Bug 192357 – [iOS] Using file upload can trigger a crash under RenderThemeIOS::paintFileUploadIconDecorations()

• Component: JavaScriptCore
• Status: RESOLVED FIXED

Created attachment 356477 [details]
crash log from iphone, ios12

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000000
appear when trying to upload image

[Wenson Hsieh]

Symbolicated:

0   WebCore::GraphicsContext::platformContext() const
1   WebCore::RenderThemeIOS::paintFileUploadIconDecorations(WebCore::RenderObject const&, WebCore::RenderObject const&, WebCore::PaintInfo const&, WebCore::IntRect const&, WebCore::Icon*, WebCore::RenderTheme::FileUploadDecorations)
2   WebCore::RenderFileUploadControl::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
3   WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
4   WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*)
5   WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::GraphicsContext&, WebCore::GraphicsContext&, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*)
6   WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
7   WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
8   WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
9   WebCore::RenderLayer::paint(WebCore::GraphicsContext&, WebCore::LayoutRect const&, WebCore::LayoutSize const&, unsigned int, WebCore::RenderObject*, unsigned int, WebCore::RenderLayer::SecurityOriginPaintPolicy)
10  WebCore::FrameView::paintContents(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy)
11  WebCore::ScrollView::paint(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy)
12  WebCore::FrameView::traverseForPaintInvalidation(WebCore::GraphicsContext::PaintInvalidationReasons)
13  WebKit::RemoteLayerTreeDrawingArea::flushLayers()
14  WebCore::ThreadTimers::sharedTimerFiredInternal()
15  WebCore::timerFired(__CFRunLoopTimer*, void*)

Seems like <rdar://problem/42852260>

[David Kilzer (:ddkilzer)]

<rdar://problem/42852260>

[Radar WebKit Bug Importer]

<rdar://problem/46473200>

[David Kilzer (:ddkilzer)]

Which website were you using when the crash happened?

Obviously this doesn't crash on every file upload form or we would have fixed it long ago.  :)

[David Kilzer (:ddkilzer)]

<rdar://problem/42852260>

hi

tested link: 
https://legacy.custom-gateway.net/acp/app/?l=gifvt#p=1626496&r=2d-canvas&guid=99999

video of issue:
https://share.vidyard.com/watch/mBgeg4qANt2HcSrVswCkbC

[alan]

Created attachment 357985 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 357985 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=357985&action=review

> Source/WebCore/ChangeLog:3
> +        Do not try to paint the file picker when painting is disabled.

Maybe use my bug title.

[alan]

Created attachment 357989 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 357989 [details]
Patch

Clearing flags on attachment: 357989

Committed r239526: <https://trac.webkit.org/changeset/239526>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.