31658 2009-11-18 19:17:05 -0800 webkit_web_view_load_string() crash 2009-12-08 06:27:45 -0800 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) PC Linux RESOLVED FIXED P2 Major --- 1 bunk webkit-unassigned gustavo oldest_to_newest 164881 0 43478 bunk 2009-11-18 19:17:05 -0800 Created attachment 43478 test program Download and compile the test program, and click twice on "Next Step". Notes: - this bug is a serious problem for Liferea users - the small example is not complete HTML, but the actual bug is with a complete XHTML file - as seen in the test program, the same HTML is accepted in webkit_web_view_load_uri() - tested on amd64 with 1.1.16 and latest SVN trunk - --disable-jit does not help $ gcc -g -O2 -Wall test-webkit-crash.c -o test-webkit-crash `pkg-config --cflags --libs gtk+-2.0 webkit-1.0` $ ./test-webkit-crash #0 0x00007f1fa2c9b4dd in __libc_waitpid (pid=12738, stat_loc=<value optimized out>, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:41 #1 0x00007f1fa2f69ed7 in IA__g_on_error_stack_trace (prg_name=0x40119e "test-webkit-crash") at /tmp/buildd/glib2.0-2.22.2/glib/gbacktrace.c:187 #2 0x0000000000400fbe in fatal_signal_handler (sig=<value optimized out>) at test-webkit-crash.c:36 #3 <signal handler called> #4 IA__g_str_hash (v=0x0) at /tmp/buildd/glib2.0-2.22.2/glib/gstring.c:99 #5 0x00007f1fa2f7e28f in g_hash_table_lookup_node (hash_table=0x20ea770, key=0x0) at /tmp/buildd/glib2.0-2.22.2/glib/ghash.c:195 #6 IA__g_hash_table_lookup (hash_table=0x20ea770, key=0x0) at /tmp/buildd/glib2.0-2.22.2/glib/ghash.c:784 #7 0x00007f1fa504c334 in soup_cookie_jar_add_cookie (jar=0x20be360, cookie=0x2118760) at soup-cookie-jar.c:345 #8 0x00007f1fa62bf409 in WebCore::setCookies (url=<value optimized out>, value=...) at WebCore/platform/network/soup/CookieJarSoup.cpp:65 #9 0x00007f1fa5d9d10e in WebCore::Document::setCookie (this=0x7f1f99f74400, value=...) at WebCore/dom/Document.cpp:3016 #10 0x00007f1fa633610d in WebCore::setJSDocumentCookie (exec=<value optimized out>, thisObject=<value optimized out>, value=<value optimized out>) at DerivedSources/JSDocument.cpp:1070 #11 0x00007f1fa633cc79 in lookupPut<WebCore::JSDocument> (this=0x7f1f95cd0240, exec=0x7f1f9674d2b8, propertyName=..., value=..., slot=...) at ./JavaScriptCore/runtime/Lookup.h:303 #12 lookupPut<WebCore::JSDocument, WebCore::JSNode> (this=0x7f1f95cd0240, exec=0x7f1f9674d2b8, propertyName=..., value=..., slot=...) at ./JavaScriptCore/runtime/Lookup.h:317 #13 WebCore::JSDocument::put (this=0x7f1f95cd0240, exec=0x7f1f9674d2b8, propertyName=..., value=..., slot=...) at DerivedSources/JSDocument.cpp:1028 #14 0x00007f1fa63c56ca in lookupPut<WebCore::JSHTMLDocument, WebCore::JSDocument> (this=0x7f1f95cd0240, exec=0x7f1f9674d2b8, propertyName=..., value=<value optimized out>, slot=...) at ./JavaScriptCore/runtime/Lookup.h:318 #15 WebCore::JSHTMLDocument::put (this=0x7f1f95cd0240, exec=0x7f1f9674d2b8, propertyName=..., value=<value optimized out>, slot=...) at DerivedSources/JSHTMLDocument.cpp:315 #16 0x00007f1fa5b95f5f in JSC::JSValue::put (this=0x7fff5281ae20, flag=<value optimized out>, registerFile=<value optimized out>, callFrame=0x7f1f9674d2b8, exception=<value optimized out>) at ./JavaScriptCore/runtime/JSObject.h:656 #17 JSC::Interpreter::privateExecute (this=0x7fff5281ae20, flag=<value optimized out>, registerFile=<value optimized out>, callFrame=0x7f1f9674d2b8, exception=<value optimized out>) at JavaScriptCore/interpreter/Interpreter.cpp:2294 #18 0x00007f1fa5ba0940 in JSC::Interpreter::execute (this=0x7f1f99f98680, functionExecutable=<value optimized out>, callFrame=0x7f1f9a002748, function=0x7f1f95cd1400, thisObj=<value optimized out>, args=<value optimized out>, scopeChain=0x7f1f95c86cf0, exc#19 0x00007f1fa5c2b6a7 in JSC::JSFunction::call (this=0x7f1f95cd1400, exec=0x7f1f9a002748, thisValue=..., args=...) at JavaScriptCore/runtime/JSFunction.cpp:120 #20 0x00007f1fa5c0ea80 in JSC::call (exec=0x2, functionObject=..., callType=<value optimized out>, callData=..., thisValue=..., args=...) at JavaScriptCore/runtime/CallData.cpp:39 #21 0x00007f1fa5caae29 in WebCore::callInWorld (exec=0x7f1f9a002748, function=..., callType=JSC::CallTypeJS, callData=..., thisValue=<value optimized out>, args=<value optimized out>, isolatedWorld=0x7f1f99fa4f80) at WebCore/bindings/js/JSDOMBinding.cpp:83#22 0x00007f1fa5cc2794 in WebCore::JSEventListener::handleEvent (this=0x7f1f95c192a8, scriptExecutionContext=0x7f1f99f74458, event=<value optimized out>) at WebCore/bindings/js/JSEventListener.cpp:118 #23 0x00007f1fa5db8a37 in WebCore::EventTarget::fireEventListeners (this=0x7f1f99f74400, event=0x7f1f95c24120) at WebCore/dom/EventTarget.cpp:297 #24 0x00007f1fa5dc7375 in WebCore::Node::dispatchGenericEvent (this=0x7f1f99f74400, prpEvent=<value optimized out>) at WebCore/dom/Node.cpp:2523 #25 0x00007f1fa5dc7901 in WebCore::Node::dispatchEvent (this=0x7f1f99f74400, prpEvent=<value optimized out>) at WebCore/dom/Node.cpp:2446 #26 0x00007f1fa5d96414 in WebCore::Document::finishedParsing (this=0x7f1f99f74400) at WebCore/dom/Document.cpp:4036 #27 0x00007f1fa5ed5dec in WebCore::HTMLTokenizer::end (this=0x7f1f95bfb800) at WebCore/html/HTMLTokenizer.cpp:1863 #28 0x00007f1fa5edeeb9 in WebCore::HTMLTokenizer::finish (this=0x7f1f95bfb800) at WebCore/html/HTMLTokenizer.cpp:1903 #29 0x00007f1fa5f39447 in WebCore::FrameLoader::endIfNotLoadingMainResource (this=0x7f1f99f4f850) at WebCore/loader/FrameLoader.cpp:949 #30 0x00007f1fa5f35bd8 in WebCore::FrameLoader::finishedLoading (this=0x7f1f99f4f850) at WebCore/loader/FrameLoader.cpp:2699 #31 0x00007f1fa5f4a61f in WebCore::MainResourceLoader::didFinishLoading (this=0x7f1f99f98b00) at WebCore/loader/MainResourceLoader.cpp:393 #32 0x00007f1fa5f4d5e2 in WebCore::MainResourceLoader::continueAfterContentPolicy (this=0x7f1f99f98b00, contentPolicy=2784274064, r=...) at WebCore/loader/MainResourceLoader.cpp:264 #33 0x00007f1fa5f4d876 in WebCore::MainResourceLoader::continueAfterContentPolicy (this=0x7f1f99f98b00, policy=WebCore::PolicyUse) at WebCore/loader/MainResourceLoader.cpp:278 #34 0x00007f1fa5f4e1dd in WebCore::MainResourceLoader::callContinueAfterContentPolicy (this=0x7f1f99f98b00, r=...) at WebCore/loader/MainResourceLoader.cpp:270 #35 WebCore::MainResourceLoader::didReceiveResponse (this=0x7f1f99f98b00, r=...) at WebCore/loader/MainResourceLoader.cpp:336 #36 0x00007f1fa5f4b2b3 in WebCore::MainResourceLoader::handleDataLoadNow (this=0x7f1f99f98b00) at WebCore/loader/MainResourceLoader.cpp:438 #37 0x00007f1fa5fe23f6 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x7f1f99f43900) at WebCore/platform/ThreadTimers.cpp:112 #38 0x00007f1fa62ae492 in timeout_cb () at WebCore/platform/gtk/SharedTimerGtk.cpp:48 #39 0x00007f1fa2f8d12a in g_main_dispatch (context=0x2032940) at /tmp/buildd/glib2.0-2.22.2/glib/gmain.c:1960 #40 IA__g_main_context_dispatch (context=0x2032940) at /tmp/buildd/glib2.0-2.22.2/glib/gmain.c:2513 #41 0x00007f1fa2f90988 in g_main_context_iterate (context=0x2032940, block=1, dispatch=1, self=<value optimized out>) at /tmp/buildd/glib2.0-2.22.2/glib/gmain.c:2591 #42 0x00007f1fa2f90e5d in IA__g_main_loop_run (loop=0x20f3a70) at /tmp/buildd/glib2.0-2.22.2/glib/gmain.c:2799 #43 0x00007f1fa53b7ca7 in IA__gtk_main () at /tmp/buildd/gtk+2.0-2.18.3/gtk/gtkmain.c:1218 #44 0x0000000000400f85 in main (argc=1, argv=0x7fff5281c3f8) at test-webkit-crash.c:68 165278 1 gustavo 2009-11-20 05:02:27 -0800 This is a bug in libsoup. Bug report, and patch here: https://bugzilla.gnome.org/show_bug.cgi?id=602498 We may want to add a work-around nevertheless? 165282 2 43573 gustavo 2009-11-20 05:17:27 -0800 Created attachment 43573 work around I submitted a patch to soup, but perhaps we should add this work-around to webkit as well, so that people who don't upgrade soup don't get crashes. 165602 3 43573 eric 2009-11-21 07:11:34 -0800 Comment on attachment 43573 work around Should we wrap this in a version check for lib soup? Also, what's a cookie with no domain look like? How does one ever set one? Would a javascript: url which manipulates document.cookies work as a unit test? Could you take an iframe and have it load up a javascript:document.cookies = "foo" url (or whatever the proper cookie-setting code would be? 165656 4 bunk 2009-11-21 14:58:12 -0800 (In reply to comment #3) > (From update of attachment 43573 [details]) > Should we wrap this in a version check for lib soup? >... Before you are doing too complicated things here you could also consider not changing WebKit's code but bumping WebKit's libsoup dependency instead. WebKit already requires as a minimum a development verion of libsoup shortly before 2.28, and assuming a libsoup 2.28.2 with this fix included comes out soon that wouldn't be a big version bump. In Liferea (the application much affected by this bug) I plan to increase the libsoup dependency in trunk (that is for unrelated reasons already at 2.28) instead of bumping the WebKit dependency from currently 1.1.11. 165793 5 43573 oliver 2009-11-22 21:45:16 -0800 Comment on attachment 43573 work around r=me 169657 6 gustavo 2009-12-08 06:27:45 -0800 We decided to not apply this work-around, and depend on a newer soup instead. Thanks all. 43478 2009-11-18 19:17:05 -0800 2009-11-18 19:17:05 -0800 test program test-webkit-crash.c text/plain 1640 bunk I2luY2x1ZGUgPHN5cy90eXBlcy5oPgojaW5jbHVkZSA8c3lzL3N0YXQuaD4KI2luY2x1ZGUgPGZj bnRsLmg+CiNpbmNsdWRlIDxzaWduYWwuaD4KI2luY2x1ZGUgPHVuaXN0ZC5oPgojaW5jbHVkZSA8 c3RyaW5nLmg+CiNpbmNsdWRlIDxndGsvZ3RrLmg+CiNpbmNsdWRlIDx3ZWJraXQvd2Via2l0Lmg+ CgpzdGF0aWMgaW50IGk7CgpzdGF0aWMgdm9pZCBjbGlja2VkKEd0a1dpZGdldCAqd2lkZ2V0LCBn cG9pbnRlciBkYXRhKQp7CiAgICBjb25zdCBnY2hhciAqaHRtbCA9ICI8ZGl2PjxzY3JpcHQgc3Jj PVwiaHR0cDovL3M3LmFkZHRoaXMuY29tL2pzLzIwMC9hZGR0aGlzX3dpZGdldC5qc1wiIHR5cGU9 XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48L2Rpdj4iOwogICAgaW50IGZkOwoKICAgIHN3 aXRjaCAoaSkgewogICAgY2FzZSAwOgogICAgICBmZCA9IG9wZW4gKCJpbnB1dC5odG1sIiwgT19X Uk9OTFl8T19DUkVBVCk7CiAgICAgIHdyaXRlIChmZCwgaHRtbCwgc3RybGVuIChodG1sKSk7CiAg ICAgIGNsb3NlIChmZCk7CiAgICAgIHdlYmtpdF93ZWJfdmlld19sb2FkX3VyaSAoV0VCS0lUX1dF Ql9WSUVXIChkYXRhKSwgImZpbGU6Ly9pbnB1dC5odG1sIik7CiAgICAgIGJyZWFrOwogICAgY2Fz ZSAxOgogICAgICB3ZWJraXRfd2ViX3ZpZXdfbG9hZF9zdHJpbmcgKFdFQktJVF9XRUJfVklFVyAo ZGF0YSksIGh0bWwsIE5VTEwsIE5VTEwsIE5VTEwpOwogICAgICBicmVhazsKICAgIGRlZmF1bHQ6 CiAgICAgIGd0a19tYWluX3F1aXQoKTsKICAgIH0KCiAgICBpKys7Cn0KCnN0YXRpYyB2b2lkIGZh dGFsX3NpZ25hbF9oYW5kbGVyKGludCBzaWcpCnsKICAgIGdfb25fZXJyb3Jfc3RhY2tfdHJhY2Ug KCJ0ZXN0LXdlYmtpdC1jcmFzaCIpOwogICAgX2V4aXQoMSk7Cn0KCmludCBtYWluKGludCAgIGFy Z2MsIGNoYXIgKmFyZ3ZbXSkKewogICAgR3RrV2lkZ2V0ICp3aW5kb3c7CiAgICBHdGtXaWRnZXQg KmJveDsKICAgIEd0a1dpZGdldCAqd2VidmlldzsKICAgIEd0a1dpZGdldCAqYnV0dG9uOwoKICAg IGdfdGhyZWFkX2luaXQgKE5VTEwpOwogICAgCiAgICBndGtfaW5pdCAoJmFyZ2MsICZhcmd2KTsK CiAgICB3aW5kb3cgPSBndGtfd2luZG93X25ldyAoR1RLX1dJTkRPV19UT1BMRVZFTCk7CgogICAg Ym94ID0gZ3RrX3Zib3hfbmV3IChGQUxTRSwgMTApOwogICAgZ3RrX2NvbnRhaW5lcl9hZGQgKEdU S19DT05UQUlORVIgKHdpbmRvdyksIGJveCk7CgogICAgd2VidmlldyA9IHdlYmtpdF93ZWJfdmll d19uZXcoKTsKICAgIGd0a19jb250YWluZXJfYWRkIChHVEtfQ09OVEFJTkVSIChib3gpLCB3ZWJ2 aWV3KTsKCiAgICBidXR0b24gPSBndGtfYnV0dG9uX25ld193aXRoX2xhYmVsICgiTmV4dCBTdGVw Iik7CiAgICBnX3NpZ25hbF9jb25uZWN0IChHX09CSkVDVCAoYnV0dG9uKSwgImNsaWNrZWQiLAoJ CSAgICAgIEdfQ0FMTEJBQ0sgKGNsaWNrZWQpLCB3ZWJ2aWV3KTsKICAgIGd0a19jb250YWluZXJf YWRkIChHVEtfQ09OVEFJTkVSIChib3gpLCBidXR0b24pOwoKICAgIGd0a193aWRnZXRfc2hvd19h bGwgKHdpbmRvdyk7CgogICAgc2lnbmFsIChTSUdTRUdWLCBmYXRhbF9zaWduYWxfaGFuZGxlcik7 CiAgICAKICAgIGd0a19tYWluICgpOwogICAgCiAgICByZXR1cm4gMDsKfQo= 43573 2009-11-20 05:17:27 -0800 2009-11-22 21:45:16 -0800 work around 0001-Ignore-cookies-for-URIs-with-no-domain.patch text/plain 1820 gustavo RnJvbSA0YmExOTAwM2JmOTlhY2Y0NDRlZjU1MjQzYTU3ZGJkNmI5OTA2MmUyIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBHdXN0YXZvIE5vcm9uaGEgU2lsdmEgPGd1c3Rhdm8ubm9yb25o YUBjb2xsYWJvcmEuY28udWs+CkRhdGU6IEZyaSwgMjAgTm92IDIwMDkgMTE6MTU6NDEgLTAyMDAK U3ViamVjdDogW1BBVENIXSBJZ25vcmUgY29va2llcyBmb3IgVVJJcyB3aXRoIG5vIGRvbWFpbi4K Ci0tLQogV2ViQ29yZS9DaGFuZ2VMb2cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg IDE0ICsrKysrKysrKysrKysrCiBXZWJDb3JlL3BsYXRmb3JtL25ldHdvcmsvc291cC9Db29raWVK YXJTb3VwLmNwcCB8ICAgIDYgKysrKysrCiAyIGZpbGVzIGNoYW5nZWQsIDIwIGluc2VydGlvbnMo KyksIDAgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9DaGFuZ2VMb2cgYi9XZWJD b3JlL0NoYW5nZUxvZwppbmRleCA2OGRkZTViLi4xYWQ5Y2FkIDEwMDY0NAotLS0gYS9XZWJDb3Jl L0NoYW5nZUxvZworKysgYi9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDA5 LTExLTIwICBHdXN0YXZvIE5vcm9uaGEgU2lsdmEgIDxndXN0YXZvLm5vcm9uaGFAY29sbGFib3Jh LmNvLnVrPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IElnbm9yZSBjb29raWVzIGZvciBVUklzIHdpdGggbm8gZG9tYWluLgorCisgICAgICAgIHdlYmtp dF93ZWJfdmlld19sb2FkX3N0cmluZygpIGNyYXNoCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zMTY1OAorCisgICAgICAgIENhbid0IHNlZSBob3cgdG8g dGVzdCB0aGlzIHdpdGggYSBsYXlvdXQgdGVzdC4KKworICAgICAgICAqIHBsYXRmb3JtL25ldHdv cmsvc291cC9Db29raWVKYXJTb3VwLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OnNldENvb2tpZXMp OgorCiAyMDA5LTExLTE5ICBHdXN0YXZvIE5vcm9uaGEgU2lsdmEgIDxndXN0YXZvLm5vcm9uaGFA Y29sbGFib3JhLmNvLnVrPgogCiAgICAgICAgIFJ1YmJlci1zdGFtcGVkIGJ5IE9saXZlciBIdW50 LgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL3NvdXAvQ29va2llSmFyU291 cC5jcHAgYi9XZWJDb3JlL3BsYXRmb3JtL25ldHdvcmsvc291cC9Db29raWVKYXJTb3VwLmNwcApp bmRleCAzZWI1NzhhLi42MjRhMDY4IDEwMDY0NAotLS0gYS9XZWJDb3JlL3BsYXRmb3JtL25ldHdv cmsvc291cC9Db29raWVKYXJTb3VwLmNwcAorKysgYi9XZWJDb3JlL3BsYXRmb3JtL25ldHdvcmsv c291cC9Db29raWVKYXJTb3VwLmNwcApAQCAtNjIsNiArNjIsMTIgQEAgdm9pZCBzZXRDb29raWVz KERvY3VtZW50KiAvKmRvY3VtZW50Ki8sIGNvbnN0IEtVUkwmIHVybCwgY29uc3QgU3RyaW5nJiB2 YWx1ZSkKIAogICAgIFNvdXBVUkkqIG9yaWdpbiA9IHNvdXBfdXJpX25ldyh1cmwuc3RyaW5nKCku dXRmOCgpLmRhdGEoKSk7CiAKKyAgICAvLyBsaWJzb3VwIHNob3VsZCBpZ25vcmUgY29va2llcyB3 aXRoIG5vIGRvbWFpbjsgdGhpcyBjdXJyZW50bHkKKyAgICAvLyBsZWFkcyB0byBhIGNyYXNoLCB0 aG91Z2guIFNlZQorICAgIC8vIGh0dHBzOi8vYnVnemlsbGEuZ25vbWUub3JnL3Nob3dfYnVnLmNn aT9pZD02MDI0OTguCisgICAgaWYgKCFvcmlnaW4tPmhvc3QpCisgICAgICAgIHJldHVybjsKKwog ICAgIHNvdXBfY29va2llX2phcl9zZXRfY29va2llKGphciwgb3JpZ2luLCB2YWx1ZS51dGY4KCku ZGF0YSgpKTsKICAgICBzb3VwX3VyaV9mcmVlKG9yaWdpbik7CiB9Ci0tIAoxLjYuNS4yCgo=