30150 2009-10-06 21:51:35 -0700 REGRESSION: Crash when accessing clipboardData.types 2009-10-13 15:03:13 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Mac OS X 10.6 RESOLVED FIXED InRadar P1 Critical --- 1 taiyoster ap oldest_to_newest 152945 0 taiyoster 2009-10-06 21:51:35 -0700 Accessing to clipboardData.types make WebKit.app (6531.9, r49209) to crash. -Reproduce 1. Assign following any website contains elements which is capable to be pasted. document.body.addEventListener("paste" , function(e){window.console.log(e.clipboardData.types)}, true) 2. Do "Paste" onto element 3. WebKit.app crashes. -Additional information This problem does not occur on Safari 4.0.3 (6531.9) 153071 1 40794 ap 2009-10-07 09:33:05 -0700 Created attachment 40794 test case (crash) #0 0x02205069 in WebCore::StringImpl::hash at StringImpl.h:112 #1 0x0220790d in WebCore::StringHash::hash at StringHash.h:70 #2 0x0220a69d in WTF::IdentityHashTranslator<WebCore::String, WebCore::String, WebCore::StringHash>::hash at HashTable.h:277 #3 0x020f10a5 in WTF::HashTable<WebCore::String, WebCore::String, WTF::IdentityExtractor<WebCore::String>, WebCore::StringHash, WTF::HashTraits<WebCore::String>, WTF::HashTraits<WebCore::String> >::add<WebCore::String, WebCore::String, WTF::IdentityHashTranslator<WebCore::String, WebCore::String, WebCore::StringHash> > at HashTable.h:634 #4 0x020f138a in WTF::HashTable<WebCore::String, WebCore::String, WTF::IdentityExtractor<WebCore::String>, WebCore::StringHash, WTF::HashTraits<WebCore::String>, WTF::HashTraits<WebCore::String> >::add at HashTable.h:315 #5 0x0222087e in WTF::HashSet<WebCore::String, WebCore::StringHash, WTF::HashTraits<WebCore::String> >::add at HashSet.h:210 #6 0x02140125 in WebCore::addHTMLClipboardTypesForCocoaType at ClipboardMac.mm:126 #7 0x021402e3 in WebCore::ClipboardMac::types at ClipboardMac.mm:285 #8 0x0253e92b in WebCore::JSClipboard::types at JSClipboardCustom.cpp:55 #9 0x0253d066 in WebCore::jsClipboardTypes at JSClipboard.cpp:182 #10 0x0098eaa7 in JSC::PropertySlot::getValue at PropertySlot.h:62 #11 0x009d6375 in JSC::JSValue::get at JSObject.h:610 #12 0x00a30f14 in cti_op_get_by_id at JITStubs.cpp:1203 #13 0x00a26fba in WTF::doubleHash at HashTable.h:437 #14 0x00a0696f in JSC::JITCode::execute at JITCode.h:79 #15 0x009f2975 in JSC::Interpreter::execute at Interpreter.cpp:724 #16 0x009584ed in JSC::JSFunction::call at JSFunction.cpp:120 #17 0x009585c9 in JSC::call at CallData.cpp:39 #18 0x025bb71c in WebCore::JSEventListener::handleEvent at JSEventListener.cpp:112 <...> 153073 2 ap 2009-10-07 09:35:07 -0700 <rdar://problem/7283540> 154447 3 41130 ap 2009-10-13 14:54:42 -0700 Created attachment 41130 proposed fix This was also causing crashes on drag&drop for me. 154451 4 ap 2009-10-13 15:03:13 -0700 Fixed in <http://trac.webkit.org/changeset/49513>. 40794 2009-10-07 09:33:05 -0700 2009-10-07 09:33:05 -0700 test case (crash) clipboardDataTypes.html text/html 247 ap PGJvZHk+CjxkaXYgY29udGVudGVkaXRhYmxlPlBhc3RlIHNvbWUgdGV4dCBoZXJlIGZvciBhIGNy YXNoLjwvZGl2Pgo8c2NyaXB0Pgpkb2N1bWVudC5ib2R5LmFkZEV2ZW50TGlzdGVuZXIoInBhc3Rl IiAsIGZ1bmN0aW9uKGUpe3dpbmRvdy5jb25zb2xlLmxvZyhlLmNsaXBib2FyZERhdGEudHlwZXMp fSwgdHJ1ZSkKZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoImRpdiIpWzBdLmZvY3VzKCk7 Cjwvc2NyaXB0Pgo8L2JvZHk+Cg== 41130 2009-10-13 14:54:42 -0700 2009-10-13 14:57:21 -0700 proposed fix 30150.txt text/plain 5117 ap SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA0OTUxMCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTYgQEAKKzIwMDktMTAtMTMgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBs ZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTMwMTUwCisgICAgICAgIFJF R1JFU1NJT046IENyYXNoIHdoZW4gYWNjZXNzaW5nIGNsaXBib2FyZERhdGEudHlwZXMKKworICAg ICAgICBUZXN0OiBlZGl0aW5nL3Bhc3RlYm9hcmQvY3Jhc2gtYWNjZXNzaW5nLWNsaXBib2FyZERh dGEtdHlwZXMuaHRtbAorCisgICAgICAgICogcGxhdGZvcm0vbWFjL0NsaXBib2FyZE1hYy5tbTog KFdlYkNvcmU6OmFkZEhUTUxDbGlwYm9hcmRUeXBlc0ZvckNvY29hVHlwZSk6IFRoZSBTdHJpbmcK KyAgICAgICAgY2xhc3MgZG9lc24ndCBoYXZlIG9wZXJhdG9yIGJvb2wsIGl0J3Mgb3BlcmF0b3Ig TlNTdHJpbmcqIHRoYXQgaXMgaW52b2tlZCBpbnN0ZWFkLCBhbmQgaXQKKyAgICAgICAgY29udmVy dHMgbnVsbCBzdHJpbmdzIHRvIG5vbi1udWxsIEAiIi4KKwogMjAwOS0xMC0xMyAgRHJldyBXaWxz b24gIDxhdHdpbHNvbkBhdHdpbHNvbi1tYWNwcm8ubG9jYWw+CiAKICAgICAgICAgUmV2aWV3ZWQg YnkgRGltaXRyaSBHbGF6a292LgpJbmRleDogV2ViQ29yZS9wbGF0Zm9ybS9tYWMvQ2xpcGJvYXJk TWFjLm1tCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvcGxhdGZvcm0vbWFjL0NsaXBib2FyZE1hYy5t bQkocmV2aXNpb24gNDk1MDUpCisrKyBXZWJDb3JlL3BsYXRmb3JtL21hYy9DbGlwYm9hcmRNYWMu bW0JKHdvcmtpbmcgY29weSkKQEAgLTEwNywxMSArMTA3LDE1IEBAIHN0YXRpYyBTdHJpbmcgdXRp VHlwZUZyb21Db2NvYVR5cGUoTlNTdHIKIHN0YXRpYyB2b2lkIGFkZEhUTUxDbGlwYm9hcmRUeXBl c0ZvckNvY29hVHlwZShIYXNoU2V0PFN0cmluZz4mIHJlc3VsdFR5cGVzLCBOU1N0cmluZyAqY29j b2FUeXBlLCBOU1Bhc3RlYm9hcmQgKnBhc3RlYm9hcmQpCiB7CiAgICAgLy8gVVRJIG1heSBub3Qg ZG8gdGhlc2UgcmlnaHQsIHNvIG1ha2Ugc3VyZSB3ZSBnZXQgdGhlIHJpZ2h0LCBwcmVkaWN0YWJs ZSByZXN1bHQKLSAgICBpZiAoW2NvY29hVHlwZSBpc0VxdWFsVG9TdHJpbmc6TlNTdHJpbmdQYm9h cmRUeXBlXSkKKyAgICBpZiAoW2NvY29hVHlwZSBpc0VxdWFsVG9TdHJpbmc6TlNTdHJpbmdQYm9h cmRUeXBlXSkgewogICAgICAgICByZXN1bHRUeXBlcy5hZGQoInRleHQvcGxhaW4iKTsKLSAgICBl bHNlIGlmIChbY29jb2FUeXBlIGlzRXF1YWxUb1N0cmluZzpOU1VSTFBib2FyZFR5cGVdKQorICAg ICAgICByZXR1cm47CisgICAgfQorICAgIGlmIChbY29jb2FUeXBlIGlzRXF1YWxUb1N0cmluZzpO U1VSTFBib2FyZFR5cGVdKSB7CiAgICAgICAgIHJlc3VsdFR5cGVzLmFkZCgidGV4dC91cmktbGlz dCIpOwotICAgIGVsc2UgaWYgKFtjb2NvYVR5cGUgaXNFcXVhbFRvU3RyaW5nOk5TRmlsZW5hbWVz UGJvYXJkVHlwZV0pIHsKKyAgICAgICAgcmV0dXJuOworICAgIH0KKyAgICBpZiAoW2NvY29hVHlw ZSBpc0VxdWFsVG9TdHJpbmc6TlNGaWxlbmFtZXNQYm9hcmRUeXBlXSkgewogICAgICAgICAvLyBJ ZiBmaWxlIGxpc3QgaXMgZW1wdHksIGFkZCBub3RoaW5nLgogICAgICAgICAvLyBOb3RlIHRoYXQg dGhlcmUgaXMgYSBjaGFuY2UgdGhhdCB0aGUgZmlsZSBsaXN0IGNvdW50IGNvdWxkIGhhdmUgY2hh bmdlZCBzaW5jZSB3ZSBncmFiYmVkIHRoZSB0eXBlcyBhcnJheS4KICAgICAgICAgLy8gSG93ZXZl ciwgdGhpcyBpcyBub3QgcmVhbGx5IGFuIGlzc3VlIGZvciB1cyBkb2luZyBhIHNhbml0eSBjaGVj ayBoZXJlLgpAQCAtMTIyLDEyICsxMjYsMTUgQEAgc3RhdGljIHZvaWQgYWRkSFRNTENsaXBib2Fy ZFR5cGVzRm9yQ29jbwogICAgICAgICAgICAgcmVzdWx0VHlwZXMuYWRkKCJ0ZXh0L3VyaS1saXN0 Iik7CiAgICAgICAgICAgICByZXN1bHRUeXBlcy5hZGQoIkZpbGVzIik7CiAgICAgICAgIH0KLSAg ICB9IGVsc2UgaWYgKFN0cmluZyB1dGlUeXBlID0gdXRpVHlwZUZyb21Db2NvYVR5cGUoY29jb2FU eXBlKSkKKyAgICAgICAgcmV0dXJuOworICAgIH0KKyAgICBTdHJpbmcgdXRpVHlwZSA9IHV0aVR5 cGVGcm9tQ29jb2FUeXBlKGNvY29hVHlwZSk7CisgICAgaWYgKCF1dGlUeXBlLmlzRW1wdHkoKSkg ewogICAgICAgICByZXN1bHRUeXBlcy5hZGQodXRpVHlwZSk7Ci0gICAgZWxzZSB7Ci0gICAgICAg IC8vIE5vIG1hcHBpbmcsIGp1c3QgcGFzcyB0aGUgd2hvbGUgc3RyaW5nIHRob3VnaAotICAgICAg ICByZXN1bHRUeXBlcy5hZGQoY29jb2FUeXBlKTsKKyAgICAgICAgcmV0dXJuOwogICAgIH0KKyAg ICAvLyBObyBtYXBwaW5nLCBqdXN0IHBhc3MgdGhlIHdob2xlIHN0cmluZyB0aG91Z2gKKyAgICBy ZXN1bHRUeXBlcy5hZGQoY29jb2FUeXBlKTsKIH0KIAogdm9pZCBDbGlwYm9hcmRNYWM6OmNsZWFy RGF0YShjb25zdCBTdHJpbmcmIHR5cGUpCkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiA0OTUxMCkKKysrIExh eW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDA5 LTEwLTEzICBBbGV4ZXkgUHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0zMDE1MAorICAgICAgICBSRUdSRVNTSU9OOiBDcmFzaCB3aGVu IGFjY2Vzc2luZyBjbGlwYm9hcmREYXRhLnR5cGVzCisKKyAgICAgICAgKiBlZGl0aW5nL3Bhc3Rl Ym9hcmQvY3Jhc2gtYWNjZXNzaW5nLWNsaXBib2FyZERhdGEtdHlwZXMtZXhwZWN0ZWQudHh0OiBB ZGRlZC4KKyAgICAgICAgKiBlZGl0aW5nL3Bhc3RlYm9hcmQvY3Jhc2gtYWNjZXNzaW5nLWNsaXBi b2FyZERhdGEtdHlwZXMuaHRtbDogQWRkZWQuCisKIDIwMDktMTAtMTMgIE1pY2hlbGFuZ2VsbyBE ZSBTaW1vbmUgIDxtaWNkZXNpbUBnbWFpbC5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgQWRh bSBCYXJ0aC4KSW5kZXg6IExheW91dFRlc3RzL2VkaXRpbmcvcGFzdGVib2FyZC9jcmFzaC1hY2Nl c3NpbmctY2xpcGJvYXJkRGF0YS10eXBlcy1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5 b3V0VGVzdHMvZWRpdGluZy9wYXN0ZWJvYXJkL2NyYXNoLWFjY2Vzc2luZy1jbGlwYm9hcmREYXRh LXR5cGVzLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2VkaXRpbmcv cGFzdGVib2FyZC9jcmFzaC1hY2Nlc3NpbmctY2xpcGJvYXJkRGF0YS10eXBlcy1leHBlY3RlZC50 eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNSBAQAorVGVzdCBmb3IgYnVnIDMwMTUwIENyYXNo IHdoZW4gYWNjZXNzaW5nIGNsaXBib2FyZERhdGEudHlwZXMKKworUEFTUyBpZiBkaWRuJ3QgY3Jh c2guCisKK1Rlc3QKClByb3BlcnR5IGNoYW5nZXMgb246IExheW91dFRlc3RzL2VkaXRpbmcvcGFz dGVib2FyZC9jcmFzaC1hY2Nlc3NpbmctY2xpcGJvYXJkRGF0YS10eXBlcy1leHBlY3RlZC50eHQK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXwpOYW1lOiBzdm46bWltZS10eXBlCiAgICsgdGV4dC9wbGFpbgpOYW1lOiBzdm46 ZW9sLXN0eWxlCiAgICsgbmF0aXZlCgpJbmRleDogTGF5b3V0VGVzdHMvZWRpdGluZy9wYXN0ZWJv YXJkL2NyYXNoLWFjY2Vzc2luZy1jbGlwYm9hcmREYXRhLXR5cGVzLmh0bWwKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvZWRpdGluZy9wYXN0ZWJvYXJkL2NyYXNoLWFjY2Vzc2luZy1jbGlwYm9h cmREYXRhLXR5cGVzLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9lZGl0aW5nL3Bh c3RlYm9hcmQvY3Jhc2gtYWNjZXNzaW5nLWNsaXBib2FyZERhdGEtdHlwZXMuaHRtbAkocmV2aXNp b24gMCkKQEAgLTAsMCArMSwxOSBAQAorPGJvZHk+CisKKzxwPlRlc3QgZm9yIDxhIGhyZWY9Imh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zMDE1MCI+YnVnIDMwMTUwPC9h PiBDcmFzaCB3aGVuIGFjY2Vzc2luZyBjbGlwYm9hcmREYXRhLnR5cGVzPC9wPgorPHA+UEFTUyBp ZiBkaWRuJ3QgY3Jhc2guPC9wPgorCis8ZGl2IGNvbnRlbnRlZGl0YWJsZSBpZD1kPlRlc3Q8L2Rp dj4KKworPHNjcmlwdD4KK2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgbGF5 b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworCitkb2N1bWVudC5ib2R5LmFkZEV2ZW50 TGlzdGVuZXIoInBhc3RlIiwgZnVuY3Rpb24oZSl7IGUuY2xpcGJvYXJkRGF0YS50eXBlcyB9LCB0 cnVlKTsKKworZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImQiKS5mb2N1cygpOworZG9jdW1lbnQu ZXhlY0NvbW1hbmQoIkN1dCIpOworZG9jdW1lbnQuZXhlY0NvbW1hbmQoIlBhc3RlIik7CisKKzwv c2NyaXB0PgorPC9ib2R5PgoKUHJvcGVydHkgY2hhbmdlcyBvbjogTGF5b3V0VGVzdHMvZWRpdGlu Zy9wYXN0ZWJvYXJkL2NyYXNoLWFjY2Vzc2luZy1jbGlwYm9hcmREYXRhLXR5cGVzLmh0bWwKX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpOYW1lOiBzdm46bWltZS10eXBlCiAgICsgdGV4dC9odG1sCgo=