254798 2023-03-30 23:41:56 -0700 AXObjectCache::characterOffsetFromVisiblePosition can deref a nullptr when underlying renderer is destroyed 2023-03-31 11:58:17 -0700 1 1 1 Unclassified WebKit Accessibility Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 tyler_w tyler_w aboxhall andresg_22 apinheiro cfleizach dmazzoni ews-watchlist jcraig jdiggs samuel_white webkit-bug-importer oldest_to_newest 1945609 0 tyler_w 2023-03-30 23:41:56 -0700 AXObjectCache::characterOffsetFromVisiblePosition creates an AX object from the node backing a VisiblePosition at the beginning of the method. Then, it does non-trivial work that could cause the renderer backing the AX object to be destroyed, and afterwards unconditionally deferences that AX object's node() at the end of the method. This can cause a null pointer dereference crash (because AccessibilityRenderObject::node() depends on a non-null renderer), and is generally poor pointer hygiene. 1945610 1 webkit-bug-importer 2023-03-30 23:42:08 -0700 <rdar://problem/107459184> 1945611 2 tyler_w 2023-03-30 23:42:54 -0700 rdar://103456792 1945613 3 465696 tyler_w 2023-03-30 23:47:09 -0700 Created attachment 465696 Patch 1945748 4 cfleizach 2023-03-31 10:46:43 -0700 Do we still want to check that this is NOT null first? deepPos.deprecatedNode(); 1945756 5 tyler_w 2023-03-31 10:56:30 -0700 (In reply to chris fleizach from comment #4) > Do we still want to check that this is NOT null first? > > deepPos.deprecatedNode(); We should be safe because if `deepPos.deprecatedNode()` were null, this check just above dereferencing it would return: if (visiblePos.isNull()) return CharacterOffset(); 1945797 6 ews-feeder 2023-03-31 11:58:15 -0700 Committed 262432@main (7d93b07962d5): <https://commits.webkit.org/262432@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 465696. 465696 2023-03-30 23:47:09 -0700 2023-03-31 11:58:16 -0700 Patch bug-254798-20230330234708.patch text/plain 3266 tyler_w RnJvbSA0ZWQ5N2UyZGM3MDUzZGRlZjliZjc0ZWRkMjViYzgxMDYyNGY2OGNiIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBUeWxlciBXaWxjb2NrIDx0eWxlcl93QGFwcGxlLmNvbT4KRGF0 ZTogVGh1LCAzMCBNYXIgMjAyMyAyMzo0MjoyMSAtMDcwMApTdWJqZWN0OiBbUEFUQ0hdIEFYT2Jq ZWN0Q2FjaGU6OmNoYXJhY3Rlck9mZnNldEZyb21WaXNpYmxlUG9zaXRpb24gY2FuIGRlcmVmIGEK IG51bGxwdHIgd2hlbiB1bmRlcmx5aW5nIHJlbmRlcmVyIGlzIGRlc3Ryb3llZAogaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTI1NDc5OCByZGFyOi8vMTAzNDU2NzkyCgpS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KCkFYT2JqZWN0Q2FjaGU6OmNoYXJhY3Rlck9mZnNl dEZyb21WaXNpYmxlUG9zaXRpb24gY3JlYXRlcyBhbiBBWCBvYmplY3QgZnJvbSB0aGUgbm9kZSBi YWNraW5nIGEgVmlzaWJsZVBvc2l0aW9uCmF0IHRoZSBiZWdpbm5pbmcgb2YgdGhlIG1ldGhvZC4g VGhlbiwgaXQgZG9lcyBub24tdHJpdmlhbCB3b3JrIHRoYXQgY291bGQgY2F1c2UgdGhlIHJlbmRl cmVyIGJhY2tpbmcgdGhlIEFYIG9iamVjdAp0byBiZSBkZXN0cm95ZWQsIGFuZCBhZnRlcndhcmRz IHVuY29uZGl0aW9uYWxseSBkZWZlcmVuY2VzIHRoYXQgQVggb2JqZWN0J3Mgbm9kZSgpIGF0IHRo ZSBlbmQgb2YgdGhlIG1ldGhvZC4gVGhpcwpjYW4gY2F1c2UgYSBudWxsIHBvaW50ZXIgZGVyZWZl cmVuY2UgY3Jhc2ggKGJlY2F1c2UgQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdDo6bm9kZSgpIGRl cGVuZHMgb24gYSBub24tbnVsbCByZW5kZXJlciksCmFuZCBpcyBnZW5lcmFsbHkgcG9vciBwb2lu dGVyIGh5Z2llbmUuCgpXaXRoIHRoaXMgcGF0Y2gsIHdlIG5vdyBrZWVwIHRoZSBWaXNpYmxlUG9z aXRpb24ncyBub2RlIGluIGEgYFJlZjxOb2RlPmAgYW5kIHJlLXVzZSBpdCBhdCB0aGUgZW5kIG9m IHRoZSBtZXRob2QgdG8gcHJldmVudCBhIGNyYXNoLgoKSSBjb3VsZCBub3QgcmVwcm9kdWNlIHRo aXMgY3Jhc2ggbXlzZWxmIGluIHRoZSBicm93c2VyIG9yIGluIGEgdGVzdGNhc2UsIHNvIHRoaXMg aXMgYSBzcGVjdWxhdGl2ZSBmaXggYmFzZWQgb24gY3Jhc2ggcmVwb3J0cy4KCiogU291cmNlL1dl YkNvcmUvYWNjZXNzaWJpbGl0eS9BWE9iamVjdENhY2hlLmNwcDoKKFdlYkNvcmU6OkFYT2JqZWN0 Q2FjaGU6OmNoYXJhY3Rlck9mZnNldEZyb21WaXNpYmxlUG9zaXRpb24pOgotLS0KIFNvdXJjZS9X ZWJDb3JlL2FjY2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHAgfCAxNCArKysrKysrLS0tLS0t LQogMSBmaWxlIGNoYW5nZWQsIDcgaW5zZXJ0aW9ucygrKSwgNyBkZWxldGlvbnMoLSkKCmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FYT2JqZWN0Q2FjaGUuY3BwIGIv U291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BWE9iamVjdENhY2hlLmNwcAppbmRleCA5ZDhj NTYyOTI3MWQuLmVmNGE5ZDJmMjVhZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNz aWJpbGl0eS9BWE9iamVjdENhY2hlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmls aXR5L0FYT2JqZWN0Q2FjaGUuY3BwCkBAIC0yNzQyLDEzICsyNzQyLDEzIEBAIENoYXJhY3Rlck9m ZnNldCBBWE9iamVjdENhY2hlOjpjaGFyYWN0ZXJPZmZzZXRGcm9tVmlzaWJsZVBvc2l0aW9uKGNv bnN0IFZpc2libGVQCiAgICAgICAgIHJldHVybiBDaGFyYWN0ZXJPZmZzZXQoKTsKICAgICAKICAg ICBQb3NpdGlvbiBkZWVwUG9zID0gdmlzaWJsZVBvcy5kZWVwRXF1aXZhbGVudCgpOwotICAgIE5v ZGUqIGRvbU5vZGUgPSBkZWVwUG9zLmRlcHJlY2F0ZWROb2RlKCk7Ci0gICAgQVNTRVJUKGRvbU5v ZGUpOwotICAgIAotICAgIGlmIChkb21Ob2RlLT5pc0NoYXJhY3RlckRhdGFOb2RlKCkpCi0gICAg ICAgIHJldHVybiB0cmF2ZXJzZVRvT2Zmc2V0SW5SYW5nZShyYW5nZUZvck5vZGVDb250ZW50cygq ZG9tTm9kZSksIGRlZXBQb3MuZGVwcmVjYXRlZEVkaXRpbmdPZmZzZXQoKSwgVHJhdmVyc2VPcHRp b25WYWxpZGF0ZU9mZnNldCk7CisgICAgLy8gRGVyZWZlcmVuY2luZyBkZXByZWNhdGVkTm9kZSBp cyBzYWZlIGJlY2F1c2UgVmlzaWJsZVBvc2l0aW9uOjppc051bGwgcmV0dXJucyB0cnVlIGlmIHRo ZSBkZWVwRXF1aXZhbGVudCBwb3NpdGlvbiBoYXMgYSBudWxsIG5vZGUuCisgICAgUmVmIG5vZGUg PSAqZGVlcFBvcy5kZXByZWNhdGVkTm9kZSgpOworCisgICAgaWYgKG5vZGUtPmlzQ2hhcmFjdGVy RGF0YU5vZGUoKSkKKyAgICAgICAgcmV0dXJuIHRyYXZlcnNlVG9PZmZzZXRJblJhbmdlKHJhbmdl Rm9yTm9kZUNvbnRlbnRzKG5vZGUuZ2V0KCkpLCBkZWVwUG9zLmRlcHJlY2F0ZWRFZGl0aW5nT2Zm c2V0KCksIFRyYXZlcnNlT3B0aW9uVmFsaWRhdGVPZmZzZXQpOwogICAgIAotICAgIFJlZlB0cjxB Y2Nlc3NpYmlsaXR5T2JqZWN0PiBvYmogPSB0aGlzLT5nZXRPckNyZWF0ZShkb21Ob2RlKTsKKyAg ICBSZWZQdHI8QWNjZXNzaWJpbGl0eU9iamVjdD4gb2JqID0gdGhpcy0+Z2V0T3JDcmVhdGUobm9k ZS5wdHIoKSk7CiAgICAgaWYgKCFvYmopCiAgICAgICAgIHJldHVybiBDaGFyYWN0ZXJPZmZzZXQo KTsKICAgICAKQEAgLTI3ODMsNyArMjc4Myw3IEBAIENoYXJhY3Rlck9mZnNldCBBWE9iamVjdENh Y2hlOjpjaGFyYWN0ZXJPZmZzZXRGcm9tVmlzaWJsZVBvc2l0aW9uKGNvbnN0IFZpc2libGVQCiAg ICAgfQogICAgIAogICAgIC8vIFNvbWV0aW1lcyB3aGVuIHRoZSBub2RlIGlzIGEgcmVwbGFjZWQg bm9kZSBhbmQgaXMgaWdub3JlZCBpbiBhY2Nlc3NpYmlsaXR5LCB3ZSBnZXQgYSB3cm9uZyBDaGFy YWN0ZXJPZmZzZXQgZnJvbSBpdC4KLSAgICBDaGFyYWN0ZXJPZmZzZXQgcmVzdWx0ID0gdHJhdmVy c2VUb09mZnNldEluUmFuZ2UocmFuZ2VGb3JOb2RlQ29udGVudHMoKm9iai0+bm9kZSgpKSwgY2hh cmFjdGVyT2Zmc2V0KTsKKyAgICBDaGFyYWN0ZXJPZmZzZXQgcmVzdWx0ID0gdHJhdmVyc2VUb09m ZnNldEluUmFuZ2UocmFuZ2VGb3JOb2RlQ29udGVudHMobm9kZS5nZXQoKSksIGNoYXJhY3Rlck9m ZnNldCk7CiAgICAgaWYgKHJlc3VsdC5yZW1haW5pbmdPZmZzZXQgPiAwICYmICFyZXN1bHQuaXNO dWxsKCkgJiYgaXNSZW5kZXJlclJlcGxhY2VkRWxlbWVudChyZXN1bHQubm9kZS0+cmVuZGVyZXIo KSkpCiAgICAgICAgIHJlc3VsdC5vZmZzZXQgKz0gcmVzdWx0LnJlbWFpbmluZ09mZnNldDsKICAg ICByZXR1cm4gcmVzdWx0Owo=