24172 2009-02-25 14:21:54 -0800 Reproducible crash in CSSParser::parseFillImage copying contents of this page 2009-02-25 14:59:16 -0800 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED HasReduction, InRadar, Regression P2 Normal --- 1 bdakin bdakin oldest_to_newest 111037 0 bdakin 2009-02-25 14:21:54 -0800 Thread 0 Crashed (i386): >#0 com.apple.WebCore 0x00e30235 WebCore::CSSParser::parseFillImage(WTF::RefPtr<WebCore::CSSValue>&) + 437 #1 com.apple.WebCore 0x00e30d8f WebCore::CSSParser::parseFillProperty(int, int&, int&, WTF::RefPtr<WebCore::CSSValue>&, WTF::RefPtr<WebCore::CSSValue>&) + 2575 #2 com.apple.WebCore 0x00e34b2c WebCore::CSSParser::parseValue(int, bool) + 7724 #3 com.apple.WebCore 0x00e1a809 cssyyparse(void*) + 12953 #4 com.apple.WebCore 0x00e2aa09 WebCore::CSSParser::parseValue(WebCore::CSSMutableStyleDeclaration*, int, WebCore::String const&, bool) + 89 #5 com.apple.WebCore 0x00e218c5 WebCore::CSSMutableStyleDeclaration::setProperty(int, WebCore::String const&, bool, bool) + 213 #6 com.apple.WebCore 0x014d0806 WebCore::createMarkup(WebCore::Range const*, WTF::Vector<WebCore::Node*, 0ul>*, WebCore::EAnnotateForInterchange, bool) + 7862 #7 com.apple.WebCore 0x0127ee37 WebCore::LegacyWebArchive::createFromSelection(WebCore::Frame*) + 135 #8 com.apple.WebCore 0x012be382 WebCore::Pasteboard::writeSelection(NSPasteboard*, WebCore::Range*, bool, WebCore::Frame*) + 1442 #9 com.apple.WebCore 0x00f96281 WebCore::Editor::copy() + 273 #10 com.apple.WebCore 0x00f9e879 __ZN7WebCoreL11executeCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE + 25 #11 com.apple.WebCore 0x00f9d48e WebCore::Editor::Command::execute(WebCore::String const&, WebCore::Event*) const + 142 #12 com.apple.WebKit 0x001c3cd1 -[WebHTMLView executeCoreCommandBySelector:] + 129 #13 com.apple.AppKit 0x9695cb03 -[NSApplication sendAction:to:from:] + 112 #14 com.apple.Safari 0x0002d458 -[BrowserApplication sendAction:to:from:] (/SourceCache/WebBrowser/WebBrowser-5525.20.1/mac/BrowserApplication.m:90) #15 com.apple.AppKit 0x96a0b540 -[NSMenu performActionForItemAtIndex:] + 493 #16 com.apple.AppKit 0x96a0b245 -[NSCarbonMenuImpl performActionWithHighlightingForItemAtIndex:] + 220 #17 com.apple.AppKit 0x96a0aecb -[NSMenu performKeyEquivalent:] + 866 #18 com.apple.AppKit 0x96a09770 -[NSApplication _handleKeyEquivalent:] + 492 #19 com.apple.AppKit 0x96926733 -[NSApplication sendEvent:] + 3999 #20 com.apple.Safari 0x0002b5d8 -[BrowserApplication sendEvent:] (/SourceCache/WebBrowser/WebBrowser-5525.20.1/mac/BrowserApplication.m:143) #21 com.apple.AppKit 0x96883d0f -[NSApplication run] + 847 #22 com.apple.AppKit 0x96850f14 NSApplicationMain + 574 #23 com.apple.Safari 0x000ba4d6 start 111038 1 27984 bdakin 2009-02-25 14:23:48 -0800 Created attachment 27984 Reduction Here is a reduction. To reproduce the crash, load the page in tip of tree WebKit. Press Command-A to select all. Press Command-C to copy. Then you should crash. This is clearly a null-dereference. I am going to upload a null-check patch momentarily. 111043 2 27987 bdakin 2009-02-25 14:49:28 -0800 Created attachment 27987 Null-Check Patch 111044 3 bdakin 2009-02-25 14:50:24 -0800 This is in Radar as <rdar://problem/6487249> 111046 4 27988 bdakin 2009-02-25 14:52:53 -0800 Created attachment 27988 Null-Check Patch with ChangLogs Oops, forgot a layout tests changelog. 111047 5 27988 darin 2009-02-25 14:54:29 -0800 Comment on attachment 27988 Null-Check Patch with ChangLogs r=me 111048 6 bdakin 2009-02-25 14:59:16 -0800 Thanks Darin! Fixed with revision 41231. 27984 2009-02-25 14:23:48 -0800 2009-02-25 14:23:48 -0800 Reduction crashy.html text/html 24 bdakin PGJvZHkgYmFja2dyb3VuZD4KaGVsbG8K 27987 2009-02-25 14:49:28 -0800 2009-02-25 14:52:53 -0800 Null-Check Patch forReview.txt text/plain 2213 bdakin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA0MTIzMCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTQgQEAKKzIwMDktMDItMjUgIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBm b3IgPHJkYXI6Ly9wcm9ibGVtLzY0ODcyNDk+IHJlcHJvIGNyYXNoIGluIAorICAgICAgICBXZWJD b3JlOjpDU1NQYXJzZXI6OnBhcnNlRmlsbEltYWdlIGNvcHlpbmcgZW50aXJlIGNvbnRlbnRzIG9m IHRoaXMgCisgICAgICAgIHBhZ2UKKworICAgICAgICAqIGNzcy9DU1NQYXJzZXIuY3BwOgorICAg ICAgICAoV2ViQ29yZTo6Q1NTUGFyc2VyOjpwYXJzZVZhbHVlKTogTnVsbC1jaGVjayBtX3N0eWxl U2hlZXQKKwogMjAwOS0wMi0yNSAgQWRhbSBUcmVhdCAgPGFkYW0udHJlYXRAdG9yY2htb2JpbGUu Y29tPgogCiAgICAgICAgIEZpeCB0aGUgUXQgYnVpbGQuCkluZGV4OiBXZWJDb3JlL2Nzcy9DU1NQ YXJzZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvY3NzL0NTU1BhcnNlci5jcHAJKHJldmlz aW9uIDQxMjIzKQorKysgV2ViQ29yZS9jc3MvQ1NTUGFyc2VyLmNwcAkod29ya2luZyBjb3B5KQpA QCAtNTM0LDYgKzUzNCw5IEBAIGJvb2wgQ1NTUGFyc2VyOjpwYXJzZVZhbHVlKGludCBwcm9wSWQs IGIKICAgICBpZiAoIXZhbHVlKQogICAgICAgICByZXR1cm4gZmFsc2U7CiAKKyAgICBpZiAoIW1f c3R5bGVTaGVldCkKKyAgICAgICAgcmV0dXJuIGZhbHNlOworCiAgICAgaW50IGlkID0gdmFsdWUt PmlkOwogCiAgICAgLy8gSW4gcXVpcmtzIG1vZGUsIHdlIHdpbGwgbG9vayBmb3IgdW5pdHMgdGhh dCBoYXZlIGJlZW4gaW5jb3JyZWN0bHkgc2VwYXJhdGVkIGZyb20gdGhlIG51bWJlciB0aGV5IGJl bG9uZyB0bwpJbmRleDogTGF5b3V0VGVzdHMvZWRpdGluZy9wYXN0ZWJvYXJkL2NvcHktY3Jhc2gt d2l0aC1leHRyYW5lb3VzLWF0dHJpYnV0ZS1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5 b3V0VGVzdHMvZWRpdGluZy9wYXN0ZWJvYXJkL2NvcHktY3Jhc2gtd2l0aC1leHRyYW5lb3VzLWF0 dHJpYnV0ZS1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9lZGl0aW5n L3Bhc3RlYm9hcmQvY29weS1jcmFzaC13aXRoLWV4dHJhbmVvdXMtYXR0cmlidXRlLWV4cGVjdGVk LnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSBAQAorVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBk b2VzIG5vdCBjcmFzaC4KSW5kZXg6IExheW91dFRlc3RzL2VkaXRpbmcvcGFzdGVib2FyZC9jb3B5 LWNyYXNoLXdpdGgtZXh0cmFuZW91cy1hdHRyaWJ1dGUuaHRtbAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlv dXRUZXN0cy9lZGl0aW5nL3Bhc3RlYm9hcmQvY29weS1jcmFzaC13aXRoLWV4dHJhbmVvdXMtYXR0 cmlidXRlLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9lZGl0aW5nL3Bhc3RlYm9h cmQvY29weS1jcmFzaC13aXRoLWV4dHJhbmVvdXMtYXR0cmlidXRlLmh0bWwJKHJldmlzaW9uIDAp CkBAIC0wLDAgKzEsMTggQEAKKzxodG1sPgorPGhlYWQ+CisgICAgPHNjcmlwdCBzcmM9Li4vZWRp dGluZy5qcyBsYW5ndWFnZT0iSmF2YVNjcmlwdCIgdHlwZT0idGV4dC9KYXZhU2NyaXB0IiA+PC9z Y3JpcHQ+CisgICAgPHNjcmlwdD4KKyAgICAgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJv bGxlcikKKyAgICAgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAg ICA8L3NjcmlwdD4KKzwvaGVhZD4KKworPGJvZHkgYmFja2dyb3VuZD4KK1RoaXMgdGVzdCBwYXNz ZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guCisKKzxzY3JpcHQ+CisgICAgc2VsZWN0QWxsQ29tbWFu ZCgpOworICAgIGNvcHlDb21tYW5kKCk7Cis8L3NjcmlwdD4KKworPC9odG1sPgo= 27988 2009-02-25 14:52:53 -0800 2009-02-25 14:54:29 -0800 Null-Check Patch with ChangLogs forReview.txt text/plain 3052 bdakin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA0MTIzMCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMDktMDItMjUgIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBm b3IgPHJkYXI6Ly9wcm9ibGVtLzY0ODcyNDk+IHJlcHJvIGNyYXNoIGluIAorICAgICAgICBXZWJD b3JlOjpDU1NQYXJzZXI6OnBhcnNlRmlsbEltYWdlIGNvcHlpbmcgZW50aXJlIGNvbnRlbnRzIG9m IHRoaXMgCisgICAgICAgIHBhZ2UKKyAgICAgICAgLWFuZCBjb3JyZXNwb25kaW5nOiBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjQxNzIKKworICAgICAgICAqIGNzcy9D U1NQYXJzZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Q1NTUGFyc2VyOjpwYXJzZVZhbHVlKTog TnVsbC1jaGVjayBtX3N0eWxlU2hlZXQKKwogMjAwOS0wMi0yNSAgQWRhbSBUcmVhdCAgPGFkYW0u dHJlYXRAdG9yY2htb2JpbGUuY29tPgogCiAgICAgICAgIEZpeCB0aGUgUXQgYnVpbGQuCkluZGV4 OiBXZWJDb3JlL2Nzcy9DU1NQYXJzZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvY3NzL0NT U1BhcnNlci5jcHAJKHJldmlzaW9uIDQxMjIzKQorKysgV2ViQ29yZS9jc3MvQ1NTUGFyc2VyLmNw cAkod29ya2luZyBjb3B5KQpAQCAtNTM0LDYgKzUzNCw5IEBAIGJvb2wgQ1NTUGFyc2VyOjpwYXJz ZVZhbHVlKGludCBwcm9wSWQsIGIKICAgICBpZiAoIXZhbHVlKQogICAgICAgICByZXR1cm4gZmFs c2U7CiAKKyAgICBpZiAoIW1fc3R5bGVTaGVldCkKKyAgICAgICAgcmV0dXJuIGZhbHNlOworCiAg ICAgaW50IGlkID0gdmFsdWUtPmlkOwogCiAgICAgLy8gSW4gcXVpcmtzIG1vZGUsIHdlIHdpbGwg bG9vayBmb3IgdW5pdHMgdGhhdCBoYXZlIGJlZW4gaW5jb3JyZWN0bHkgc2VwYXJhdGVkIGZyb20g dGhlIG51bWJlciB0aGV5IGJlbG9uZyB0bwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gNDEyMzApCisrKyBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNSBAQAorMjAw OS0wMi0yNSAgQmV0aCBEYWtpbiAgPGJkYWtpbkBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdCBmb3IgPHJkYXI6Ly9wcm9ibGVt LzY0ODcyNDk+IHJlcHJvIGNyYXNoIGluIAorICAgICAgICBXZWJDb3JlOjpDU1NQYXJzZXI6OnBh cnNlRmlsbEltYWdlIGNvcHlpbmcgZW50aXJlIGNvbnRlbnRzIG9mIHRoaXMgCisgICAgICAgIHBh Z2UKKyAgICAgICAgLWFuZCBjb3JyZXNwb25kaW5nOiBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MjQxNzIKKworICAgICAgICAqIGVkaXRpbmcvcGFzdGVib2FyZC9jb3B5 LWNyYXNoLXdpdGgtZXh0cmFuZW91cy1hdHRyaWJ1dGUtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAg ICAgICAgKiBlZGl0aW5nL3Bhc3RlYm9hcmQvY29weS1jcmFzaC13aXRoLWV4dHJhbmVvdXMtYXR0 cmlidXRlLmh0bWw6IEFkZGVkLgorCiAyMDA5LTAyLTI1ICBDaHJpcyBNYXJyaW4gIDxjbWFycmlu QGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBTaW1vbiBGcmFzZXIuCkluZGV4OiBM YXlvdXRUZXN0cy9lZGl0aW5nL3Bhc3RlYm9hcmQvY29weS1jcmFzaC13aXRoLWV4dHJhbmVvdXMt YXR0cmlidXRlLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9lZGl0aW5n L3Bhc3RlYm9hcmQvY29weS1jcmFzaC13aXRoLWV4dHJhbmVvdXMtYXR0cmlidXRlLWV4cGVjdGVk LnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2VkaXRpbmcvcGFzdGVib2FyZC9jb3B5 LWNyYXNoLXdpdGgtZXh0cmFuZW91cy1hdHRyaWJ1dGUtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAw KQpAQCAtMCwwICsxIEBACitUaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLgpJ bmRleDogTGF5b3V0VGVzdHMvZWRpdGluZy9wYXN0ZWJvYXJkL2NvcHktY3Jhc2gtd2l0aC1leHRy YW5lb3VzLWF0dHJpYnV0ZS5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2VkaXRpbmcv cGFzdGVib2FyZC9jb3B5LWNyYXNoLXdpdGgtZXh0cmFuZW91cy1hdHRyaWJ1dGUuaHRtbAkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL2VkaXRpbmcvcGFzdGVib2FyZC9jb3B5LWNyYXNoLXdp dGgtZXh0cmFuZW91cy1hdHRyaWJ1dGUuaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxOCBA QAorPGh0bWw+Cis8aGVhZD4KKyAgICA8c2NyaXB0IHNyYz0uLi9lZGl0aW5nLmpzIGxhbmd1YWdl PSJKYXZhU2NyaXB0IiB0eXBlPSJ0ZXh0L0phdmFTY3JpcHQiID48L3NjcmlwdD4KKyAgICA8c2Ny aXB0PgorICAgICAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgICAgICAg ICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAgIDwvc2NyaXB0PgorPC9o ZWFkPgorCis8Ym9keSBiYWNrZ3JvdW5kPgorVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5v dCBjcmFzaC4KKworPHNjcmlwdD4KKyAgICBzZWxlY3RBbGxDb21tYW5kKCk7CisgICAgY29weUNv bW1hbmQoKTsKKzwvc2NyaXB0PgorCis8L2h0bWw+Cg==