Bug 180769

Summary:

Crash inside ImageLoader::updateFromElement()

Product:

WebKit

Reporter:

Ryosuke Niwa <rniwa>

Component:

DOM

Assignee:

Ryosuke Niwa <rniwa>

Status:

REOPENED

Severity:

Normal

CC:

cdumez, commit-queue, koivisto, sabouhallawa, simon.fraser, webkit-bug-importer, zalan

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

180729, 180855

Bug Blocks:

Attachments:

Description	Flags
Fixes the crash	none

Ryosuke Niwa

Reported 2017-12-13 14:38:22 PST

Because ImageLoader::updateFromElement() can send a sync IPC with the following stack trace and execute arbitrary scripts while waiting for the response, it's not safe to call this function where NoEventDispatchAssertion is present. 3 WebKit: IPC::Connection::SyncMessageState::dispatchMessages(IPC::Connection*) 3 WebKit: IPC::Connection::waitForSyncReply(unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) 3 WebKit: IPC::Connection::sendSyncMessage(unsigned long long, std::__1::unique_ptr<IPC::Encoder, std::__1::default_delete<IPC::Encoder> >, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) 3 WebKit: bool IPC::Connection::sendSync<Messages::NetworkConnectionToWebProcess::CookieRequestHeaderFieldValue>(Messages::NetworkConnectionToWebProcess::CookieRequestHeaderFieldValue&&, Messages::NetworkConnectionToWebProcess::CookieRequestHeaderFieldValue::Reply&&, unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) 3 WebKit: WebKit::WebPlatformStrategies::cookieRequestHeaderFieldValue(WebCore::SessionID, WebCore::URL const&, WebCore::URL const&) 3 WebCore: WebCore::verifyVaryingRequestHeaders(WTF::Vector<std::__1::pair<WTF::String, WTF::String>, 0ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::ResourceRequest const&, WebCore::SessionID) 3 WebCore: WebCore::CachedResource::varyHeaderValuesMatch(WebCore::ResourceRequest const&) 3 WebCore: WebCore::CachedResourceLoader::determineRevalidationPolicy(WebCore::CachedResource::Type, WebCore::CachedResourceRequest&, WebCore::CachedResource*, WebCore::CachedResourceLoader::ForPreload, WebCore::CachedResourceLoader::DeferOption) const 3 WebCore: WebCore::CachedResourceLoader::requestResource(WebCore::CachedResource::Type, WebCore::CachedResourceRequest&&, WebCore::CachedResourceLoader::ForPreload, WebCore::CachedResourceLoader::DeferOption) 3 WebCore: WebCore::CachedResourceLoader::requestImage(WebCore::CachedResourceRequest&&) 3 WebCore: WebCore::ImageLoader::updateFromElement()

Attachments
Fixes the crash (19.25 KB, patch) 2017-12-13 14:50 PST, Ryosuke Niwa	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Ryosuke Niwa

Comment 1 2017-12-13 14:38:42 PST

<rdar://problem/35278782>

Ryosuke Niwa

Comment 2 2017-12-13 14:50:42 PST

Created attachment 329262 [details] Fixes the crash

WebKit Commit Bot

Comment 3 2017-12-13 16:05:46 PST

Comment on attachment 329262 [details] Fixes the crash Clearing flags on attachment: 329262 Committed r225878: <https://trac.webkit.org/changeset/225878>

WebKit Commit Bot

Comment 4 2017-12-13 16:05:48 PST

All reviewed patches have been landed. Closing bug.

WebKit Commit Bot

Comment 5 2017-12-14 17:36:17 PST

Re-opened since this is blocked by bug 180855

Note You need to log in before you can comment on or make changes to this bug.