46536 2010-09-24 16:14:37 -0700 REGRESSION (r68260): Crash in PlatformCertificateInfo::~PlatformCertificateInfo when navigating away from Gmail 2010-09-27 06:29:36 -0700 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) PC Windows XP RESOLVED FIXED InRadar, PlatformOnly, Regression P2 Normal --- 1 aroben aroben sam oldest_to_newest 284816 0 aroben 2010-09-24 16:14:37 -0700 To reproduce: 1. Go to http://gmail.com/ in WebKit2 2. Go to some other page You'll crash in PlatformCertificateInfo::~PlatformCertificateInfo. Here's the backtrace: crypt32.dll!ReleaseContextElement() + 0x18 bytes crypt32.dll!_CertFreeCertificateContext@4() + 0x15 bytes > WebKit.dll!WebKit::PlatformCertificateInfo::~PlatformCertificateInfo() Line 63 + 0xe bytes C++ WebKit.dll!WebKit::WebCertificateInfo::~WebCertificateInfo() + 0x19 bytes C++ WebKit.dll!WebKit::WebCertificateInfo::`scalar deleting destructor'() + 0x16 bytes C++ WebKit.dll!WTF::RefCounted<WebKit::APIObject>::deref() Line 139 + 0x3a bytes C++ WebKit.dll!WTF::derefIfNotNull<WebKit::WebCertificateInfo>(WebKit::WebCertificateInfo * ptr=0x099888e8) Line 59 C++ WebKit.dll!WTF::RefPtr<WebKit::WebCertificateInfo>::operator=(const WTF::PassRefPtr<WebKit::WebCertificateInfo> & o={...}) Line 140 + 0x9 bytes C++ WebKit.dll!WebKit::WebFrameProxy::setCertificateInfo(WTF::PassRefPtr<WebKit::WebCertificateInfo> certificateInfo={...}) Line 69 C++ WebKit.dll!WebKit::WebPageProxy::didCommitLoadForFrame(WebKit::WebFrameProxy * frame=0x0987a0b8, const WebKit::PlatformCertificateInfo & certificateInfo={...}, WebKit::APIObject * userData=0x00000000) Line 1038 C++ WebKit.dll!WebKit::WebPageProxy::didReceiveMessage(CoreIPC::Connection * connection=0x08cda7a8, CoreIPC::MessageID messageID={...}, CoreIPC::ArgumentDecoder * arguments=0x0aa1cac8) Line 616 C++ WebKit.dll!WebKit::WebProcessProxy::didReceiveMessage(CoreIPC::Connection * connection=0x08cda7a8, CoreIPC::MessageID messageID={...}, CoreIPC::ArgumentDecoder * arguments=0x0aa1cac8) Line 356 C++ WebKit.dll!CoreIPC::Connection::dispatchMessages() Line 278 + 0x33 bytes C++ WebKit.dll!MemberFunctionWorkItem0<CoreIPC::Connection>::execute() Line 74 + 0x10 bytes C++ WebKit.dll!RunLoop::performWork() Line 62 + 0x1a bytes C++ WebKit.dll!RunLoop::wndProc(HWND__ * hWnd=0x000b0a82, unsigned int message=1025, unsigned int wParam=106901664, long lParam=0) Line 56 C++ WebKit.dll!RunLoop::RunLoopWndProc(HWND__ * hWnd=0x000b0a82, unsigned int message=1025, unsigned int wParam=106901664, long lParam=0) Line 38 + 0x18 bytes C++ 284818 1 aroben 2010-09-24 16:14:55 -0700 Luckily, I have a fix! 284820 2 aroben 2010-09-24 16:15:48 -0700 <rdar://problem/8477292> 285413 3 68899 aroben 2010-09-27 06:09:03 -0700 Created attachment 68899 Don't double-free CERT_CONTEXTs when copying PlatformCertificateInfos on Windows 285416 4 68899 sam 2010-09-27 06:14:13 -0700 Comment on attachment 68899 Don't double-free CERT_CONTEXTs when copying PlatformCertificateInfos on Windows View in context: https://bugs.webkit.org/attachment.cgi?id=68899&action=review > WebKit2/Shared/win/PlatformCertificateInfo.cpp:77 > +PlatformCertificateInfo& PlatformCertificateInfo::operator=(const PlatformCertificateInfo& other) > +{ > + if (m_certificateContext) > + ::CertFreeCertificateContext(m_certificateContext); > + m_certificateContext = ::CertDuplicateCertificateContext(other.m_certificateContext); > + return *this; > +} We should try and handle the self-assignment case here. 285419 5 68901 aroben 2010-09-27 06:19:57 -0700 Created attachment 68901 Don't double-free CERT_CONTEXTs when copying PlatformCertificateInfos on Windows 285422 6 aroben 2010-09-27 06:29:36 -0700 Committed r68387: <http://trac.webkit.org/changeset/68387> 68899 2010-09-27 06:09:03 -0700 2010-09-27 06:19:51 -0700 Don't double-free CERT_CONTEXTs when copying PlatformCertificateInfos on Windows bug-46536-20100927090901.patch text/plain 2890 aroben ZGlmZiAtLWdpdCBhL1dlYktpdDIvQ2hhbmdlTG9nIGIvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXgg MWM2NTJlYWViYzliZmE3ODQwYmFiZDBlNDk5NmE3Y2EwYWE0OGNiOC4uZjliN2ViYWNlZDAxNjNh Njk4MGJlMzc0MmFhN2JiYWRiZmUzNmQ5ZCAxMDA2NDQKLS0tIGEvV2ViS2l0Mi9DaGFuZ2VMb2cK KysrIGIvV2ViS2l0Mi9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyMiBAQAorMjAxMC0wOS0yNyAgQWRh bSBSb2JlbiAgPGFyb2JlbkBhcHBsZS5jb20+CisKKyAgICAgICAgRG9uJ3QgZG91YmxlLWZyZWUg Q0VSVF9DT05URVhUcyB3aGVuIGNvcHlpbmcgUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm9zCisgICAg ICAgIG9uIFdpbmRvd3MKKworICAgICAgICBGaXhlcyA8aHR0cDovL3dlYmtpdC5vcmcvYi80NjUz Nj4gPHJkYXI6Ly9wcm9ibGVtLzg0NzcyOTI+IFJFR1JFU1NJT04KKyAgICAgICAgKHI2ODI2MCk6 IENyYXNoIGluIFBsYXRmb3JtQ2VydGlmaWNhdGVJbmZvOjp+UGxhdGZvcm1DZXJ0aWZpY2F0ZUlu Zm8KKyAgICAgICAgd2hlbiBuYXZpZ2F0aW5nIGF3YXkgZnJvbSBHbWFpbAorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogU2hhcmVkL3dpbi9QbGF0Zm9y bUNlcnRpZmljYXRlSW5mby5jcHA6CisgICAgICAgIChXZWJLaXQ6OlBsYXRmb3JtQ2VydGlmaWNh dGVJbmZvOjpQbGF0Zm9ybUNlcnRpZmljYXRlSW5mbyk6CisgICAgICAgIChXZWJLaXQ6OlBsYXRm b3JtQ2VydGlmaWNhdGVJbmZvOjpvcGVyYXRvcj0pOgorICAgICAgICAqIFNoYXJlZC93aW4vUGxh dGZvcm1DZXJ0aWZpY2F0ZUluZm8uaDoKKyAgICAgICAgQWRkZWQgYSBjb3B5IGNvbnN0cnVjdG9y IGFuZCBhc3NpZ21lbnQgb3BlcmF0b3IgdG8gaGFuZGxlIGNvcnJlY3RseQorICAgICAgICByZWZm aW5nL2RlcmVmZmluZyB0aGUgQ0VSVF9DT05URVhUcyB3aGVuIGNvcHlpbmcgYQorICAgICAgICBQ bGF0Zm9ybUNlcnRpZmljYXRlSW5mby4KKwogMjAxMC0wOS0yNiAgU2FtIFdlaW5pZyAgPHNhbUB3 ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFNpbW9uIEZyYXNlci4KZGlmZiAtLWdp dCBhL1dlYktpdDIvU2hhcmVkL3dpbi9QbGF0Zm9ybUNlcnRpZmljYXRlSW5mby5jcHAgYi9XZWJL aXQyL1NoYXJlZC93aW4vUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8uY3BwCmluZGV4IGY2ZTQyNDlj NzhiNjU2Mjk4NTZkMTEyZWMwNDQ5YWY5YzljOTJjNmQuLmEwYWQwNjJlNDg1ODQyMTZkMWQ1OTIx ZDhmZmQ1OTVmMWIwYzk5NTUgMTAwNjQ0Ci0tLSBhL1dlYktpdDIvU2hhcmVkL3dpbi9QbGF0Zm9y bUNlcnRpZmljYXRlSW5mby5jcHAKKysrIGIvV2ViS2l0Mi9TaGFyZWQvd2luL1BsYXRmb3JtQ2Vy dGlmaWNhdGVJbmZvLmNwcApAQCAtNjMsNiArNjMsMTkgQEAgUGxhdGZvcm1DZXJ0aWZpY2F0ZUlu Zm86On5QbGF0Zm9ybUNlcnRpZmljYXRlSW5mbygpCiAgICAgICAgIDo6Q2VydEZyZWVDZXJ0aWZp Y2F0ZUNvbnRleHQobV9jZXJ0aWZpY2F0ZUNvbnRleHQpOwogfQogCitQbGF0Zm9ybUNlcnRpZmlj YXRlSW5mbzo6UGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8oY29uc3QgUGxhdGZvcm1DZXJ0aWZpY2F0 ZUluZm8mIG90aGVyKQorICAgIDogbV9jZXJ0aWZpY2F0ZUNvbnRleHQoOjpDZXJ0RHVwbGljYXRl Q2VydGlmaWNhdGVDb250ZXh0KG90aGVyLm1fY2VydGlmaWNhdGVDb250ZXh0KSkKK3sKK30KKwor UGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8mIFBsYXRmb3JtQ2VydGlmaWNhdGVJbmZvOjpvcGVyYXRv cj0oY29uc3QgUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8mIG90aGVyKQoreworICAgIGlmIChtX2Nl cnRpZmljYXRlQ29udGV4dCkKKyAgICAgICAgOjpDZXJ0RnJlZUNlcnRpZmljYXRlQ29udGV4dCht X2NlcnRpZmljYXRlQ29udGV4dCk7CisgICAgbV9jZXJ0aWZpY2F0ZUNvbnRleHQgPSA6OkNlcnRE dXBsaWNhdGVDZXJ0aWZpY2F0ZUNvbnRleHQob3RoZXIubV9jZXJ0aWZpY2F0ZUNvbnRleHQpOwor ICAgIHJldHVybiAqdGhpczsKK30KKwogdm9pZCBQbGF0Zm9ybUNlcnRpZmljYXRlSW5mbzo6ZW5j b2RlKENvcmVJUEM6OkFyZ3VtZW50RW5jb2RlciogZW5jb2RlcikgY29uc3QKIHsKICAgICAvLyBG SVhNRTogV2Ugc2hvdWxkIGVuY29kZSB0aGUgbm8gY2VydGlmaWNhdGUgY29udGV4dCBjYXNlIGlu IHRoZQpkaWZmIC0tZ2l0IGEvV2ViS2l0Mi9TaGFyZWQvd2luL1BsYXRmb3JtQ2VydGlmaWNhdGVJ bmZvLmggYi9XZWJLaXQyL1NoYXJlZC93aW4vUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8uaAppbmRl eCAxNTM3ZjU3YzYwNmMxMDYwMTIxZDI5MWI3YzAyNmI2YjkwMjYxNTBjLi5iOGQ2ZDZkNmNlMzg1 MmRhZjYwYmQ1OWNmNzI0NzkyYWM2NWI0ZDJiIDEwMDY0NAotLS0gYS9XZWJLaXQyL1NoYXJlZC93 aW4vUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8uaAorKysgYi9XZWJLaXQyL1NoYXJlZC93aW4vUGxh dGZvcm1DZXJ0aWZpY2F0ZUluZm8uaApAQCAtNDMsNiArNDMsOSBAQCBwdWJsaWM6CiAgICAgZXhw bGljaXQgUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8oY29uc3QgV2ViQ29yZTo6UmVzb3VyY2VSZXNw b25zZSYpOyAgICAKICAgICB+UGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8oKTsKIAorICAgIFBsYXRm b3JtQ2VydGlmaWNhdGVJbmZvKGNvbnN0IFBsYXRmb3JtQ2VydGlmaWNhdGVJbmZvJik7CisgICAg UGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8mIG9wZXJhdG9yPShjb25zdCBQbGF0Zm9ybUNlcnRpZmlj YXRlSW5mbyYpOworCiAgICAgUENDRVJUX0NPTlRFWFQgY2VydGlmaWNhdGVDb250ZXh0KCkgY29u c3QgeyByZXR1cm4gbV9jZXJ0aWZpY2F0ZUNvbnRleHQ7IH0KIAogICAgIHZvaWQgZW5jb2RlKENv cmVJUEM6OkFyZ3VtZW50RW5jb2RlciogZW5jb2RlcikgY29uc3Q7Cg== 68901 2010-09-27 06:19:57 -0700 2010-09-27 06:25:54 -0700 Don't double-free CERT_CONTEXTs when copying PlatformCertificateInfos on Windows bug-46536-20100927091954.patch text/plain 2923 aroben ZGlmZiAtLWdpdCBhL1dlYktpdDIvQ2hhbmdlTG9nIGIvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXgg MWM2NTJlYWViYzliZmE3ODQwYmFiZDBlNDk5NmE3Y2EwYWE0OGNiOC4uZjliN2ViYWNlZDAxNjNh Njk4MGJlMzc0MmFhN2JiYWRiZmUzNmQ5ZCAxMDA2NDQKLS0tIGEvV2ViS2l0Mi9DaGFuZ2VMb2cK KysrIGIvV2ViS2l0Mi9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyMiBAQAorMjAxMC0wOS0yNyAgQWRh bSBSb2JlbiAgPGFyb2JlbkBhcHBsZS5jb20+CisKKyAgICAgICAgRG9uJ3QgZG91YmxlLWZyZWUg Q0VSVF9DT05URVhUcyB3aGVuIGNvcHlpbmcgUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm9zCisgICAg ICAgIG9uIFdpbmRvd3MKKworICAgICAgICBGaXhlcyA8aHR0cDovL3dlYmtpdC5vcmcvYi80NjUz Nj4gPHJkYXI6Ly9wcm9ibGVtLzg0NzcyOTI+IFJFR1JFU1NJT04KKyAgICAgICAgKHI2ODI2MCk6 IENyYXNoIGluIFBsYXRmb3JtQ2VydGlmaWNhdGVJbmZvOjp+UGxhdGZvcm1DZXJ0aWZpY2F0ZUlu Zm8KKyAgICAgICAgd2hlbiBuYXZpZ2F0aW5nIGF3YXkgZnJvbSBHbWFpbAorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogU2hhcmVkL3dpbi9QbGF0Zm9y bUNlcnRpZmljYXRlSW5mby5jcHA6CisgICAgICAgIChXZWJLaXQ6OlBsYXRmb3JtQ2VydGlmaWNh dGVJbmZvOjpQbGF0Zm9ybUNlcnRpZmljYXRlSW5mbyk6CisgICAgICAgIChXZWJLaXQ6OlBsYXRm b3JtQ2VydGlmaWNhdGVJbmZvOjpvcGVyYXRvcj0pOgorICAgICAgICAqIFNoYXJlZC93aW4vUGxh dGZvcm1DZXJ0aWZpY2F0ZUluZm8uaDoKKyAgICAgICAgQWRkZWQgYSBjb3B5IGNvbnN0cnVjdG9y IGFuZCBhc3NpZ21lbnQgb3BlcmF0b3IgdG8gaGFuZGxlIGNvcnJlY3RseQorICAgICAgICByZWZm aW5nL2RlcmVmZmluZyB0aGUgQ0VSVF9DT05URVhUcyB3aGVuIGNvcHlpbmcgYQorICAgICAgICBQ bGF0Zm9ybUNlcnRpZmljYXRlSW5mby4KKwogMjAxMC0wOS0yNiAgU2FtIFdlaW5pZyAgPHNhbUB3 ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFNpbW9uIEZyYXNlci4KZGlmZiAtLWdp dCBhL1dlYktpdDIvU2hhcmVkL3dpbi9QbGF0Zm9ybUNlcnRpZmljYXRlSW5mby5jcHAgYi9XZWJL aXQyL1NoYXJlZC93aW4vUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8uY3BwCmluZGV4IGY2ZTQyNDlj NzhiNjU2Mjk4NTZkMTEyZWMwNDQ5YWY5YzljOTJjNmQuLjViOWEyYzlkYmVhZTNlNmRlMjAzMzA4 NDcxMzY0MTkyNmM4OTg2MWMgMTAwNjQ0Ci0tLSBhL1dlYktpdDIvU2hhcmVkL3dpbi9QbGF0Zm9y bUNlcnRpZmljYXRlSW5mby5jcHAKKysrIGIvV2ViS2l0Mi9TaGFyZWQvd2luL1BsYXRmb3JtQ2Vy dGlmaWNhdGVJbmZvLmNwcApAQCAtNjMsNiArNjMsMjAgQEAgUGxhdGZvcm1DZXJ0aWZpY2F0ZUlu Zm86On5QbGF0Zm9ybUNlcnRpZmljYXRlSW5mbygpCiAgICAgICAgIDo6Q2VydEZyZWVDZXJ0aWZp Y2F0ZUNvbnRleHQobV9jZXJ0aWZpY2F0ZUNvbnRleHQpOwogfQogCitQbGF0Zm9ybUNlcnRpZmlj YXRlSW5mbzo6UGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8oY29uc3QgUGxhdGZvcm1DZXJ0aWZpY2F0 ZUluZm8mIG90aGVyKQorICAgIDogbV9jZXJ0aWZpY2F0ZUNvbnRleHQoOjpDZXJ0RHVwbGljYXRl Q2VydGlmaWNhdGVDb250ZXh0KG90aGVyLm1fY2VydGlmaWNhdGVDb250ZXh0KSkKK3sKK30KKwor UGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8mIFBsYXRmb3JtQ2VydGlmaWNhdGVJbmZvOjpvcGVyYXRv cj0oY29uc3QgUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8mIG90aGVyKQoreworICAgIDo6Q2VydER1 cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dChvdGhlci5tX2NlcnRpZmljYXRlQ29udGV4dCk7Cisg ICAgaWYgKG1fY2VydGlmaWNhdGVDb250ZXh0KQorICAgICAgICA6OkNlcnRGcmVlQ2VydGlmaWNh dGVDb250ZXh0KG1fY2VydGlmaWNhdGVDb250ZXh0KTsKKyAgICBtX2NlcnRpZmljYXRlQ29udGV4 dCA9IG90aGVyLm1fY2VydGlmaWNhdGVDb250ZXh0OworICAgIHJldHVybiAqdGhpczsKK30KKwog dm9pZCBQbGF0Zm9ybUNlcnRpZmljYXRlSW5mbzo6ZW5jb2RlKENvcmVJUEM6OkFyZ3VtZW50RW5j b2RlciogZW5jb2RlcikgY29uc3QKIHsKICAgICAvLyBGSVhNRTogV2Ugc2hvdWxkIGVuY29kZSB0 aGUgbm8gY2VydGlmaWNhdGUgY29udGV4dCBjYXNlIGluIHRoZQpkaWZmIC0tZ2l0IGEvV2ViS2l0 Mi9TaGFyZWQvd2luL1BsYXRmb3JtQ2VydGlmaWNhdGVJbmZvLmggYi9XZWJLaXQyL1NoYXJlZC93 aW4vUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8uaAppbmRleCAxNTM3ZjU3YzYwNmMxMDYwMTIxZDI5 MWI3YzAyNmI2YjkwMjYxNTBjLi5iOGQ2ZDZkNmNlMzg1MmRhZjYwYmQ1OWNmNzI0NzkyYWM2NWI0 ZDJiIDEwMDY0NAotLS0gYS9XZWJLaXQyL1NoYXJlZC93aW4vUGxhdGZvcm1DZXJ0aWZpY2F0ZUlu Zm8uaAorKysgYi9XZWJLaXQyL1NoYXJlZC93aW4vUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8uaApA QCAtNDMsNiArNDMsOSBAQCBwdWJsaWM6CiAgICAgZXhwbGljaXQgUGxhdGZvcm1DZXJ0aWZpY2F0 ZUluZm8oY29uc3QgV2ViQ29yZTo6UmVzb3VyY2VSZXNwb25zZSYpOyAgICAKICAgICB+UGxhdGZv cm1DZXJ0aWZpY2F0ZUluZm8oKTsKIAorICAgIFBsYXRmb3JtQ2VydGlmaWNhdGVJbmZvKGNvbnN0 IFBsYXRmb3JtQ2VydGlmaWNhdGVJbmZvJik7CisgICAgUGxhdGZvcm1DZXJ0aWZpY2F0ZUluZm8m IG9wZXJhdG9yPShjb25zdCBQbGF0Zm9ybUNlcnRpZmljYXRlSW5mbyYpOworCiAgICAgUENDRVJU X0NPTlRFWFQgY2VydGlmaWNhdGVDb250ZXh0KCkgY29uc3QgeyByZXR1cm4gbV9jZXJ0aWZpY2F0 ZUNvbnRleHQ7IH0KIAogICAgIHZvaWQgZW5jb2RlKENvcmVJUEM6OkFyZ3VtZW50RW5jb2Rlciog ZW5jb2RlcikgY29uc3Q7Cg==