV0byBkYXRhID0gbV9kYXRhKSB7Ci0gICAgICAgICAgICAg ICAgZGF0YS0+Zm9yRWFjaFNlZ21lbnQoWyZdKGF1dG8mIHNlZ21lbnQpIHsKKyAgICAgICAgICAg IGlmIChtX2RhdGEpIHsKKyAgICAgICAgICAgICAgICBtX2RhdGEtPmZvckVhY2hTZWdtZW50KFsm XShhdXRvJiBzZWdtZW50KSB7CiAgICAgICAgICAgICAgICAgICAgIGlmIChoYXNDbGllbnQoKmNs aWVudCkpCiAgICAgICAgICAgICAgICAgICAgICAgICBjbGllbnQtPmRhdGFSZWNlaXZlZCgqdGhp cywgc2VnbWVudC5kYXRhKCksIHNlZ21lbnQuc2l6ZSgpKTsKICAgICAgICAgICAgICAgICB9KTsK ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL1NoYXJlZEJ1ZmZlci5jcHAgYi9T b3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9TaGFyZWRCdWZmZXIuY3BwCmluZGV4IDdkOTJkZWI1NDI0 MDc2NjIxOTI2MDFiMzcxNWE2ZjEyYWFiMWJiMjQuLjA1NGNlNWE0MjkyNGM0ZDlmMGM2OWYyZGE4 NmQ5MDc3OWE5MTA4MTUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL1NoYXJl ZEJ1ZmZlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vU2hhcmVkQnVmZmVyLmNw cApAQCAtMjM4LDcgKzIzOCw4IEBAIFJlZjxTaGFyZWRCdWZmZXI+IFNoYXJlZEJ1ZmZlcjo6Y29w eSgpIGNvbnN0CiAKIHZvaWQgU2hhcmVkQnVmZmVyOjpmb3JFYWNoU2VnbWVudChjb25zdCBGdW5j dGlvbjx2b2lkKGNvbnN0IFNwYW48Y29uc3QgdWludDhfdD4mKT4mIGFwcGx5KSBjb25zdAogewot ICAgIGZvciAoYXV0byYgc2VnbWVudCA6IG1fc2VnbWVudHMpCisgICAgYXV0byBzZWdtZW50cyA9 IG1fc2VnbWVudHM7CisgICAgZm9yIChhdXRvJiBzZWdtZW50IDogc2VnbWVudHMpCiAgICAgICAg IGFwcGx5KFNwYW4geyBzZWdtZW50LnNlZ21lbnQtPmRhdGEoKSwgc2VnbWVudC5zZWdtZW50LT5z aXplKCkgfSk7CiB9CiAK