Bug 178009 – Null pointer crash under JSC::Lexer<wchar_t>::setCode.

• Component: JavaScriptCore
• Status: NEW

[Per Arne Vollan]

0d47bdf4 6af567ed 1aa551b8 0d47d218 0d47e880 JavaScriptCore!JSC::Lexer<wchar_t>::setCode+0x11b
0d47be28 6abb292d 0574e0d8 1aa551b8 00000001 JavaScriptCore!JSC::Parser<JSC::Lexer<wchar_t> >::Parser<JSC::Lexer<wchar_t> >+0x2bd
0d47e7fc 6abd8a2d 0d47e880 0574e0d8 1aa551b8 JavaScriptCore!JSC::parse<JSC::ProgramNode>+0x18d
0d47e904 6abd163b 0574e0d8 1aa551b8 0d47e930 JavaScriptCore!JSC::BuiltinExecutables::createExecutable+0x1cd
0d47e938 6abb8e77 0574e0d8 1aa551b8 76eee400 JavaScriptCore!JSC::BuiltinExecutables::stringIteratorPrototypeNextCodeExecutable+0x6b
0d47e954 6b03c067 0574e0d8 0d47ea84 0574e0d8 JavaScriptCore!JSC::stringIteratorPrototypeNextCodeGenerator+0x27
0d47e974 6b0678b3 0574e0d8 00000000 0d47e9d4 JavaScriptCore!JSC::reifyStaticProperty+0x37
0d47e9bc 6b03af0b 0574e0d8 00000000 6b25d618 JavaScriptCore!JSC::setUpStaticFunctionSlot+0xc3
0d47ea04 6b02cc4f 0574e0d8 00000000 6b1e3a44 JavaScriptCore!JSC::getStaticPropertySlotFromTable+0x12b
0d47ea30 6b017efe 0574e0d8 0a04d0b0 0d47ea84 JavaScriptCore!JSC::JSObject::getOwnStaticPropertySlot+0x2f
0d47eac0 6b00c6e9 0d47ee88 09cb4160 0b591028 JavaScriptCore!<lambda_44573b79eef68b208cfc4e8544f09b9e>::operator()+0x1be
0d47fb10 6b0032a3 0574e0d8 0574e0d8 0571c0a0 JavaScriptCore!JSC::JSGlobalObject::init+0x5e79
0d47fb28 672b34d0 00000000 09e540a0 0571c0a0 JavaScriptCore!JSC::JSGlobalObject::finishCreation+0x53
0d47fb40 677eca84 0574e0d8 09e540a0 0571c0a0 WebKit!WebCore::JSWorkerGlobalScopeBase::finishCreation+0x40
0d47fb5c 672ae124 0574e0d8 09e540a0 09d2027c WebKit!WebCore::JSWorkerGlobalScope::finishCreation+0x14
0d47fba4 672ad87b 09d2027c 0a04e3f0 09d20270 WebKit!WebCore::WorkerScriptController::initScript+0x1a4
0d47fbe4 672ad7df 0d47fc1c 0d47fbfc 09d202b8 WebKit!WebCore::WorkerScriptController::evaluate+0x3b
0d47fc04 6739a425 0d47fc1c 1bac9508 19e38430 WebKit!WebCore::WorkerScriptController::evaluate+0x2f
0d47fc74 6ab13f89 1aa53b90 6ab39490 1aa53b90 WebKit!WebCore::WorkerThread::workerThread+0x1c5
0d47fc90 6ab3949b 09d5e4b0 0d47fcd8 6ab62b24 WTF!WTF::Thread::entryPoint+0xa9
0d47fc9c 6ab62b24 19e38420 cdd6bc28 00000000 WTF!WTF::wtfThreadEntryPoint+0xb
0d47fcd8 759a336a 1aa53b90 0d47fd24 76ef9902 WTF!thread_start<unsigned int (__stdcall*)(void *)>+0x57

[Per Arne Vollan]

Created attachment 323016 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 323016 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=323016&action=review

> Source/JavaScriptCore/ChangeLog:8
> +        Add null pointer check.

Can a regression test be added for this?

[Per Arne Vollan]

(In reply to Alexey Proskuryakov from comment #2)
> Comment on attachment 323016 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=323016&action=review
> 
> > Source/JavaScriptCore/ChangeLog:8
> > +        Add null pointer check.
> 
> Can a regression test be added for this?

It crashed during layout tests (on Windows), so I believe we have test coverage. But maybe we should add a specific test for this?

Thanks for reviewing!

[Saam Barati]

Comment on attachment 323016 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=323016&action=review

> Source/JavaScriptCore/parser/Lexer.cpp:570
> +    if (LIKELY(m_code < m_codeEnd && m_code))

I don’t see why this is needed. Why would m_codeEnd be > m_code if it’s null? I’d expect us to have these two pointers be equal in this case

[Alexey Proskuryakov]

Yeah, this feels more like an actual bug than a missing null check.

[Maciej Stachowiak]

Comment on attachment 323016 [details]
Patch

Even though this patch still builds and seems to pass tests, per prior comments, it seems like if there is a bug here it should be fixed at a higher level. m_codeEnd should also be null when m_code_is, so m_code shouldn't be less than.