Bug 149281 – Regression(r189881): release assertion hit in toJS(ExecState*, JSDOMGlobalObject*, DocumentFragment*)

• Component: DOM
• Status: RESOLVED FIXED

[Chris Dumez]

release assertion hit in toJS(ExecState*, JSDOMGlobalObject*, DocumentFragment*) after <http://trac.webkit.org/changeset/189881>:
Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x00000000bbadbeef

VM Regions Near 0xbbadbeef:
--> 
    __TEXT                 0000000100d8f000-0000000100d91000 [    8K] r-x/rwx SM=COW  /Volumes/VOLUME/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development

Application Specific Information:
CRASHING TEST: plugins/snapshotting/snapshot-plugin-not-quite-blocked-by-image.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000106917d1e WTFCrash + 62
1   com.apple.WebCore             	0x0000000107826155 WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::DocumentFragment*) + 149
2   com.apple.WebCore             	0x00000001072cf527 WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot(WebCore::ShadowRoot*) + 391
3   com.apple.WebCore             	0x0000000107599f9e WebCore::Element::addShadowRoot(WTF::Ref<WebCore::ShadowRoot>&&) + 558
4   com.apple.WebCore             	0x0000000107139a43 WebCore::Element::ensureUserAgentShadowRoot() + 83
5   com.apple.WebCore             	0x000000010705f50d WebCore::ThreadTimers::sharedTimerFiredInternal() + 157
6   com.apple.WebCore             	0x000000010705f438 WebCore::timerFired(__CFRunLoopTimer*, void*) + 24

[Chris Dumez]

The assertion is:
    // If you hit this assertion you either have a use after free bug, or
    // DocumentFragment has subclasses. If DocumentFragment has subclasses that get passed
    // to toJS() we currently require DocumentFragment you to opt out of binding hardening
    // by adding the SkipVTableValidation attribute to the interface IDL definition
    RELEASE_ASSERT(actualVTablePointer == expectedVTablePointer);

DocumentFragment does have a subclass: ShadowRoot. However, ShadowRoot does not have a Web-Exposed type. Therefore, I believe the current code is safe and we should bypass the assertion here.

[Ryosuke Niwa]

ShadowRoot will be exposed to Web now.

[Chris Dumez]

Created attachment 261420 [details]
Patch

[Chris Dumez]

Created attachment 261443 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 261443 [details]
Patch

Clearing flags on attachment: 261443

Committed r189949: <http://trac.webkit.org/changeset/189949>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.