45880 2010-09-16 04:28:58 -0700 createBlobURL with no argument causes crash 2010-09-17 12:01:51 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED FIXED P1 Normal --- 1 skylined jianli dimich eric jianli levin oldest_to_newest 280010 0 67779 skylined 2010-09-16 04:28:58 -0700 Created attachment 67779 Repro <script>createBlobURL()</script> Results fro latest Chromium: id: WebKit::WebCString::WebCString ReadAV@NULL (633fb021372abb6fa84401694bab542d) description: Attempt to read from NULL pointer (+0x50) in WebKit::WebCString::WebCString stack: WebKit::WebCString::WebCString WebKit::WebURL::WebURL WebCore::BlobRegistryProxy::registerBlobURL WebCore::ThreadableBlobRegistry::registerBlobURL WebCore::ScriptExecutionContext::createPublicBlobURL WebCore::DOMWindow::createBlobURL WebCore::DOMWindowInternal::createBlobURLCallback v8::internal::HandleApiCallHelper<...> v8::internal::Builtin_HandleApiCall v8::internal::Invoke v8::internal::Execution::Call v8::Function::Call WebCore::V8Proxy::callFunction WebCore::ScheduledAction::execute WebCore::ScheduledAction::execute WebCore::DOMTimer::fired WebCore::ThreadTimers::sharedTimerFiredInternal MessageLoop::RunTask MessageLoop::DeferOrRunPendingTask MessageLoop::DoDelayedWork base::MessagePumpDefault::Run MessageLoop::RunInternal MessageLoop::Run RendererMain ChromeMain MainDllLoader::Launch wWinMain __tmainCRTStartup BaseProcessStart 280743 1 67922 jianli 2010-09-17 11:01:13 -0700 Created attachment 67922 Proposed Patch 280756 2 67922 dimich 2010-09-17 11:19:07 -0700 Comment on attachment 67922 Proposed Patch View in context: https://bugs.webkit.org/attachment.cgi?id=67922&action=prettypatch > WebCore/dom/ScriptExecutionContext.cpp:266 > + return KURL(); Would be nice to make sure that JS object returned is undefined, not a valid empty string. 280764 3 67926 jianli 2010-09-17 11:39:40 -0700 Created attachment 67926 Proposed Patch Add attribute to convert null string to undefined. Also update the test to verify it. 280767 4 67926 dimich 2010-09-17 11:45:53 -0700 Comment on attachment 67926 Proposed Patch r+ with 2 nits View in context: https://bugs.webkit.org/attachment.cgi?id=67926&action=prettypatch > LayoutTests/fast/files/create-blob-url-crash.html:3 > +<body> I think by moving 'script' tag before the body and just setting the <body onload="test()"> it's possible to get rid of need to use notifyDone(). > LayoutTests/fast/files/create-blob-url-crash.html:23 > +if (window.eventSender) { you don't use eventSender, so the check could be just "if (window.layoutTestController) ..." 280773 5 jianli 2010-09-17 12:01:51 -0700 Committed as http://trac.webkit.org/changeset/67734. 67779 2010-09-16 04:28:58 -0700 2010-09-16 04:28:58 -0700 Repro repro.html text/html 32 skylined PHNjcmlwdD5jcmVhdGVCbG9iVVJMKCk8L3NjcmlwdD4= 67922 2010-09-17 11:01:13 -0700 2010-09-17 11:39:40 -0700 Proposed Patch 45880 text/plain 2664 jianli ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCBlNzZmOTk3Li5kZTQ2OGZhIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTAtMDkt MTcgIEppYW4gTGkgIDxqaWFubGlAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGNyZWF0ZUJsb2JVUkwgd2l0aCBubyBhcmd1bWVu dCBjYXVzZXMgY3Jhc2guCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD00NTg4MAorCisgICAgICAgICogZmFzdC9maWxlcy9jcmVhdGUtYmxvYi11cmwtY3Jh c2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2ZpbGVzL2NyZWF0ZS1ibG9i LXVybC1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxMC0wOS0xNCAgUGF2ZWwgUG9kaXZpbG92ICA8 cG9kaXZpbG92QGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBQYXZlbCBGZWxk bWFuLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9maWxlcy9jcmVhdGUtYmxvYi11cmwt Y3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9maWxlcy9jcmVhdGUtYmxvYi11 cmwtY3Jhc2gtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu LmZhOWUxMzMKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ZpbGVzL2NyZWF0 ZS1ibG9iLXVybC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSBAQAorVGVzdCB0aGF0IGNy ZWF0ZUJsb2JVUkwgd2l0aCBubyBhcmd1bWVudCBzaG91bGQgbm90IGNhdXNlIGNyYXNoLgpkaWZm IC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9maWxlcy9jcmVhdGUtYmxvYi11cmwtY3Jhc2guaHRt bCBiL0xheW91dFRlc3RzL2Zhc3QvZmlsZXMvY3JlYXRlLWJsb2ItdXJsLWNyYXNoLmh0bWwKbmV3 IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uY2I0OTM3ZQotLS0gL2Rldi9udWxsCisr KyBiL0xheW91dFRlc3RzL2Zhc3QvZmlsZXMvY3JlYXRlLWJsb2ItdXJsLWNyYXNoLmh0bWwKQEAg LTAsMCArMSwxMyBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxib2R5PgorPHNjcmlwdD4K K2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgbGF5b3V0VGVzdENvbnRyb2xs ZXIuZHVtcEFzVGV4dCgpOworCitjcmVhdGVCbG9iVVJMKCk7Cis8L3NjcmlwdD4KK1Rlc3QgdGhh dCBjcmVhdGVCbG9iVVJMIHdpdGggbm8gYXJndW1lbnQgc2hvdWxkIG5vdCBjYXVzZSBjcmFzaC4K KzwvYm9keT4KKzwvaHRtbD4KKwpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9DaGFuZ2VMb2cgYi9XZWJD b3JlL0NoYW5nZUxvZwppbmRleCA5ZDBmZTcxLi43NjE2MjM3IDEwMDY0NAotLS0gYS9XZWJDb3Jl L0NoYW5nZUxvZworKysgYi9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEw LTA5LTE3ICBKaWFuIExpICA8amlhbmxpQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBjcmVhdGVCbG9iVVJMIHdpdGggbm8gYXJn dW1lbnQgY2F1c2VzIGNyYXNoLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9NDU4ODAKKworICAgICAgICBUaGUgZml4IGlzIHRvIGNoZWNrIGlmIHRoZSBw YXNzaW5nIGJsb2IgYXJndW1lbnQgaXMgTlVMTCBvciBub3QuCisKKyAgICAgICAgVGVzdDogZmFz dC9maWxlcy9jcmVhdGUtYmxvYi11cmwtY3Jhc2guaHRtbAorCisgICAgICAgICogZG9tL1Njcmlw dEV4ZWN1dGlvbkNvbnRleHQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6U2NyaXB0RXhlY3V0aW9u Q29udGV4dDo6Y3JlYXRlUHVibGljQmxvYlVSTCk6CisKIDIwMTAtMDktMTQgIFBhdmVsIFBvZGl2 aWxvdiAgPHBvZGl2aWxvdkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgUGF2 ZWwgRmVsZG1hbi4KZGlmZiAtLWdpdCBhL1dlYkNvcmUvZG9tL1NjcmlwdEV4ZWN1dGlvbkNvbnRl eHQuY3BwIGIvV2ViQ29yZS9kb20vU2NyaXB0RXhlY3V0aW9uQ29udGV4dC5jcHAKaW5kZXggNjcy YTFmNS4uYmZkYTE3YiAxMDA2NDQKLS0tIGEvV2ViQ29yZS9kb20vU2NyaXB0RXhlY3V0aW9uQ29u dGV4dC5jcHAKKysrIGIvV2ViQ29yZS9kb20vU2NyaXB0RXhlY3V0aW9uQ29udGV4dC5jcHAKQEAg LTI2Miw2ICsyNjIsOCBAQCBET01UaW1lciogU2NyaXB0RXhlY3V0aW9uQ29udGV4dDo6ZmluZFRp bWVvdXQoaW50IHRpbWVvdXRJZCkKICNpZiBFTkFCTEUoQkxPQikKIEtVUkwgU2NyaXB0RXhlY3V0 aW9uQ29udGV4dDo6Y3JlYXRlUHVibGljQmxvYlVSTChCbG9iKiBibG9iKQogeworICAgIGlmICgh YmxvYikKKyAgICAgICAgcmV0dXJuIEtVUkwoKTsKICAgICBLVVJMIHB1YmxpY1VSTCA9IEJsb2JV Ukw6OmNyZWF0ZVB1YmxpY1VSTChzZWN1cml0eU9yaWdpbigpKTsKICAgICBUaHJlYWRhYmxlQmxv YlJlZ2lzdHJ5OjpyZWdpc3RlckJsb2JVUkwocHVibGljVVJMLCBibG9iLT51cmwoKSk7CiAgICAg bV9wdWJsaWNCbG9iVVJMcy5hZGQocHVibGljVVJMLnN0cmluZygpKTsK 67926 2010-09-17 11:39:40 -0700 2010-09-17 11:45:52 -0700 Proposed Patch 45880_2 text/plain 3689 jianli ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCBlNzZmOTk3Li5kZTQ2OGZhIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTAtMDkt MTcgIEppYW4gTGkgIDxqaWFubGlAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGNyZWF0ZUJsb2JVUkwgd2l0aCBubyBhcmd1bWVu dCBjYXVzZXMgY3Jhc2guCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD00NTg4MAorCisgICAgICAgICogZmFzdC9maWxlcy9jcmVhdGUtYmxvYi11cmwtY3Jh c2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2ZpbGVzL2NyZWF0ZS1ibG9i LXVybC1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxMC0wOS0xNCAgUGF2ZWwgUG9kaXZpbG92ICA8 cG9kaXZpbG92QGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBQYXZlbCBGZWxk bWFuLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9maWxlcy9jcmVhdGUtYmxvYi11cmwt Y3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9maWxlcy9jcmVhdGUtYmxvYi11 cmwtY3Jhc2gtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu LjJiNTM1NmEKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ZpbGVzL2NyZWF0 ZS1ibG9iLXVybC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSw0IEBACitUZXN0IHRoYXQg Y3JlYXRlQmxvYlVSTCB3aXRoIG5vIGFyZ3VtZW50IHNob3VsZCBub3QgY2F1c2UgY3Jhc2guCitQ QVNTCitET05FCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvZmlsZXMvY3JlYXRlLWJs b2ItdXJsLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2ZpbGVzL2NyZWF0ZS1ibG9iLXVy bC1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjJmNTQ3OTUK LS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ZpbGVzL2NyZWF0ZS1ibG9iLXVy bC1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMzEgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8 Ym9keT4KKzxwcmUgaWQ9J2NvbnNvbGUnPjwvcHJlPgorCis8c2NyaXB0PgorZnVuY3Rpb24gbG9n KG1lc3NhZ2UpCit7CisgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2NvbnNvbGUnKS5hcHBl bmRDaGlsZChkb2N1bWVudC5jcmVhdGVUZXh0Tm9kZShtZXNzYWdlICsgIlxuIikpOworfQorCitm dW5jdGlvbiB0ZXN0KCkKK3sKKyAgICBsb2coIlRlc3QgdGhhdCBjcmVhdGVCbG9iVVJMIHdpdGgg bm8gYXJndW1lbnQgc2hvdWxkIG5vdCBjYXVzZSBjcmFzaC4iKTsKKyAgICB2YXIgdXJsID0gY3Jl YXRlQmxvYlVSTCgpOworICAgIGxvZyh1cmwgPT0gdW5kZWZpbmVkID8gIlBBU1MiIDogIkZBSUwi KTsKKworICAgIGxvZygiRE9ORSIpOworICAgIGlmIChsYXlvdXRUZXN0Q29udHJvbGxlci5ub3Rp ZnlEb25lKQorICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5ub3RpZnlEb25lKCk7Cit9CisK K2lmICh3aW5kb3cuZXZlbnRTZW5kZXIpIHsKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1w QXNUZXh0KCk7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIud2FpdFVudGlsRG9uZSgpOworICAg IHdpbmRvdy5vbmxvYWQgPSB0ZXN0OworfQorPC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CisK ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg OWQwZmU3MS4uOTAxNThhZSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxOCBAQAorMjAxMC0wOS0xNyAgSmlhbiBMaSAgPGpp YW5saUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgY3JlYXRlQmxvYlVSTCB3aXRoIG5vIGFyZ3VtZW50IGNhdXNlcyBjcmFzaC4K KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ1ODgwCisK KyAgICAgICAgVGhlIGZpeCBpcyB0byBjaGVjayBpZiB0aGUgcGFzc2luZyBibG9iIGFyZ3VtZW50 IGlzIE5VTEwgb3Igbm90LgorCisgICAgICAgIFRlc3Q6IGZhc3QvZmlsZXMvY3JlYXRlLWJsb2It dXJsLWNyYXNoLmh0bWwKKworICAgICAgICAqIGRvbS9TY3JpcHRFeGVjdXRpb25Db250ZXh0LmNw cDoKKyAgICAgICAgKFdlYkNvcmU6OlNjcmlwdEV4ZWN1dGlvbkNvbnRleHQ6OmNyZWF0ZVB1Ymxp Y0Jsb2JVUkwpOgorICAgICAgICAqIHBhZ2UvRE9NV2luZG93LmlkbDogQWRkIGF0dHJpYnV0ZSB0 byBjb252ZXJ0IG51bGwgc3RyaW5nIHRvIHVuZGVmaW5lZC4KKwogMjAxMC0wOS0xNCAgUGF2ZWwg UG9kaXZpbG92ICA8cG9kaXZpbG92QGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBi eSBQYXZlbCBGZWxkbWFuLgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9kb20vU2NyaXB0RXhlY3V0aW9u Q29udGV4dC5jcHAgYi9XZWJDb3JlL2RvbS9TY3JpcHRFeGVjdXRpb25Db250ZXh0LmNwcAppbmRl eCA2NzJhMWY1Li5iZmRhMTdiIDEwMDY0NAotLS0gYS9XZWJDb3JlL2RvbS9TY3JpcHRFeGVjdXRp b25Db250ZXh0LmNwcAorKysgYi9XZWJDb3JlL2RvbS9TY3JpcHRFeGVjdXRpb25Db250ZXh0LmNw cApAQCAtMjYyLDYgKzI2Miw4IEBAIERPTVRpbWVyKiBTY3JpcHRFeGVjdXRpb25Db250ZXh0Ojpm aW5kVGltZW91dChpbnQgdGltZW91dElkKQogI2lmIEVOQUJMRShCTE9CKQogS1VSTCBTY3JpcHRF eGVjdXRpb25Db250ZXh0OjpjcmVhdGVQdWJsaWNCbG9iVVJMKEJsb2IqIGJsb2IpCiB7CisgICAg aWYgKCFibG9iKQorICAgICAgICByZXR1cm4gS1VSTCgpOwogICAgIEtVUkwgcHVibGljVVJMID0g QmxvYlVSTDo6Y3JlYXRlUHVibGljVVJMKHNlY3VyaXR5T3JpZ2luKCkpOwogICAgIFRocmVhZGFi bGVCbG9iUmVnaXN0cnk6OnJlZ2lzdGVyQmxvYlVSTChwdWJsaWNVUkwsIGJsb2ItPnVybCgpKTsK ICAgICBtX3B1YmxpY0Jsb2JVUkxzLmFkZChwdWJsaWNVUkwuc3RyaW5nKCkpOwpkaWZmIC0tZ2l0 IGEvV2ViQ29yZS9wYWdlL0RPTVdpbmRvdy5pZGwgYi9XZWJDb3JlL3BhZ2UvRE9NV2luZG93Lmlk bAppbmRleCBiNGM2NTg5Li4yMzUwOGJlIDEwMDY0NAotLS0gYS9XZWJDb3JlL3BhZ2UvRE9NV2lu ZG93LmlkbAorKysgYi9XZWJDb3JlL3BhZ2UvRE9NV2luZG93LmlkbApAQCAtNzYyLDcgKzc2Miw3 IEBAIG1vZHVsZSB3aW5kb3cgewogICAgICAgICBhdHRyaWJ1dGUgW0NvbmRpdGlvbmFsPUJMT0Jd IEJsb2JCdWlsZGVyQ29uc3RydWN0b3IgQmxvYkJ1aWxkZXI7CiAKICNpZiBkZWZpbmVkKEVOQUJM RV9CTE9CKSAmJiBFTkFCTEVfQkxPQgotICAgICAgICBET01TdHJpbmcgY3JlYXRlQmxvYlVSTChp biBCbG9iIGJsb2IpOworICAgICAgICBbQ29udmVydE51bGxTdHJpbmdUbz1VbmRlZmluZWRdIERP TVN0cmluZyBjcmVhdGVCbG9iVVJMKGluIEJsb2IgYmxvYik7CiAgICAgICAgIHZvaWQgcmV2b2tl QmxvYlVSTChpbiBET01TdHJpbmcgYmxvYlVSTCk7CiAjZW5kaWYKIAo=