Bug 108709 – SVG DOM manipulation crash

• Component: SVG
• Status: RESOLVED FIXED

[Cris Neckar]

Created attachment 186162 [details]
repro

Originally filed by [e-mail] at https://crbug.com/171363

Chrome Version: 25.0.1364.36
Operating System: Ubuntu 10.04

URL (if applicable) where crash occurred: http://shinobi.dempsky.org/~matthew/misc/chrome-svg-crash.html

Can you reproduce this crash? Yes, 100% reliable.

What steps will reproduce this crash? (or if it's not reproducible, what were you doing just before the crash)?

1. Navigate to http://shinobi.dempsky.org/~matthew/misc/chrome-svg-crash.html
2. Click the left orange square.
3. Crash.



The bug exists when there are multiple event handlers on a node in an SVG use tree and the first handler causes the tree to be rebuilt. The target of the event remains the now removed node from the original use tree. I am not certain that this is a security issue, but I suspect it is due to a heap-use-after-free scenario. Maybe the ref-counting on the target is enough to avoid the heap-use-after-free.

It is NOT a security bug in the example because it is a Chrome mouse event handler that is second to be invoked, and Chrome cannot access a WebNode for the deleted node (it's null).

[Stephen Chenney]

Created attachment 187703 [details]
Patch

[WebKit Review Bot]

Comment on attachment 187703 [details]
Patch

Clearing flags on attachment: 187703

Committed r142548: <http://trac.webkit.org/changeset/142548>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.