63885 2011-07-03 20:21:09 -0700 Null deref accessing CustomEvent.detail 2011-07-05 13:51:12 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) All All RESOLVED FIXED EasyFix, InRadar P1 Normal --- 1 sam sam oldest_to_newest 431776 0 sam 2011-07-03 20:21:09 -0700 The ScriptValue m_detail in the CustomEvent class is initialized to null (rather than jsNull()) which can lead to a null deref if it is access before calling initCustomEvent. javascript:alert(document.createEvent("CustomEvent").detail) should do the trick. 431821 1 ap 2011-07-03 23:34:06 -0700 It does, it does! Repro crash -> P1 432375 2 99737 sam 2011-07-05 13:07:48 -0700 Created attachment 99737 Patch 432376 3 sam 2011-07-05 13:09:42 -0700 <rdar://problem/9724577> 432388 4 sam 2011-07-05 13:51:12 -0700 Committed r90405: <http://trac.webkit.org/changeset/90405> 99737 2011-07-05 13:07:48 -0700 2011-07-05 13:28:34 -0700 Patch bug-63885-20110705130746.patch text/plain 2986 sam SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDkwNDAzKQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTEtMDctMDUgIFNhbSBXZWlu aWcgIDxzYW1Ad2Via2l0Lm9yZz4KKworICAgICAgICBOdWxsIGRlcmVmIGFjY2Vzc2luZyBDdXN0 b21FdmVudC5kZXRhaWwKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTYzODg1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgVGVzdDogZmFzdC9ldmVudHMvY3VzdG9tLWV2ZW50LXVuaW5pdGlhbGl6ZWQuaHRtbAor CisgICAgICAgICogYmluZGluZ3Mvc2NyaXB0cy9Db2RlR2VuZXJhdG9ySlMucG06CisgICAgICAg IEd1YXJkIGFnYWluc3QgdW5pbml0aWFsaXplZCBzY3JpcHQgdmFsdWUuCisKIDIwMTEtMDctMDUg IFByYXRpayBTb2xhbmtpICA8cHNvbGFua2lAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2Vk IGJ5IERhbiBCZXJuc3RlaW4uCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9zY3JpcHRz L0NvZGVHZW5lcmF0b3JKUy5wbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9iaW5kaW5n cy9zY3JpcHRzL0NvZGVHZW5lcmF0b3JKUy5wbQkocmV2aXNpb24gOTAzNzApCisrKyBTb3VyY2Uv V2ViQ29yZS9iaW5kaW5ncy9zY3JpcHRzL0NvZGVHZW5lcmF0b3JKUy5wbQkod29ya2luZyBjb3B5 KQpAQCAtMjY4NSw3ICsyNjg1LDcgQEAgc3ViIE5hdGl2ZVRvSlNWYWx1ZQogICAgICAgICBpZiAo JGltcGxDbGFzc05hbWUgZXEgIkRvY3VtZW50IikgewogICAgICAgICAgICAgJGltcGxJbmNsdWRl c3siSlNDYW52YXNSZW5kZXJpbmdDb250ZXh0MkQuaCJ9ID0gMTsKICAgICAgICAgfSBlbHNlIHsK LSAgICAgICAgICAgIHJldHVybiAiJHZhbHVlLmpzVmFsdWUoKTsiOworICAgICAgICAgICAgcmV0 dXJuICIoJHZhbHVlLmhhc05vVmFsdWUoKSA/IGpzTnVsbCgpIDogJHZhbHVlLmpzVmFsdWUoKSki OwogICAgICAgICB9CiAgICAgfSBlbHNpZiAoJHR5cGUgPX4gL1NWR1BhdGhTZWcvKSB7CiAgICAg ICAgICRpbXBsSW5jbHVkZXN7IkpTJHR5cGUuaCJ9ID0gMTsKSW5kZXg6IExheW91dFRlc3RzL0No YW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDkw NDAzKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEs MTYgQEAKKzIwMTEtMDctMDUgIFNhbSBXZWluaWcgIDxzYW1Ad2Via2l0Lm9yZz4KKworICAgICAg ICBOdWxsIGRlcmVmIGFjY2Vzc2luZyBDdXN0b21FdmVudC5kZXRhaWwKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTYzODg1CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkIHRlc3Qgd2hpY2ggZXhlcmNpc2Vz IGFuIGluaXRpYWxpemVkIGRldGFpbHMgcHJvcGVydHkgb24gCisgICAgICAgIGEgQ3VzdG9tRXZl bnQgaW5zdGFuY2UuCisKKyAgICAgICAgKiBmYXN0L2V2ZW50cy9jdXN0b20tZXZlbnQtdW5pbml0 aWFsaXplZC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvZXZlbnRzL2N1c3Rv bS1ldmVudC11bmluaXRpYWxpemVkLmh0bWw6IEFkZGVkLgorCiAyMDExLTA3LTA1ICBHYXZpbiBC YXJyYWNsb3VnaCAgPGJhcnJhY2xvdWdoQGFwcGxlLmNvbT4KIAogICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NjM5NDcKSW5kZXg6IExheW91dFRlc3RzL2Zh c3QvZXZlbnRzL2N1c3RvbS1ldmVudC11bmluaXRpYWxpemVkLWV4cGVjdGVkLnR4dAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2V2ZW50cy9jdXN0b20tZXZlbnQtdW5pbml0aWFsaXpl ZC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2V2ZW50cy9j dXN0b20tZXZlbnQtdW5pbml0aWFsaXplZC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0w LDAgKzEgQEAKK1RoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guIChodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NjM4ODUpCkluZGV4OiBMYXlvdXRUZXN0 cy9mYXN0L2V2ZW50cy9jdXN0b20tZXZlbnQtdW5pbml0aWFsaXplZC5odG1sCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIExheW91dFRlc3RzL2Zhc3QvZXZlbnRzL2N1c3RvbS1ldmVudC11bmluaXRpYWxpemVkLmh0 bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2V2ZW50cy9jdXN0b20tZXZlbnQt dW5pbml0aWFsaXplZC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDggQEAKKzxwPlRoaXMg dGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guIChodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9NjM4ODUpPC9wPgorCis8c2NyaXB0PgorICAgIGlmICh3aW5kb3cu bGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBB c1RleHQoKTsKKworICAgIFN0cmluZyhkb2N1bWVudC5jcmVhdGVFdmVudCgiQ3VzdG9tRXZlbnQi KS5kZXRhaWwpOworPC9zY3JpcHQ+Cg==