Bug 171801

Summary: Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
Product: WebKit Reporter: Kamil Frankowicz <kamil.frankowicz>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: fpizlo, ggaren, jfbastien, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
POC to trigger null pointer dereference (jsc)
none
the patch msaboff: review+

Kamil Frankowicz
Reported 2017-05-08 03:49:13 PDT
Created attachment 309352 [details] POC to trigger null pointer dereference (jsc) Affected SVN revision: 216356 To reproduce the problem: ./jsc jsc_null_ptr_ref_ptr.js ASAN Output: ==21363==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f1a0150fc49 bp 0x7ffec7ffda30 sp 0x7ffec7ffd7c0 T0) ==21363==The signal is caused by a READ memory access. ==21363==Hint: address points to the zero page. #0 0x7f1a0150fc48 in WTF::RefPtr<WTF::StringImpl>::operator!() const /XYZ/WebKit/Source/WTF/wtf/RefPtr.h:76:38 #1 0x7f1a0150fc48 in WTF::String::isNull() const /XYZ/WebKit/Source/WTF/wtf/text/WTFString.h:150 #2 0x7f1a0150fc48 in JSC::JSString::isRope() const /XYZ/WebKit/Source/JavaScriptCore/runtime/JSString.h:208 #3 0x7f1a0150fc48 in JSC::JSString::toAtomicString(JSC::ExecState*) const /XYZ/WebKit/Source/JavaScriptCore/runtime/JSString.h:529 #4 0x7f1a0150fc48 in JSC::JSString::toIdentifier(JSC::ExecState*) const /XYZ/WebKit/Source/JavaScriptCore/runtime/JSString.h:524 #5 0x7f1a0150fc48 in slow_path_get_direct_pname /XYZ/WebKit/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:732 #6 0x7f1a00ce76d9 (/XYZ/WebKit/WebKitBuild/Release/lib/libJavaScriptCore.so.1+0x2b9f6d9) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /XYZ/WebKit/Source/WTF/wtf/RefPtr.h:76:38 in WTF::RefPtr<WTF::StringImpl>::operator!() const ==21363==ABORTING
Attachments
POC to trigger null pointer dereference (jsc) (87 bytes, application/javascript)
2017-05-08 03:49 PDT, Kamil Frankowicz 		no flags
Details
the patch (5.13 KB, patch)
2017-05-10 09:04 PDT, Filip Pizlo 		msaboff: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2017-05-08 19:53:34 PDT
<rdar://problem/32066936>
Filip Pizlo
Comment 2 2017-05-10 09:04:55 PDT
Created attachment 309611 [details] the patch
Michael Saboff
Comment 3 2017-05-10 09:11:10 PDT
Comment on attachment 309611 [details] the patch r=me
Filip Pizlo
Comment 4 2017-05-10 10:00:41 PDT
Landed in https://trac.webkit.org/changeset/216593/webkit
Note You need to log in before you can comment on or make changes to this bug.