74970 2011-12-20 15:55:05 -0800 [Coverity] Address use-after-free report in MemoryCache 2011-12-22 02:48:17 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 gbillock gbillock ap groby japhet koivisto levin webkit.review.bot zoltan oldest_to_newest 524911 0 gbillock 2011-12-20 15:55:05 -0800 [Coverity] Address use-after-free report in MemoryCache 524917 1 120105 gbillock 2011-12-20 15:58:41 -0800 Created attachment 120105 Patch 524965 2 ap 2011-12-20 16:50:25 -0800 What does this use-after-free report mean? Is this just a false positive that you're shutting up? 524991 3 gbillock 2011-12-20 17:15:51 -0800 Basically, yes. Coverity is worried that evict(revalidatingResource) can delete revalidatingResource, and then it gets used below. But canDelete() is clearly false if isLoaded() is true. That's beyond Coverity's abilities, but usually that means humans have a hard time deciphering such facts as well. :-) 525111 4 ap 2011-12-20 22:46:18 -0800 OK. Maybe that's worth a comment in code in addition to the ASSERT. CC'ing some folks who worked on this code in case something is this function jumps out as incorrect once this assertion for documenting behavior is added. 525327 5 120191 gbillock 2011-12-21 10:32:23 -0800 Created attachment 120191 Patch 525328 6 gbillock 2011-12-21 10:32:56 -0800 Added a comment. 525567 7 120191 ap 2011-12-21 14:09:34 -0800 Comment on attachment 120191 Patch + // The evict() call can delete revalidatingResource, which we then use + // below. Assert explicitly that this can't happen. I'd state this differently: // Calling evict() can potentially delete the resource. This won't happen here because <...> 525649 8 120223 gbillock 2011-12-21 14:53:26 -0800 Created attachment 120223 Patch 525650 9 gbillock 2011-12-21 14:54:00 -0800 Done. 525653 10 120223 eric 2011-12-21 14:55:31 -0800 Comment on attachment 120223 Patch OK. 525654 11 webkit.review.bot 2011-12-21 14:55:44 -0800 Attachment 120223 did not pass style-queue: Failed to run "['Tools/Scripts/update-webkit']" exit_code: 9 Updating OpenSource From git://git.webkit.org/WebKit daea471..578c1d3 master -> origin/master Partial-rebuilding .git/svn/refs/remotes/origin/master/.rev_map.268f45cc-cd09-0410-ab3c-d52691b4dbfc ... Currently at 103458 = daea471373d620a3fbc3e7dbc138f927d151a5c9 r103460 = 578c1d3f4da422dcdedb98687c619ba79bfeb36f Done rebuilding .git/svn/refs/remotes/origin/master/.rev_map.268f45cc-cd09-0410-ab3c-d52691b4dbfc First, rewinding head to replay your work on top of it... Applying: Inform the scrolling coordinator when scrollbar layers come and go Using index info to reconstruct a base tree... <stdin>:474806: trailing whitespace. [Chromium] DatabaseTrackerChromium: iterating DatabaseSet races with Database disposal on worker thread <stdin>:474827: trailing whitespace. Nothing to test, just removing redundant code. Correct behavior tested by <stdin>:475346: trailing whitespace. warning: 3 lines add whitespace errors. Falling back to patching base and 3-way merge... warning: too many files (created: 167249 deleted: 3), skipping inexact rename detection Auto-merging LayoutTests/ChangeLog CONFLICT (content): Merge conflict in LayoutTests/ChangeLog Auto-merging LayoutTests/platform/chromium/test_expectations.txt Auto-merging Source/WebCore/ChangeLog CONFLICT (content): Merge conflict in Source/WebCore/ChangeLog Auto-merging Source/WebCore/rendering/RenderLayerCompositor.cpp CONFLICT (content): Merge conflict in Source/WebCore/rendering/RenderLayerCompositor.cpp Auto-merging Source/WebKit2/ChangeLog CONFLICT (content): Merge conflict in Source/WebKit2/ChangeLog Failed to merge in the changes. Patch failed at 0001 Inform the scrolling coordinator when scrollbar layers come and go When you have resolved this problem run "git rebase --continue". If you would prefer to skip this patch, instead run "git rebase --skip". To restore the original branch and stop rebasing run "git rebase --abort". rebase refs/remotes/origin/master: command returned error: 1 Died at Tools/Scripts/update-webkit line 158. If any of these errors are false positives, please file a bug against check-webkit-style. 526128 12 120223 webkit.review.bot 2011-12-22 02:48:12 -0800 Comment on attachment 120223 Patch Clearing flags on attachment: 120223 Committed r103513: <http://trac.webkit.org/changeset/103513> 526129 13 webkit.review.bot 2011-12-22 02:48:17 -0800 All reviewed patches have been landed. Closing bug. 120105 2011-12-20 15:58:41 -0800 2011-12-21 10:32:16 -0800 Patch bug-74970-20111220155840.patch text/plain 1327 gbillock U3VidmVyc2lvbiBSZXZpc2lvbjogMTAyNjU0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOWVjMTc4Nzg3N2U2N2U2 ZjhkODAxY2NjNzYzYmJiMjdhNzE5OGIxYi4uZGNmZmVlMGJhMDA5NTZmMTE4MzBkMGU5MTdkM2U2 N2E4YWI5YTRiNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDExLTEyLTIwICBHcmVn IEJpbGxvY2sgIDxnYmlsbG9ja0Bnb29nbGUuY29tPgorCisgICAgICAgIFtDb3Zlcml0eV0gQWRk cmVzcyB1c2UtYWZ0ZXItZnJlZSByZXBvcnQgaW4gTWVtb3J5Q2FjaGUKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc0OTcwCisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBsb2FkZXIvY2FjaGUvTWVtb3J5Q2Fj aGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6TWVtb3J5Q2FjaGU6OnJldmFsaWRhdGlvblN1Y2Nl ZWRlZCk6CisKIDIwMTEtMTItMTIgIEtlbm5ldGggUnVzc2VsbCAgPGtickBnb29nbGUuY29tPgog CiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxpbmcgb3V0IHIxMDI2NDguCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViQ29yZS9sb2FkZXIvY2FjaGUvTWVtb3J5Q2FjaGUuY3BwIGIvU291cmNlL1dlYkNv cmUvbG9hZGVyL2NhY2hlL01lbW9yeUNhY2hlLmNwcAppbmRleCAzNDQzZWRhZTNmYjllZWE3NmZh ZGM2MzdkYjQ4NWE1MmJkMjZmMWM4Li5jYTkyZGQ1NDdjNTY2YmEwNTgzOWIyYjdiZTdhMjY1MTI3 YzczZDAxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvY2FjaGUvTWVtb3J5Q2Fj aGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9NZW1vcnlDYWNoZS5jcHAK QEAgLTEwNSw3ICsxMDUsOCBAQCB2b2lkIE1lbW9yeUNhY2hlOjpyZXZhbGlkYXRpb25TdWNjZWVk ZWQoQ2FjaGVkUmVzb3VyY2UqIHJldmFsaWRhdGluZ1Jlc291cmNlLCBjbwogICAgIEFTU0VSVCgh cmVzb3VyY2UtPmluQ2FjaGUoKSk7CiAgICAgQVNTRVJUKHJlc291cmNlLT5pc0xvYWRlZCgpKTsK ICAgICBBU1NFUlQocmV2YWxpZGF0aW5nUmVzb3VyY2UtPmluQ2FjaGUoKSk7Ci0gICAgCisgICAg QVNTRVJUKCFyZXZhbGlkYXRpbmdSZXNvdXJjZS0+Y2FuRGVsZXRlKCkpOworCiAgICAgZXZpY3Qo cmV2YWxpZGF0aW5nUmVzb3VyY2UpOwogCiAgICAgQVNTRVJUKCFtX3Jlc291cmNlcy5nZXQocmVz b3VyY2UtPnVybCgpKSk7Cg== 120191 2011-12-21 10:32:23 -0800 2011-12-21 14:53:22 -0800 Patch bug-74970-20111221103221.patch text/plain 1494 gbillock U3VidmVyc2lvbiBSZXZpc2lvbjogMTAzMzk5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTk0N2M2ZjNjYmExNzFi N2ExYWJhMWU0MmUzOGIwZGQxYmQ5ZjgxNS4uODAxZWZhZDljOGEyOGNhY2JhOWU3YWQ2Y2RhM2Q0 Yzk1MmFmZjk3ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDExLTEyLTIwICBHcmVn IEJpbGxvY2sgIDxnYmlsbG9ja0Bnb29nbGUuY29tPgorCisgICAgICAgIFtDb3Zlcml0eV0gQWRk cmVzcyB1c2UtYWZ0ZXItZnJlZSByZXBvcnQgaW4gTWVtb3J5Q2FjaGUKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc0OTcwCisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBsb2FkZXIvY2FjaGUvTWVtb3J5Q2Fj aGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6TWVtb3J5Q2FjaGU6OnJldmFsaWRhdGlvblN1Y2Nl ZWRlZCk6CisKIDIwMTEtMTItMjEgIE1hdHQgRmFsa2VuaGFnZW4gIDxmYWxrZW5AY2hyb21pdW0u b3JnPgogCiAgICAgICAgIEFkZCBhbGwgSUNVIGxhbmd1YWdlcyB0byBMb2NhbGVUb1NjcmlwdE1h cHBpbmdEZWZhdWx0LmNwcApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hl L01lbW9yeUNhY2hlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9NZW1vcnlDYWNo ZS5jcHAKaW5kZXggMzQ0M2VkYWUzZmI5ZWVhNzZmYWRjNjM3ZGI0ODVhNTJiZDI2ZjFjOC4uNTg4 MWU0NWEzYmQ1NDkyYjJmOGU0ODY0NDY2YmJlYzdmOWNmZmJlNCAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvbG9hZGVyL2NhY2hlL01lbW9yeUNhY2hlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29y ZS9sb2FkZXIvY2FjaGUvTWVtb3J5Q2FjaGUuY3BwCkBAIC0xMDUsNyArMTA1LDExIEBAIHZvaWQg TWVtb3J5Q2FjaGU6OnJldmFsaWRhdGlvblN1Y2NlZWRlZChDYWNoZWRSZXNvdXJjZSogcmV2YWxp ZGF0aW5nUmVzb3VyY2UsIGNvCiAgICAgQVNTRVJUKCFyZXNvdXJjZS0+aW5DYWNoZSgpKTsKICAg ICBBU1NFUlQocmVzb3VyY2UtPmlzTG9hZGVkKCkpOwogICAgIEFTU0VSVChyZXZhbGlkYXRpbmdS ZXNvdXJjZS0+aW5DYWNoZSgpKTsKLSAgICAKKworICAgIC8vIFRoZSBldmljdCgpIGNhbGwgY2Fu IGRlbGV0ZSByZXZhbGlkYXRpbmdSZXNvdXJjZSwgd2hpY2ggd2UgdGhlbiB1c2UKKyAgICAvLyBi ZWxvdy4gQXNzZXJ0IGV4cGxpY2l0bHkgdGhhdCB0aGlzIGNhbid0IGhhcHBlbi4KKyAgICBBU1NF UlQoIXJldmFsaWRhdGluZ1Jlc291cmNlLT5jYW5EZWxldGUoKSk7CisKICAgICBldmljdChyZXZh bGlkYXRpbmdSZXNvdXJjZSk7CiAKICAgICBBU1NFUlQoIW1fcmVzb3VyY2VzLmdldChyZXNvdXJj ZS0+dXJsKCkpKTsK 120223 2011-12-21 14:53:26 -0800 2011-12-22 02:48:12 -0800 Patch bug-74970-20111221145325.patch text/plain 1558 gbillock U3VidmVyc2lvbiBSZXZpc2lvbjogMTAzMzk5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTk0N2M2ZjNjYmExNzFi N2ExYWJhMWU0MmUzOGIwZGQxYmQ5ZjgxNS4uODAxZWZhZDljOGEyOGNhY2JhOWU3YWQ2Y2RhM2Q0 Yzk1MmFmZjk3ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDExLTEyLTIwICBHcmVn IEJpbGxvY2sgIDxnYmlsbG9ja0Bnb29nbGUuY29tPgorCisgICAgICAgIFtDb3Zlcml0eV0gQWRk cmVzcyB1c2UtYWZ0ZXItZnJlZSByZXBvcnQgaW4gTWVtb3J5Q2FjaGUKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc0OTcwCisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBsb2FkZXIvY2FjaGUvTWVtb3J5Q2Fj aGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6TWVtb3J5Q2FjaGU6OnJldmFsaWRhdGlvblN1Y2Nl ZWRlZCk6CisKIDIwMTEtMTItMjEgIE1hdHQgRmFsa2VuaGFnZW4gIDxmYWxrZW5AY2hyb21pdW0u b3JnPgogCiAgICAgICAgIEFkZCBhbGwgSUNVIGxhbmd1YWdlcyB0byBMb2NhbGVUb1NjcmlwdE1h cHBpbmdEZWZhdWx0LmNwcApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hl L01lbW9yeUNhY2hlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9NZW1vcnlDYWNo ZS5jcHAKaW5kZXggMzQ0M2VkYWUzZmI5ZWVhNzZmYWRjNjM3ZGI0ODVhNTJiZDI2ZjFjOC4uNDUx NDJhMjc3OGU4ZGFlODZiOGU2NjkxNmM0NGY4YTRiNmE3MzFkNyAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvbG9hZGVyL2NhY2hlL01lbW9yeUNhY2hlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29y ZS9sb2FkZXIvY2FjaGUvTWVtb3J5Q2FjaGUuY3BwCkBAIC0xMDUsNyArMTA1LDEyIEBAIHZvaWQg TWVtb3J5Q2FjaGU6OnJldmFsaWRhdGlvblN1Y2NlZWRlZChDYWNoZWRSZXNvdXJjZSogcmV2YWxp ZGF0aW5nUmVzb3VyY2UsIGNvCiAgICAgQVNTRVJUKCFyZXNvdXJjZS0+aW5DYWNoZSgpKTsKICAg ICBBU1NFUlQocmVzb3VyY2UtPmlzTG9hZGVkKCkpOwogICAgIEFTU0VSVChyZXZhbGlkYXRpbmdS ZXNvdXJjZS0+aW5DYWNoZSgpKTsKLSAgICAKKworICAgIC8vIENhbGxpbmcgZXZpY3QoKSBjYW4g cG90ZW50aWFsbHkgZGVsZXRlIHJldmFsaWRhdGluZ1Jlc291cmNlLCB3aGljaCB3ZSB1c2UKKyAg ICAvLyBiZWxvdy4gVGhpcyBtdXN0bid0IGJlIHRoZSBjYXNlIHNpbmNlIHJldmFsaWRhdGlvbiBt ZWFucyBpdCBpcyBsb2FkZWQKKyAgICAvLyBhbmQgc28gY2FuRGVsZXRlKCkgaXMgZmFsc2UuCisg ICAgQVNTRVJUKCFyZXZhbGlkYXRpbmdSZXNvdXJjZS0+Y2FuRGVsZXRlKCkpOworCiAgICAgZXZp Y3QocmV2YWxpZGF0aW5nUmVzb3VyY2UpOwogCiAgICAgQVNTRVJUKCFtX3Jlc291cmNlcy5nZXQo cmVzb3VyY2UtPnVybCgpKSk7Cg==