230770 2021-09-24 13:50:47 -0700 Line iterator firstRun/lastRun may return runs from wrong lines 2021-09-26 06:47:57 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ajuma koivisto beidson bfulgham fpizlo koivisto msaboff product-security rniwa rohitrao simon.fraser webkit-bug-importer zalan oldest_to_newest 1797019 0 439193 ajuma 2021-09-24 13:50:47 -0700 Created attachment 439193 Minimal test case Filing this as a security bug since it was found using a fuzzer; there's no disclosure deadline for this bug. This reproduces in an ASan build of WebKitTestRunner. Stack: ================================================================= ==51278==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x0005c23cdaad bp 0x7ffee3c4c580 sp 0x7ffee3c4c580 T0) ==51278==The signal is caused by a READ memory access. ==51278==Hint: address points to the zero page. #0 0x5c23cdaac in WTF::RefPtr<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> >, WTF::DefaultRefDerefTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >::operator bool() const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x21aac) #1 0x5c4e3545d in WTF::WeakPtr<WebCore::RenderObject, WTF::EmptyCounter>::get() const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2a8945d) #2 0x5c4e35448 in WTF::WeakPtr<WebCore::RenderObject, WTF::EmptyCounter>::operator*() const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2a89448) #3 0x5c4e3508d in decltype(WTF::visit(makeVisitor(std::forward<WebCore::LayoutIntegration::PathRun::renderer() const::'lambda'(auto&)>(fp0)), std::forward<auto>(fp))) WTF::switchOn<WTF::Variant<WebCore::LayoutIntegration::RunIteratorModernPath, WebCore::LayoutIntegration::RunIteratorLegacyPath> const&, WebCore::LayoutIntegration::PathRun::renderer() const::'lambda'(auto&)>(auto&&, WebCore::LayoutIntegration::PathRun::renderer() const::'lambda'(auto&)&&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2a8908d) #4 0x5c4e2183f in WebCore::LayoutIntegration::PathRun::renderer() const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2a7583f) #5 0x5c7543e57 in WebCore::RenderBlockFlow::inlineSelectionGaps(WebCore::RenderBlock&, WebCore::LayoutPoint const&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LogicalSelectionOffsetCaches const&, WebCore::PaintInfo const*)::$_5::operator()(WebCore::LayoutIntegration::LineIterator const&, WebCore::LayoutUnit, WebCore::LayoutUnit) const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x5197e57) #6 0x5c7542b36 in WebCore::RenderBlockFlow::inlineSelectionGaps(WebCore::RenderBlock&, WebCore::LayoutPoint const&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LogicalSelectionOffsetCaches const&, WebCore::PaintInfo const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x5196b36) #7 0x5c74f6ef6 in WebCore::RenderBlock::selectionGaps(WebCore::RenderBlock&, WebCore::LayoutPoint const&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LogicalSelectionOffsetCaches const&, WebCore::PaintInfo const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x514aef6) #8 0x5c74f87b5 in WebCore::RenderBlock::blockSelectionGaps(WebCore::RenderBlock&, WebCore::LayoutPoint const&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LogicalSelectionOffsetCaches const&, WebCore::PaintInfo const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x514c7b5) #9 0x5c74f6f2b in WebCore::RenderBlock::selectionGaps(WebCore::RenderBlock&, WebCore::LayoutPoint const&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LogicalSelectionOffsetCaches const&, WebCore::PaintInfo const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x514af2b) #10 0x5c74f608e in WebCore::RenderBlock::selectionGapRectsForRepaint(WebCore::RenderLayerModelObject const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x514a08e) #11 0x5c77ea1ef in WebCore::RenderBlockSelectionInfo::RenderBlockSelectionInfo(WebCore::RenderBlock&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x543e1ef) #12 0x5c78bc93f in std::__1::__unique_if<WebCore::RenderBlockSelectionInfo>::__unique_single std::__1::make_unique<WebCore::RenderBlockSelectionInfo, WebCore::RenderBlock&>(WebCore::RenderBlock&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x551093f) #13 0x5c78a986e in WebCore::collectSelectionData(WebCore::RenderRange const&, bool) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x54fd86e) #14 0x5c78a6c0f in WebCore::SelectionRangeData::apply(WebCore::RenderRange const&, WebCore::SelectionRangeData::RepaintMode) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x54fac0f) #15 0x5c78a6892 in WebCore::SelectionRangeData::set(WebCore::RenderRange const&, WebCore::SelectionRangeData::RepaintMode) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x54fa892) #16 0x5c5bb54d5 in WebCore::FrameSelection::updateAppearance() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x38094d5) #17 0x5c5bb4a25 in WebCore::FrameSelection::updateAndRevealSelection(WebCore::AXTextStateChangeIntent const&, WebCore::ScrollBehavior, WebCore::RevealExtentOption) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3808a25) #18 0x5c5b7cbde in WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x37d0bde) #19 0x5c5b7b371 in WebCore::FrameSelection::selectAll() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x37cf371) #20 0x5c5bd07b0 in WebCore::executeSelectAll(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x38247b0) #21 0x5c582f378 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3483378) #22 0x5c2c9abe5 in WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x8eebe5) #23 0x5c2c9a67b in long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x8ee67b) #24 0x39c131c011d7 (<unknown module>) #25 0x5e0a5fec4 in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xd3fec4) #26 0x5e0a5ff51 in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xd3ff51) #27 0x5e0a43878 in vmEntryToJavaScript (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xd23878) #28 0x5e231694a in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x25f694a) #29 0x5e2b2333f in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x2e0333f) #30 0x5e2b236fb in JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x2e036fb) #31 0x5c4fbd338 in WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2c11338) #32 0x5c4fe7871 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2c3b871) #33 0x5c5954abf in WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x35a8abf) #34 0x5c5954362 in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x35a8362) #35 0x5c59240e8 in WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x35780e8) #36 0x5c5943efc in WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3597efc) #37 0x5c59434ae in WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x35974ae) #38 0x5c68fc23b in WebCore::DOMWindow::dispatchLoadEvent() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x455023b) #39 0x5c5813be0 in WebCore::Document::dispatchWindowLoadEvent() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3467be0) #40 0x5c58134d0 in WebCore::Document::implicitClose() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x34674d0) #41 0x5c66ee282 in WebCore::FrameLoader::checkCompleted() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x4342282) #42 0x5c66eaa70 in WebCore::FrameLoader::finishedParsing() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x433ea70) #43 0x5c5835467 in WebCore::Document::finishedParsing() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3489467) #44 0x5c61593fa in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3dad3fa) #45 0x5c6667c20 in WebCore::DocumentWriter::end() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x42bbc20) #46 0x5c6666706 in WebCore::DocumentLoader::finishedLoading() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x42ba706) #47 0x5c666f7db in WebCore::DocumentLoader::continueAfterContentPolicy(WebCore::PolicyAction) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x42c37db) #48 0x5c6668e02 in WebCore::DocumentLoader::responseReceived(WebCore::ResourceResponse const&, WTF::CompletionHandler<void ()>&&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x42bce02) #49 0x5c666812c in WebCore::DocumentLoader::handleSubstituteDataLoadNow() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x42bc12c) #50 0x5dfe0283e in WTF::RunLoop::dispatch(WTF::HashSet<WTF::RefPtr<WTF::SchedulePair, WTF::RawPtrTraits<WTF::SchedulePair>, WTF::DefaultRefDerefTraits<WTF::SchedulePair> >, WTF::SchedulePairHash, WTF::HashTraits<WTF::RefPtr<WTF::SchedulePair, WTF::RawPtrTraits<WTF::SchedulePair>, WTF::DefaultRefDerefTraits<WTF::SchedulePair> > >, WTF::HashTableTraits> const&, WTF::Function<void ()>&&)::$_0::operator()(__CFRunLoopTimer*, void*) const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xe283e) #51 0x7fff31374467 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x9f467) #52 0x7fff31373fcd in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x9efcd) #53 0x7fff31373ab8 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x9eab8) #54 0x7fff3135870c in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x8370c) #55 0x7fff31357952 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x82952) #56 0x7fff33a151c7 in -[NSRunLoop(NSRunLoop) runMode:beforeDate:] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x601c7) #57 0x7fff33ac7c6e in -[NSRunLoop(NSRunLoop) run] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x112c6e) #58 0x7fff6b7144e9 in _xpc_objc_main.cold.4 (/usr/lib/system/libxpc.dylib:x86_64+0x164e9) #59 0x7fff6b71442f in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x1642f) #60 0x7fff6b713f62 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0x15f62) #61 0x5b10eeee5 in WebKit::XPCServiceMain(int, char const**) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x10eeee5) #62 0x7fff6b4c2cc8 in start (/usr/lib/system/libdyld.dylib:x86_64+0x1acc8) ==51278==Register values: rax = 0x0000000000000004 rbx = 0x0000000000000020 rcx = 0x0000100000000004 rdx = 0x00000000e3c4c603 rdi = 0x0000000000000020 rsi = 0x00007ffee3c4c7c0 rbp = 0x00007ffee3c4c580 rsp = 0x00007ffee3c4c580 r8 = 0x000000007fffffff r9 = 0x0000100000000000 r10 = 0xffffffffffffffff r11 = 0x00000fffffffffff r12 = 0x00007ffee3c4c5e0 r13 = 0x00007ffee3c4c5c0 r14 = 0x0000000000000000 r15 = 0x00001fffdc7898b8 ===================================== Clusterfuzz-id: 5717398421045248 1797020 1 webkit-bug-importer 2021-09-24 13:51:00 -0700 <rdar://problem/83509753> 1797025 2 zalan 2021-09-24 13:59:42 -0700 probably a fallout from https://trac.webkit.org/changeset/282764/webkit 1797284 3 439292 koivisto 2021-09-26 02:16:44 -0700 Created attachment 439292 Patch 1797287 4 ews-feeder 2021-09-26 06:47:49 -0700 Committed r283087 (242145@main): <https://commits.webkit.org/242145@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 439292. 439193 2021-09-24 13:50:47 -0700 2021-09-24 13:50:47 -0700 Minimal test case layoutIntegrationPathRunRenderer.html text/html 786 ajuma PHNjcmlwdD4KZnVuY3Rpb24gZXZlbnRoYW5kbGVyMigpIHsKIC8qIG5ld3Zhcnt2YXIwMDExNTpi b29sZWFufSAqLyB2YXIgdmFyMDAxMTUgPSBkb2N1bWVudC5leGVjQ29tbWFuZCgic2VsZWN0QWxs Iik7IAogd2luZG93LnJlc2l6ZVRvKDEpOyAKIGh0bWx2YXIwMDAxMC5hbGlnbiA9ICJyaWdodCI7 IAp9Cjwvc2NyaXB0Pgo8dmlkZW8gYWNjZXNza2V5PSI+Ij5XO3VZaSxeVlJJeTlCPC92aWRlbz4N CjxlbWJlZCBpZD0iaHRtbHZhcjAwMDEwIiBzdHlsZT0iLXdlYmtpdC1oeXBoZW5zOiBub25lOyAt d2Via2l0LWJvcmRlci12ZXJ0aWNhbC1zcGFjaW5nOiAwcHg7IG1zby1zdHlsZS1uZXh0OiBOb3Jt YWw7IGp1c3RpZnktc2VsZjogZW5kIHVuc2FmZTsgLXdlYmtpdC1jb2x1bW4tZ2FwOiBpbml0aWFs IiBoZWlnaHQ9IjIxNDc0ODM2NDciID0ibWlkZGxlIiB0eXBlPSBjZWxsc3BhY2luZz0iLTEiPg0K PGRldGFpbHMgaWQ9Imh0bWx2YXIwMDAyMyIgb3Blbj1uYW1lPSI9KTl4XiZhbXA7WiZndDs0YnYx NikhTHtlIiBvbnRvZ2dsZT0iZXZlbnRoYW5kbGVyMigpIiBvbmJlZm9yZWxvYWQ9PSJtdWx0aXBs ZSI+DQomYW1wO3VzayZsdDstcClWQnhaSSddMzZIMz08L2RldGFpbHM+DQo8aWZyYW1lIGlkPSJo dG1sdmFyMDAwNDMidHlwZT0iaXNpbmRleCIgc3JjZG9jPSIndUleYTlcW2kiIG9ubG9hZD0iZXZl bnRoYW5kbGVyMigpIiBvbm1vdXNlb3Zlcj0iZXZlbnRoYW5kbGVyNSgpIj5QQn5XdG4/ITs8L2lm cmFtZT4NCjxkaXYgbGFuZz0iVFIiPjFyd3dQdSBgYiZhbXA7Jmd0OyZsdDtc 439292 2021-09-26 02:16:44 -0700 2021-09-26 06:47:53 -0700 Patch bug-230770-20210926121642.patch text/plain 4327 koivisto U3VidmVyc2lvbiBSZXZpc2lvbjogMjgzMDMxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggN2U4MzA2YjI0MjYzM2M2 NmI4NTIyNzNjNDc1YzdmZjgwYTcwMmZkNi4uNmNkYjZlMjEzZWUwNDU4N2RmMTQ1OTFhYzM0NDU4 OWRmNzVlODIzNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDIxLTA5LTI2ICBBbnR0 aSBLb2l2aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBMaW5lIGl0ZXJhdG9yIGZp cnN0UnVuL2xhc3RSdW4gbWF5IHJldHVybiBydW5zIGZyb20gd3JvbmcgbGluZXMKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzMDc3MAorICAgICAgICA8 cmRhcjovL3Byb2JsZW0vODM1MDk3NTM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgSW4gc29tZSBzaXR1YXRpb24gbGluZSBpdGVyYXRvciBmaXJzdFJ1 bi9sYXN0UnVuIGNvdWxkIHJldHVybiBydW5zIGZyb20gZGlmZmVyZW50IGxpbmVzLgorICAgICAg ICBUaGlzIGNvdWxkIGxlYWQgdG8gaW5jb25zaXN0ZW5jaWVzIGxpa2UgZmlyc3RSdW4gYmVpbmcg bm9uLW51bGwgd2hpbGUgbGFzdFJ1biBpcyBudWxsLgorCisgICAgICAgIFRlc3Q6IGVkaXRpbmcv aXRlcmF0b3ItbGluZS1zdGFydC1lbmQuaHRtbAorCisgICAgICAgICogbGF5b3V0L2ludGVncmF0 aW9uL0xheW91dEludGVncmF0aW9uTGluZUl0ZXJhdG9yTW9kZXJuUGF0aC5oOgorICAgICAgICAo V2ViQ29yZTo6TGF5b3V0SW50ZWdyYXRpb246OkxpbmVJdGVyYXRvck1vZGVyblBhdGg6OmZpcnN0 UnVuIGNvbnN0KToKKyAgICAgICAgKFdlYkNvcmU6OkxheW91dEludGVncmF0aW9uOjpMaW5lSXRl cmF0b3JNb2Rlcm5QYXRoOjpsYXN0UnVuIGNvbnN0KToKKworICAgICAgICBUYWtlIGNhcmUgdG8g b25seSByZXR1cm4gcnVucyBmcm9tIHRoaXMgbGluZS4KKwogMjAyMS0wOS0yNCAgTXlsZXMgQy4g TWF4ZmllbGQgIDxtbWF4ZmllbGRAYXBwbGUuY29tPgogCiAgICAgICAgIEhhbmRsZSBDU1NPTSBz dHlsZSBtdXRhdGlvbiBvZiBmb250LXBhbGV0dGUtdmFsdWVzCmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViQ29yZS9sYXlvdXQvaW50ZWdyYXRpb24vTGF5b3V0SW50ZWdyYXRpb25MaW5lSXRlcmF0b3JN b2Rlcm5QYXRoLmggYi9Tb3VyY2UvV2ViQ29yZS9sYXlvdXQvaW50ZWdyYXRpb24vTGF5b3V0SW50 ZWdyYXRpb25MaW5lSXRlcmF0b3JNb2Rlcm5QYXRoLmgKaW5kZXggMjgyYzI4MzEyODhjNGVjMDMz MjgwNWM3OGEzMDQ4MTVhZjQ3ZDFiNC4uNWY5MzU5ZmYxMDZkZmE0ODY3OTQ5MDIxMDIwZWQ5Mjg5 N2IyODVhOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvbGF5b3V0L2ludGVncmF0aW9uL0xh eW91dEludGVncmF0aW9uTGluZUl0ZXJhdG9yTW9kZXJuUGF0aC5oCisrKyBiL1NvdXJjZS9XZWJD b3JlL2xheW91dC9pbnRlZ3JhdGlvbi9MYXlvdXRJbnRlZ3JhdGlvbkxpbmVJdGVyYXRvck1vZGVy blBhdGguaApAQCAtMTAyLDcgKzEwMiw3IEBAIHB1YmxpYzoKICAgICAgICAgICAgIHJldHVybiB7 ICptX2lubGluZUNvbnRlbnQgfTsKICAgICAgICAgYXV0byBydW5JdGVyYXRvciA9IFJ1bkl0ZXJh dG9yTW9kZXJuUGF0aCB7ICptX2lubGluZUNvbnRlbnQsIGxpbmUoKS5maXJzdEJveEluZGV4KCkg fTsKICAgICAgICAgaWYgKHJ1bkl0ZXJhdG9yLmJveCgpLmlzSW5saW5lQm94KCkpCi0gICAgICAg ICAgICBydW5JdGVyYXRvci50cmF2ZXJzZU5leHRMZWFmKCk7CisgICAgICAgICAgICBydW5JdGVy YXRvci50cmF2ZXJzZU5leHRPbkxpbmUoKTsKICAgICAgICAgcmV0dXJuIHJ1bkl0ZXJhdG9yOwog ICAgIH0KIApAQCAtMTEzLDcgKzExMyw3IEBAIHB1YmxpYzoKICAgICAgICAgICAgIHJldHVybiB7 ICptX2lubGluZUNvbnRlbnQgfTsKICAgICAgICAgYXV0byBydW5JdGVyYXRvciA9IFJ1bkl0ZXJh dG9yTW9kZXJuUGF0aCB7ICptX2lubGluZUNvbnRlbnQsIGxpbmUoKS5maXJzdEJveEluZGV4KCkg KyBib3hDb3VudCAtIDEgfTsKICAgICAgICAgaWYgKHJ1bkl0ZXJhdG9yLmJveCgpLmlzSW5saW5l Qm94KCkpCi0gICAgICAgICAgICBydW5JdGVyYXRvci50cmF2ZXJzZVByZXZpb3VzTGVhZigpOwor ICAgICAgICAgICAgcnVuSXRlcmF0b3IudHJhdmVyc2VQcmV2aW91c09uTGluZSgpOwogICAgICAg ICByZXR1cm4gcnVuSXRlcmF0b3I7CiAgICAgfQogCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9D aGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggZGViYjgxMzZjZmU4M2Q4M2Vj NjJhNGFiODE2MmI5ZjU1ZjYxYjRhMy4uYmQ3N2M5MzNlYzkxYWFhYTBjZDFlYjk2NTY3ZDE5ZTFl NmIyNzcyNSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRl c3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDIxLTA5LTI2ICBBbnR0aSBLb2l2aXN0 byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBMaW5lIGl0ZXJhdG9yIGZpcnN0UnVuL2xh c3RSdW4gbWF5IHJldHVybiBydW5zIGZyb20gd3JvbmcgbGluZXMKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzMDc3MAorICAgICAgICA8cmRhcjovL3By b2JsZW0vODM1MDk3NTM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgKiBlZGl0aW5nL2l0ZXJhdG9yLWxpbmUtc3RhcnQtZW5kLWV4cGVjdGVkLnR4dDog QWRkZWQuCisgICAgICAgICogZWRpdGluZy9pdGVyYXRvci1saW5lLXN0YXJ0LWVuZC5odG1sOiBB ZGRlZC4KKwogMjAyMS0wOS0yNCAgQnJhbmRvbiBTdGV3YXJ0ICA8YnJhbmRvbnN0ZXdhcnRAYXBw bGUuY29tPgogCiAgICAgICAgIFtSZW5kZXJUcmVlVXBkYXRlcl0gTlVMTCBwdHIgZGVyZWYgaW4g dXBkYXRlUmVuZGVyVHJlZQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZWRpdGluZy9pdGVyYXRv ci1saW5lLXN0YXJ0LWVuZC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2l0ZXJh dG9yLWxpbmUtc3RhcnQtZW5kLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5jMDFlYTkzMTdjZmI1 NjVkZTQyZjQ5MzYwZjBmZDZiMjg3YWMwZjRmCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVz dHMvZWRpdGluZy9pdGVyYXRvci1saW5lLXN0YXJ0LWVuZC1leHBlY3RlZC50eHQKQEAgLTAsMCAr MSwzIEBACisKK1RoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lc24ndCBjcmFzaAoreHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHggeApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZWRpdGluZy9pdGVy YXRvci1saW5lLXN0YXJ0LWVuZC5odG1sIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9pdGVyYXRvci1s aW5lLXN0YXJ0LWVuZC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjI1YzE4MWVkMTQzZGE2Y2U4Y2E1MjYzNGQx NzM4ZTZjOGY5YWIzOTUKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2l0 ZXJhdG9yLWxpbmUtc3RhcnQtZW5kLmh0bWwKQEAgLTAsMCArMSw5IEBACis8aW1nIGFsaWduPSJy aWdodCIgaGVpZ2h0PSIxMDAiPgorPGRpdj5UaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXNuJ3Qg Y3Jhc2g8L2Rpdj4KKzxkaXY+eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHggeDwvZGl2PgorPHNj cmlwdD4KK2lmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQo KTsKKworZG9jdW1lbnQuZXhlY0NvbW1hbmQoInNlbGVjdEFsbCIpOworPC9zY3JpcHQ+Cg==