Bug 12463

Summary: WebArchiver - attempt to insert nil exception when archive empty iframe
Product: WebKit Reporter: Jim Correia <jim.correia>
Component: WebKit Misc.Assignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: darin, ddkilzer
Priority: P2 Keywords: HasReduction, InRadar
Version: 420+   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
Test Case described in bug body.
none
Patch/fix.
none
changelog
none
Test (will crash ToT!)
none
Stack trace
none
testcase
none
testcase
none
revised patch
none
revised patch (no tabs this time)
none
patch
ddkilzer: review-
Patch v2 darin: review+

Jim Correia
Reported 2007-01-29 12:02:13 PST
If you attempt to archive the main frame of a page like the attached one with an empty iframe, during the archiving process an exception will be raised: *** -[NSCFArray addObject:]: attempt to insert nil WebResource's designated initializer returns nil if there is no mainResource, but the calling code doesn't handle this. Patch attached. To reproduce archive the main frame of any product page loaded from amazon.com: <http://www.amazon.com/Beginning-Tiger-Dashboard-Widget-Development/dp/0471778257/sr=8-2/qid=1170100387/ref=sr_1_2/105-9135809-2773235?ie=UTF8&s=books> Reduced test case attached.
Attachments
Test Case described in bug body. (358 bytes, text/html)
2007-01-29 12:02 PST, Jim Correia
no flags
Patch/fix. (809 bytes, patch)
2007-01-29 12:03 PST, Jim Correia
no flags
changelog (207 bytes, text/plain)
2007-01-29 12:28 PST, Jim Correia
no flags
Test (will crash ToT!) (838 bytes, application/x-webarchive)
2007-01-29 12:30 PST, David Kilzer (:ddkilzer)
no flags
Stack trace (2.01 KB, text/plain)
2007-01-29 12:34 PST, David Kilzer (:ddkilzer)
no flags
testcase (26.64 KB, application/zip)
2007-01-29 14:13 PST, Jim Correia
no flags
testcase (26.67 KB, application/zip)
2007-01-29 16:08 PST, Jim Correia
no flags
revised patch (1.37 KB, patch)
2007-01-29 20:42 PST, Jim Correia
no flags
revised patch (no tabs this time) (1.37 KB, patch)
2007-01-29 21:01 PST, Jim Correia
no flags
patch (2.09 KB, patch)
2007-01-30 05:42 PST, Jim Correia
ddkilzer: review-
Patch v2 (26.05 KB, patch)
2007-03-07 04:06 PST, David Kilzer (:ddkilzer)
darin: review+
Jim Correia
Comment 1 2007-01-29 12:02:56 PST
Created attachment 12750 [details] Test Case described in bug body.
Jim Correia
Comment 2 2007-01-29 12:03:34 PST
Created attachment 12751 [details] Patch/fix.
David Kilzer (:ddkilzer)
Comment 3 2007-01-29 12:27:59 PST
The crash occurs when opening the archive, not when initially saving it. Shipping Safari 2.0.4 (419.3) on Mac OS X 10.4.8 (8N1037) does NOT crash when opening such a webarchive. Confirmed crash with locally-built debug build of WebKit r19232 with Safari 2.0.4 (419.3) on Mac OS X 10.4.8 (8N1037).
Jim Correia
Comment 4 2007-01-29 12:28:48 PST
Created attachment 12753 [details] changelog
David Kilzer (:ddkilzer)
Comment 5 2007-01-29 12:30:07 PST
Created attachment 12754 [details] Test (will crash ToT!)
David Kilzer (:ddkilzer)
Comment 6 2007-01-29 12:34:01 PST
Created attachment 12756 [details] Stack trace Note that this is appears to be crashing from a missing nil/null check in the new loader code that used to be "free" with the old ObjC loader code. Another way to fix this bug is to add a nil check to the loader in the appropriate place.
Jim Correia
Comment 7 2007-01-29 13:01:55 PST
Dave - I think they are really two distinct issues. I have not tested the loading case at all. The bug I am referring to is the result of an -addObject:nil being sent to a mutable array as the archive is created. This is corrected in my patch. Do you need a sample application which demonstrates the problem, or is the description and patch sufficient?
David Kilzer (:ddkilzer)
Comment 8 2007-01-29 13:21:49 PST
(In reply to comment #7) > Dave - I think they are really two distinct issues. I have not tested the > loading case at all. > > The bug I am referring to is the result of an -addObject:nil being sent to a > mutable array as the archive is created. This is corrected in my patch. > > Do you need a sample application which demonstrates the problem, or is the > description and patch sufficient? Interesting! What version of Safari/WebKit did you use to cause the crash when saving the webarchive?
Jim Correia
Comment 9 2007-01-29 14:12:39 PST
(In reply to comment #8) > Interesting! What version of Safari/WebKit did you use to cause the crash when > saving the webarchive? I wasn't using Safari. Safari doesn't archive the frame/data source, but instead the current DOM. This has its own set of issues which I am trying to avoid. [1] :-) I'll attach a sample which demonstrates the problem the patch seeks to solve. This was testing against trunk builds of WebKit. [1] Safari issue logged as rdar://problem/4961915
Jim Correia
Comment 10 2007-01-29 14:13:28 PST
Created attachment 12758 [details] testcase
David Kilzer (:ddkilzer)
Comment 11 2007-01-29 15:09:07 PST
Comment on attachment 12754 [details] Test (will crash ToT!) Test case for Bug 12467.
David Kilzer (:ddkilzer)
Comment 12 2007-01-29 15:09:48 PST
Comment on attachment 12756 [details] Stack trace Stack trace for Bug 12467.
David Kilzer (:ddkilzer)
Comment 13 2007-01-29 15:13:08 PST
Removing Regression keyword since I'm not sure if this is a regression. (Jim, does this crash with the shipping WebKit framework on Tiger?). It's a crasher, so it's still P1.
David Kilzer (:ddkilzer)
Comment 14 2007-01-29 15:31:31 PST
(In reply to comment #13) > Removing Regression keyword since I'm not sure if this is a regression. (Jim, > does this crash with the shipping WebKit framework on Tiger?). > > It's a crasher, so it's still P1. Jim, is the test application supposed to crash? Or does it simply not write a file when it fails?
Jim Correia
Comment 15 2007-01-29 16:08:42 PST
Created attachment 12764 [details] testcase
Jim Correia
Comment 16 2007-01-29 16:11:06 PST
> Jim, is the test application supposed to crash? Or does it simply not write a > file when it fails? The failure case is that a file isn't written because generating the WebArchive fails due to an exception. You should see this logged in the console: 2007-01-29 18:59:25.100 WebArchiveTester[15984] *** -[NSCFArray addObject:]: attempt to insert nil I had a stupid bug in the last testcase app, so I've attached the fixed version which shows the prob.em. The same problem happens with shipping WebKit on Tiger, but for a similar reason in a different piece of code (since the code has been significantly reworked since the Tiger snapshot.)
Jim Correia
Comment 17 2007-01-29 20:42:49 PST
Created attachment 12771 [details] revised patch The revised patch corrects brace formatting and includes a changelog.
Jim Correia
Comment 18 2007-01-29 21:01:07 PST
Created attachment 12773 [details] revised patch (no tabs this time)
Darin Adler
Comment 19 2007-01-29 22:14:27 PST
Comment on attachment 12773 [details] revised patch (no tabs this time) Looks fine, but don't we need the same change in this method? + _archiveWithMarkupString:fromFrame:nodes: I'd like to see this test added to the regression tests somehow. I think that can be done by enhancing DumpRenderTree.
Jim Correia
Comment 20 2007-01-30 05:42:37 PST
Created attachment 12789 [details] patch Revised patch with additional fix as suggested by darin.
Darin Adler
Comment 21 2007-01-30 09:49:26 PST
Comment on attachment 12789 [details] patch r=me I'd much prefer this with a test in our regression tests. I think there *is* a way to do this with Dave Kilzer's new work.
David Kilzer (:ddkilzer)
Comment 22 2007-01-30 10:05:32 PST
(In reply to comment #21) > I'd much prefer this with a test in our regression tests. I think there *is* a > way to do this with Dave Kilzer's new work. According to Jim, Safari doesn't use this code path to create webarchive files, so this would have to be an ObjC test.
David Kilzer (:ddkilzer)
Comment 23 2007-01-30 10:10:58 PST
(In reply to comment #22) > (In reply to comment #21) > > I'd much prefer this with a test in our regression tests. I think there *is* a > > way to do this with Dave Kilzer's new work. > According to Jim, Safari doesn't use this code path to create webarchive files, > so this would have to be an ObjC test. Which is to say that Bug 11882 changes DumpRenderTree to create webarchive test output using the same method that Safari does (I think). I suppose we could add a different code path to DRT, or add some kind of option to the layoutTestController.dumpAsWebArchive() method to use a different code path. I'll look into it.
Mark Rowe (bdash)
Comment 24 2007-02-01 18:41:14 PST
David Kilzer (:ddkilzer)
Comment 25 2007-02-04 22:27:56 PST
Comment on attachment 12789 [details] patch >- [subframeArchives addObject:[self _archiveCurrentStateForFrame:childFrame]]; >+ WebArchive *childFrameArchive = [self archiveFrame:childFrame]; >+ if (childFrameArchive) >+ [subframeArchives addObject:childFrameArchive]; This is wrong for two reasons: 1. The new code does not match the behavior of the old code. 2. This code doesn't exhibit the same problem that the archiveFrame: method does. After the page is loaded, the iframe contains "about:blank" when the WebArchiver archives the page, so there will never be an attempt to add nil to an NSMutableArray. Darin, I need to extend DRT to make this fix testable. The current method name is dumpAsWebArchive(), but I need two methods, one that dumps the current DOM into a webarchive (which is the current behavior) and one that dumps the original source into a webarchive. I'm thinking of: dumpDOMAsWebArchive() and dumpSourceAsWebArchive() or dumpFrameAsWebArchive(). Any opinions?
David Kilzer (:ddkilzer)
Comment 26 2007-02-04 22:29:44 PST
Comment on attachment 12773 [details] revised patch (no tabs this time) Clearing darin's r+ on old patch.
David Kilzer (:ddkilzer)
Comment 27 2007-03-07 04:06:55 PST
Created attachment 13514 [details] Patch v2 Addresses issues in Comment #19, Comment #21 and Comment #25. DRT and LayoutTest changes made at 32,000 ft over the western U.S. with my MBP in a "V" shape on my lap because the person in front of me reclined his seatback. (Reclining mine didn't help as I was just in front of the exit row. So close to real leg room, and yet, so far away.)
Darin Adler
Comment 28 2007-03-07 06:25:22 PST
Comment on attachment 13514 [details] Patch v2 r=me
David Kilzer (:ddkilzer)
Comment 29 2007-03-07 07:14:49 PST
Committed revision 20018.
Note You need to log in before you can comment on or make changes to this bug.