4367 2005-08-09 17:19:35 -0700 Crash when executing setTimeout / Date / document.write Javascript (bugtraq) 2005-09-10 13:44:37 -0700 1 1 1 Unclassified WebKit JavaScriptCore 420+ Mac OS X 10.4 RESOLVED FIXED P1 Normal --- 1 kbroderick darin mrowe oldest_to_newest 16321 0 kbroderick 2005-08-09 17:19:35 -0700 As seen on bugtraq, the attached HTML file (mostly JS) can crash Safari. Bugtraq submitter reported it on 10.3.9 and Safari 1.3 (132); I've also seen it on 10.4.2 w/WebKit.App (ToT from 8 Aug 05). 16322 1 3302 kbroderick 2005-08-09 17:20:08 -0700 Created attachment 3302 Javascript that crashes WebKit 18952 2 mrowe 2005-09-06 23:56:54 -0700 Confirmed with ToT WebKit. Bumping to P1 as it's a reproducible crash. 19051 3 darin 2005-09-07 22:20:11 -0700 Simple problem in document logic; unnecessary code to destroy the tokenizer twice. 19052 4 3806 darin 2005-09-07 22:23:15 -0700 Created attachment 3806 patch to fix this by removing some uneeded code from document.close 19141 5 mjs 2005-09-08 22:32:26 -0700 It's hard to see the actual code change, given all the formatting changes. 19143 6 mjs 2005-09-08 22:39:44 -0700 OK, r=me if the layout tests all still pass. Make sure to add the test case as a layout test. 19303 7 darin 2005-09-10 13:44:37 -0700 Had to change the test quite a bit to land it as a layout test, but I came up with something. 3302 2005-08-09 17:20:08 -0700 2005-08-09 17:20:08 -0700 Javascript that crashes WebKit crasher.html text/html 264 kbroderick CjxodG1sPgo8c2NyaXB0IG5hbWU9IkphdmFTY3JpcHQiPgo8IS0tCgpmdW5jdGlvbiB0aWNrVG9j aygpCnsKICAgICAgICBzZXRUaW1lb3V0KCJ0aWNrVG9jaygpIiwgMTAwMCk7CiAgICAgICAgdGhp c1RpbWUgPSBuZXcgRGF0ZSgpCiAgICAgICAgc2Vjb25kcyA9IHRoaXNUaW1lLmdldFNlY29uZHMo KQogICAgICAgIGRvY3VtZW50LndyaXRlKHNlY29uZHMpOyAKfQoKLy8gLS0+Cjwvc2NyaXB0PgoK PGJvZHkgb25Mb2FkPSJ0aWNrVG9jaygpOyI+CjwvaHRtbD4K 3806 2005-09-07 22:23:15 -0700 2005-09-08 22:40:01 -0700 patch to fix this by removing some uneeded code from document.close DocumentClosePatch.txt text/plain 6590 darin SW5kZXg6IGtodG1sL3htbC9kb21fZG9jaW1wbC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQpSQ1MgZmlsZTogL2N2 cy9yb290L1dlYkNvcmUva2h0bWwveG1sL2RvbV9kb2NpbXBsLmNwcCx2CnJldHJpZXZpbmcgcmV2 aXNpb24gMS4yNTIKZGlmZiAtcCAtdSAtcjEuMjUyIGtodG1sL3htbC9kb21fZG9jaW1wbC5jcHAK LS0tIGtodG1sL3htbC9kb21fZG9jaW1wbC5jcHAJNSBTZXAgMjAwNSAyMjo0MTozNiAtMDAwMAkx LjI1MgorKysga2h0bWwveG1sL2RvbV9kb2NpbXBsLmNwcAk4IFNlcCAyMDA1IDA1OjIzOjQzIC0w MDAwCkBAIC0xMzIyLDk3ICsxMzIyLDc1IEBAIHZvaWQgRG9jdW1lbnRJbXBsOjppbXBsaWNpdENs b3NlKCkKICAgICAgICAgcmV0dXJuOwogICAgIH0KIAotICAgIC8vIEZpcnN0IGZpcmUgdGhlIG9u bG9hZC4KLSAgICAKICAgICBib29sIHdhc0xvY2F0aW9uQ2hhbmdlUGVuZGluZyA9IHBhcnQoKSAm JiBwYXJ0KCktPmlzU2NoZWR1bGVkTG9jYXRpb25DaGFuZ2VQZW5kaW5nKCk7CiAgICAgYm9vbCBk b2xvYWQgPSAhcGFyc2luZygpICYmIG1fdG9rZW5pemVyICYmICFtX3Byb2Nlc3NpbmdMb2FkRXZl bnQgJiYgIXdhc0xvY2F0aW9uQ2hhbmdlUGVuZGluZzsKICAgICAKLSAgICBpZiAoZG9sb2FkKSB7 Ci0gICAgICAgIG1fcHJvY2Vzc2luZ0xvYWRFdmVudCA9IHRydWU7CisgICAgaWYgKCFkb2xvYWQp CisgICAgICAgIHJldHVybjsKIAotICAgICAgICAvLyBXZSBoYXZlIHRvIGNsZWFyIHRoZSB0b2tl bml6ZXIsIGluIGNhc2Ugc29tZW9uZSBkb2N1bWVudC53cml0ZSgpcyBmcm9tIHRoZQotICAgICAg ICAvLyBvbkxvYWQgZXZlbnQgaGFuZGxlciwgYXMgaW4gUmFkYXIgMzIwNjUyNAotICAgICAgICBk ZWxldGUgbV90b2tlbml6ZXI7Ci0gICAgICAgIG1fdG9rZW5pemVyID0gMDsKLQotICAgICAgICAv LyBDcmVhdGUgYSBib2R5IGVsZW1lbnQgaWYgd2UgZG9uJ3QgYWxyZWFkeSBoYXZlIG9uZS4KLSAg ICAgICAgLy8gSW4gdGhlIGNhc2Ugb2YgUmFkYXIgMzc1ODc4NSwgdGhlIHdpbmRvdy5vbmxvYWQg d2FzIHNldCBpbiBzb21lIGphdmFzY3JpcHQsIGJ1dCBuZXZlciBmaXJlZCBiZWNhdXNlIHRoZXJl IHdhcyBubyBib2R5LiAgCi0gICAgICAgIC8vIFRoaXMgYmVoYXZpb3Igbm93IG1hdGNoZXMgRmly ZWZveCBhbmQgSUUuCi0gICAgICAgIEhUTUxFbGVtZW50SW1wbCAqYm9keSA9IHRoaXMtPmJvZHko KTsKLSAgICAgICAgaWYgKCFib2R5ICYmIGlzSFRNTERvY3VtZW50KCkpIHsKLSAgICAgICAgICAg IE5vZGVJbXBsICpkZSA9IGRvY3VtZW50RWxlbWVudCgpOwotICAgICAgICAgICAgaWYgKGRlKSB7 Ci0gICAgICAgICAgICAgICAgYm9keSA9IG5ldyBIVE1MQm9keUVsZW1lbnRJbXBsKGRvY1B0cigp KTsKLSAgICAgICAgICAgICAgICBpbnQgZXhjZXB0aW9uQ29kZSA9IDA7Ci0gICAgICAgICAgICAg ICAgZGUtPmFwcGVuZENoaWxkKGJvZHksIGV4Y2VwdGlvbkNvZGUpOwotICAgICAgICAgICAgICAg IGlmIChleGNlcHRpb25Db2RlICE9IDApCi0gICAgICAgICAgICAgICAgICAgIGJvZHkgPSAwOwot ICAgICAgICAgICAgfQotICAgICAgICB9CisgICAgbV9wcm9jZXNzaW5nTG9hZEV2ZW50ID0gdHJ1 ZTsKIAotICAgICAgICBpZiAoYm9keSkgewotICAgICAgICAgICAgZGlzcGF0Y2hJbWFnZUxvYWRF dmVudHNOb3coKTsKLSAgICAgICAgICAgIGJvZHktPmRpc3BhdGNoV2luZG93RXZlbnQobG9hZEV2 ZW50LCBmYWxzZSwgZmFsc2UpOwotI2lmIEFQUExFX0NIQU5HRVMKLSAgICAgICAgICAgIGlmIChL SFRNTFBhcnQgKnAgPSBwYXJ0KCkpCi0gICAgICAgICAgICAgICAgS1dRKHApLT5oYW5kbGVkT25s b2FkRXZlbnRzKCk7Ci0jZW5kaWYKKyAgICAvLyBXZSBoYXZlIHRvIGNsZWFyIHRoZSB0b2tlbml6 ZXIsIGluIGNhc2Ugc29tZW9uZSBkb2N1bWVudC53cml0ZSgpcyBmcm9tIHRoZQorICAgIC8vIG9u TG9hZCBldmVudCBoYW5kbGVyLCBhcyBpbiBSYWRhciAzMjA2NTI0LgorICAgIGRlbGV0ZSBtX3Rv a2VuaXplcjsKKyAgICBtX3Rva2VuaXplciA9IDA7CiAKLSNpZmRlZiBJTlNUUlVNRU5UX0xBWU9V VF9TQ0hFRFVMSU5HCi0gICAgICAgICAgICBpZiAoIW93bmVyRWxlbWVudCgpKQotICAgICAgICAg ICAgICAgIHByaW50Zigib25sb2FkIGZpcmVkIGF0ICVkXG4iLCBlbGFwc2VkVGltZSgpKTsKLSNl bmRpZgorICAgIC8vIENyZWF0ZSBhIGJvZHkgZWxlbWVudCBpZiB3ZSBkb24ndCBhbHJlYWR5IGhh dmUgb25lLgorICAgIC8vIEluIHRoZSBjYXNlIG9mIFJhZGFyIDM3NTg3ODUsIHRoZSB3aW5kb3cu b25sb2FkIHdhcyBzZXQgaW4gc29tZSBqYXZhc2NyaXB0LCBidXQgbmV2ZXIgZmlyZWQgYmVjYXVz ZSB0aGVyZSB3YXMgbm8gYm9keS4gIAorICAgIC8vIFRoaXMgYmVoYXZpb3Igbm93IG1hdGNoZXMg RmlyZWZveCBhbmQgSUUuCisgICAgSFRNTEVsZW1lbnRJbXBsICpib2R5ID0gdGhpcy0+Ym9keSgp OworICAgIGlmICghYm9keSAmJiBpc0hUTUxEb2N1bWVudCgpKSB7CisgICAgICAgIE5vZGVJbXBs ICpkZSA9IGRvY3VtZW50RWxlbWVudCgpOworICAgICAgICBpZiAoZGUpIHsKKyAgICAgICAgICAg IGJvZHkgPSBuZXcgSFRNTEJvZHlFbGVtZW50SW1wbChkb2NQdHIoKSk7CisgICAgICAgICAgICBp bnQgZXhjZXB0aW9uQ29kZSA9IDA7CisgICAgICAgICAgICBkZS0+YXBwZW5kQ2hpbGQoYm9keSwg ZXhjZXB0aW9uQ29kZSk7CisgICAgICAgICAgICBpZiAoZXhjZXB0aW9uQ29kZSAhPSAwKQorICAg ICAgICAgICAgICAgIGJvZHkgPSAwOwogICAgICAgICB9CisgICAgfQogCi0gICAgICAgIG1fcHJv Y2Vzc2luZ0xvYWRFdmVudCA9IGZhbHNlOworICAgIGlmIChib2R5KSB7CisgICAgICAgIGRpc3Bh dGNoSW1hZ2VMb2FkRXZlbnRzTm93KCk7CisgICAgICAgIGJvZHktPmRpc3BhdGNoV2luZG93RXZl bnQobG9hZEV2ZW50LCBmYWxzZSwgZmFsc2UpOworICAgICAgICBpZiAoS0hUTUxQYXJ0ICpwID0g cGFydCgpKQorICAgICAgICAgICAgS1dRKHApLT5oYW5kbGVkT25sb2FkRXZlbnRzKCk7CisjaWZk ZWYgSU5TVFJVTUVOVF9MQVlPVVRfU0NIRURVTElORworICAgICAgICBpZiAoIW93bmVyRWxlbWVu dCgpKQorICAgICAgICAgICAgcHJpbnRmKCJvbmxvYWQgZmlyZWQgYXQgJWRcbiIsIGVsYXBzZWRU aW1lKCkpOworI2VuZGlmCiAgICAgfQotICAgIAorCisgICAgbV9wcm9jZXNzaW5nTG9hZEV2ZW50 ID0gZmFsc2U7CisKICAgICAvLyBNYWtlIHN1cmUgYm90aCB0aGUgaW5pdGlhbCBsYXlvdXQgYW5k IHJlZmxvdyBoYXBwZW4gYWZ0ZXIgdGhlIG9ubG9hZAogICAgIC8vIGZpcmVzLiBUaGlzIHdpbGwg aW1wcm92ZSBvbmxvYWQgc2NvcmVzLCBhbmQgb3RoZXIgYnJvd3NlcnMgZG8gaXQuCiAgICAgLy8g SWYgdGhleSB3YW5uYSBjaGVhdCwgd2UgY2FuIHRvby4gLWR3aAotICAgIAotICAgIGJvb2wgaXNM b2NhdGlvbkNoYW5nZVBlbmRpbmcgPSBwYXJ0KCkgJiYgcGFydCgpLT5pc1NjaGVkdWxlZExvY2F0 aW9uQ2hhbmdlUGVuZGluZygpOwotICAgIAotICAgIGlmIChkb2xvYWQgJiYgaXNMb2NhdGlvbkNo YW5nZVBlbmRpbmcgJiYgbV9zdGFydFRpbWUuZWxhcHNlZCgpIDwgY0xheW91dFNjaGVkdWxlVGhy ZXNob2xkKSB7Ci0JLy8gSnVzdCBiYWlsIG91dC4gQmVmb3JlIG9yIGR1cmluZyB0aGUgb25sb2Fk IHdlIHdlcmUgc2hpZnRlZCB0byBhbm90aGVyIHBhZ2UuCi0JLy8gVGhlIG9sZCBpLUJlbmNoIHN1 aXRlIGRvZXMgdGhpcy4gV2hlbiB0aGlzIGhhcHBlbnMgZG9uJ3QgYm90aGVyIHBhaW50aW5nIG9y IGxheWluZyBvdXQuICAgICAgICAKLQlkZWxldGUgbV90b2tlbml6ZXI7Ci0JbV90b2tlbml6ZXIg PSAwOwotCXZpZXcoKS0+dW5zY2hlZHVsZVJlbGF5b3V0KCk7Ci0JcmV0dXJuOwotICAgIH0KLSAg ICAKLSAgICBpZiAoZG9sb2FkKSB7Ci0gICAgICAgIC8vIG9uIGFuIGV4cGxpY2l0IGRvY3VtZW50 LmNsb3NlKCksIHRoZSB0b2tlbml6ZXIgbWlnaHQgc3RpbGwgYmUgd2FpdGluZyBvbiBzY3JpcHRz LAotICAgICAgICAvLyBhbmQgaW4gdGhhdCBjYXNlIHdlIGRvbid0IHdhbnQgdG8gZGVzdHJveSBp dCBiZWNhdXNlIHRoYXQgd2lsbCBwcmV2ZW50IHRoZQotICAgICAgICAvLyBzY3JpcHRzIGZyb20g Z2V0dGluZyBwcm9jZXNzZWQuCi0gICAgICAgIC8vIEZJWE1FOiB0aGlzIGNoZWNrIG1heSBubyBs b25nZXIgYmUgbmVjZXNzYXJ5LCBzaW5jZSBub3cgaXQgc2hvdWxkIGJlIGltcG9zc2libGUKLSAg ICAgICAgLy8gZm9yIHBhcnNpbmcgdG8gYmUgZmFsc2Ugd2hpbGUgc3RpbCB3YWl0aW5nIGZvciBz Y3JpcHRzCi0gICAgICAgIGlmIChtX3Rva2VuaXplciAmJiAhbV90b2tlbml6ZXItPmlzV2FpdGlu Z0ZvclNjcmlwdHMoKSkgewotICAgICAgICAgICAgZGVsZXRlIG1fdG9rZW5pemVyOwotICAgICAg ICAgICAgbV90b2tlbml6ZXIgPSAwOwotICAgICAgICB9CiAKLSAgICAgICAgaWYgKG1fdmlldykK LSAgICAgICAgICAgIG1fdmlldy0+cGFydCgpLT5jaGVja0VtaXRMb2FkRXZlbnQoKTsKKyAgICBp ZiAocGFydCgpICYmIHBhcnQoKS0+aXNTY2hlZHVsZWRMb2NhdGlvbkNoYW5nZVBlbmRpbmcoKSAm JiBtX3N0YXJ0VGltZS5lbGFwc2VkKCkgPCBjTGF5b3V0U2NoZWR1bGVUaHJlc2hvbGQpIHsKKyAg ICAgICAgLy8gSnVzdCBiYWlsIG91dC4gQmVmb3JlIG9yIGR1cmluZyB0aGUgb25sb2FkIHdlIHdl cmUgc2hpZnRlZCB0byBhbm90aGVyIHBhZ2UuCisgICAgICAgIC8vIFRoZSBvbGQgaS1CZW5jaCBz dWl0ZSBkb2VzIHRoaXMuIFdoZW4gdGhpcyBoYXBwZW5zIGRvbid0IGJvdGhlciBwYWludGluZyBv ciBsYXlpbmcgb3V0LiAgICAgICAgCisgICAgICAgIHZpZXcoKS0+dW5zY2hlZHVsZVJlbGF5b3V0 KCk7CisgICAgICAgIHJldHVybjsKICAgICB9CiAKKyAgICBpZiAocGFydCgpKQorICAgICAgICBw YXJ0KCktPmNoZWNrRW1pdExvYWRFdmVudCgpOworCiAgICAgLy8gTm93IGRvIG91ciBwYWludGlu Zy9sYXlvdXQsIGJ1dCBvbmx5IGlmIHdlIGFyZW4ndCBpbiBhIHN1YmZyYW1lIG9yIGlmIHdlJ3Jl IGluIGEgc3ViZnJhbWUKICAgICAvLyB0aGF0IGhhcyBiZWVuIHNpemVkIGFscmVhZHkuICBPdGhl cndpc2UsIG91ciB2aWV3IHNpemUgd291bGQgYmUgaW5jb3JyZWN0LCBzbyBkb2luZyBhbnkgCiAg ICAgLy8gbGF5b3V0L3BhaW50aW5nIG5vdyB3b3VsZCBiZSBwb2ludGxlc3MuCi0gICAgaWYgKGRv bG9hZCkgewotICAgICAgICBpZiAoIW93bmVyRWxlbWVudCgpIHx8IChvd25lckVsZW1lbnQoKS0+ cmVuZGVyZXIoKSAmJiAhb3duZXJFbGVtZW50KCktPnJlbmRlcmVyKCktPm5lZWRzTGF5b3V0KCkp KSB7Ci0gICAgICAgICAgICB1cGRhdGVSZW5kZXJpbmcoKTsKLSAgICAgICAgICAgIAotICAgICAg ICAgICAgLy8gQWx3YXlzIGRvIGEgbGF5b3V0IGFmdGVyIGxvYWRpbmcgaWYgbmVlZGVkLgotICAg ICAgICAgICAgaWYgKHZpZXcoKSAmJiByZW5kZXJlcigpICYmICghcmVuZGVyZXIoKS0+Zmlyc3RD aGlsZCgpIHx8IHJlbmRlcmVyKCktPm5lZWRzTGF5b3V0KCkpKQotICAgICAgICAgICAgICAgIHZp ZXcoKS0+bGF5b3V0KCk7Ci0gICAgICAgIH0KKyAgICBpZiAoIW93bmVyRWxlbWVudCgpIHx8IChv d25lckVsZW1lbnQoKS0+cmVuZGVyZXIoKSAmJiAhb3duZXJFbGVtZW50KCktPnJlbmRlcmVyKCkt Pm5lZWRzTGF5b3V0KCkpKSB7CisgICAgICAgIHVwZGF0ZVJlbmRlcmluZygpOworICAgICAgICAK KyAgICAgICAgLy8gQWx3YXlzIGRvIGEgbGF5b3V0IGFmdGVyIGxvYWRpbmcgaWYgbmVlZGVkLgor ICAgICAgICBpZiAodmlldygpICYmIHJlbmRlcmVyKCkgJiYgKCFyZW5kZXJlcigpLT5maXJzdENo aWxkKCkgfHwgcmVuZGVyZXIoKS0+bmVlZHNMYXlvdXQoKSkpCisgICAgICAgICAgICB2aWV3KCkt PmxheW91dCgpOworICAgIH0KICNpZiBBUFBMRV9DSEFOR0VTCi0gICAgICAgIGlmIChyZW5kZXJl cigpICYmIEtXUUFjY09iamVjdENhY2hlOjphY2Nlc3NpYmlsaXR5RW5hYmxlZCgpKQotICAgICAg ICAgICAgZ2V0QWNjT2JqZWN0Q2FjaGUoKS0+cG9zdE5vdGlmaWNhdGlvbihyZW5kZXJlcigpLCAi QVhMb2FkQ29tcGxldGUiKTsKKyAgICBpZiAocmVuZGVyZXIoKSAmJiBLV1FBY2NPYmplY3RDYWNo ZTo6YWNjZXNzaWJpbGl0eUVuYWJsZWQoKSkKKyAgICAgICAgZ2V0QWNjT2JqZWN0Q2FjaGUoKS0+ cG9zdE5vdGlmaWNhdGlvbihyZW5kZXJlcigpLCAiQVhMb2FkQ29tcGxldGUiKTsKICNlbmRpZgot ICAgIH0KIH0KIAogdm9pZCBEb2N1bWVudEltcGw6OnNldFBhcnNpbmcoYm9vbCBiKQpAQCAtMTQ2 OSw3ICsxNDQ3LDggQEAgdm9pZCBEb2N1bWVudEltcGw6OndyaXRlKCBjb25zdCBRU3RyaW5nIAog ICAgIAogICAgIGlmICghbV90b2tlbml6ZXIpIHsKICAgICAgICAgb3BlbigpOwotICAgICAgICB3 cml0ZShRU3RyaW5nOjpmcm9tTGF0aW4xKCI8aHRtbD4iKSk7CisgICAgICAgIGFzc2VydChtX3Rv a2VuaXplcik7CisgICAgICAgIHdyaXRlKFFTdHJpbmcoIjxodG1sPiIpKTsKICAgICB9CiAgICAg bV90b2tlbml6ZXItPndyaXRlKHRleHQsIGZhbHNlKTsKIAo=