Summary: | [CoreIPC] Nullptr crash in Ref<SharedBuffer>::copyRef() via IPC::ArgumentCoder<WebCore::PasteboardCustomData, void>::decode | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> | ||||||||||||||||
Component: | HTML Editing | Assignee: | Rob Buis <rbuis> | ||||||||||||||||
Status: | RESOLVED FIXED | ||||||||||||||||||
Severity: | Normal | CC: | bfulgham, cdumez, cgarcia, commit-queue, ews-feeder, fred.wang, gpoo, jenner, product-security, rbuis, svillar, webkit-bug-importer, wenson_hsieh | ||||||||||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||||||||||
Version: | WebKit Nightly Build | ||||||||||||||||||
Hardware: | Unspecified | ||||||||||||||||||
OS: | Unspecified | ||||||||||||||||||
Bug Depends on: | 222689 | ||||||||||||||||||
Bug Blocks: | |||||||||||||||||||
Attachments: |
|
Description
Ryosuke Niwa
2021-02-04 18:13:20 PST
Created attachment 419359 [details]
Test
I get a different backtrace on MacOS: ASSERTION FAILED: node.isConnected() ./style/StyleScope.cpp(155) : static WebCore::Style::Scope &WebCore::Style::Scope::forNode(WebCore::Node &) 1 0x79ea9a899 WTFCrash 2 0x75fcc19e0 canLoad_libAccessibility__AXSIsolatedTreeMode 3 0x76c724678 WebCore::Style::Scope::forNode(WebCore::Node&) 4 0x76c60b7c1 WebCore::Style::ElementRuleCollector::matchSlottedPseudoElementRules() 5 0x76c60b3a0 WebCore::Style::ElementRuleCollector::collectMatchingAuthorRules() 6 0x76c60b235 WebCore::Style::ElementRuleCollector::matchAuthorRules() 7 0x76c6f2a61 WebCore::Style::Resolver::pseudoStyleRulesForElement(WebCore::Element const*, WebCore::PseudoId, unsigned int) 8 0x76c6f267e WebCore::Style::Resolver::styleRulesForElement(WebCore::Element const*, unsigned int) 9 0x768230939 WebCore::styleFromMatchedRulesForElement(WebCore::Element&, unsigned int) 10 0x768230dc7 WebCore::EditingStyle::removeStyleFromRulesAndContext(WebCore::StyledElement&, WebCore::Node*) 11 0x768362f7b WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(WebCore::ReplaceSelectionCommand::InsertedNodes&) 12 0x76836a094 WebCore::ReplaceSelectionCommand::doApply() 13 0x7681a20c8 WebCore::CompositeEditCommand::apply() 14 0x76825af35 WebCore::Editor::replaceSelectionWithFragment(WebCore::DocumentFragment&, WebCore::Editor::SelectReplacement, WebCore::Editor::SmartReplace, WebCore::Editor::MatchStyle, WebCore::EditAction, WebCore::MailBlockquoteHandling) 15 0x76825a13c WebCore::Editor::handleTextEvent(WebCore::TextEvent&) 16 0x769f55cc8 WebCore::EventHandler::defaultTextInputEventHandler(WebCore::TextEvent&) 17 0x767e690bb WebCore::Node::defaultEventHandler(WebCore::Event&) 18 0x767cdd8f3 WebCore::callDefaultEventHandlersInBubblingOrder(WebCore::Event&, WebCore::EventPath const&) 19 0x767cdca62 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) 20 0x767e67efd WebCore::Node::dispatchEvent(WebCore::Event&) 21 0x76825f71c WebCore::Editor::pasteAsFragment(WTF::Ref<WebCore::DocumentFragment, WTF::RawPtrTraits<WebCore::DocumentFragment> >&&, bool, bool, WebCore::MailBlockquoteHandling) 22 0x762599770 WebCore::Editor::pasteWithPasteboard(WebCore::Pasteboard*, WTF::OptionSet<WebCore::Editor::PasteOption>) 23 0x768270d1b WebCore::Editor::paste(WebCore::Pasteboard&, WebCore::Editor::FromMenuOrKeyBinding) 24 0x76827078d WebCore::Editor::paste(WebCore::Editor::FromMenuOrKeyBinding) 25 0x7682e57c2 WebCore::executePaste(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) 26 0x7682757a0 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const (In reply to Rob Buis from comment #2) > I get a different backtrace on MacOS: > ASSERTION FAILED: node.isConnected() This looks like a duplicate of bug 221651. Can you please try with the patch? (In reply to Frédéric Wang (:fredw) from comment #3) > (In reply to Rob Buis from comment #2) > > I get a different backtrace on MacOS: > > ASSERTION FAILED: node.isConnected() > > This looks like a duplicate of bug 221651. Can you please try with the patch? So checking now, actually the node.isConnected() failure is happening with a <slot> element (which always has `display: content`) ; so this is similar but different to bug 221651. Will investigate more... (rr) p showTree(&node) SUMMARY 0x7f04d475fde0 (renderer (nil)) STYLE=padding: 1px; (needs style recalc) #document-fragment 0x7f04d475fe70 (renderer (nil)) (needs style recalc) (child needs style recalc) DIV 0x7f04d4750010 (renderer (nil)) * SLOT 0x7f04d47500a0 (renderer (nil)) IMG 0x7f04d47513b0 (renderer (nil)) STYLE=caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: -webkit-standard; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-tap-highlight-color: rgba(0, 0, 0, 0.4); -webkit-text-stroke-width: 0px; text-decoration: none; $1 = void Comment on attachment 419359 [details] Test Sorry, this test is for https://bugs.webkit.org/show_bug.cgi?id=221440. Created attachment 421507 [details]
Test
(In reply to Ryosuke Niwa from comment #6) > Created attachment 421507 [details] > Test Thnx, now same bt is reproducible on MacOS, will have a look. (In reply to Rob Buis from comment #7) > (In reply to Ryosuke Niwa from comment #6) > > Created attachment 421507 [details] > > Test > > Thnx, now same bt is reproducible on MacOS, will have a look. Nice! Created attachment 421812 [details]
Patch
Comment on attachment 421812 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=421812&action=review > LayoutTests/ChangeLog:9 > + * ipc/pasteboard-write-custom-data-expected.txt: Added. > + * ipc/pasteboard-write-custom-data.html: Added. Oh, we probably need to skip this entire directory in release builds since this API isn't available there. Created attachment 421908 [details]
Patch
Comment on attachment 421812 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=421812&action=review >> LayoutTests/ChangeLog:9 >> + * ipc/pasteboard-write-custom-data.html: Added. > > Oh, we probably need to skip this entire directory in release builds since this API isn't available there. I made a mistake when trying to protect calling the API through testing window.IPC, should work this time. /Volumes/Data/worker/Commit-Queue/build/LayoutTests/ChangeLog neither lists a valid reviewer nor contains the string "Unreviewed" or "Rubber stamp" (case insensitive). Comment on attachment 421908 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=421908&action=review > LayoutTests/ChangeLog:7 > + Add test for this. > + You're missing: Reviewed by NOBODY (OOPS!). Comment on attachment 421908 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=421908&action=review >> LayoutTests/ChangeLog:7 >> + > > You're missing: Reviewed by NOBODY (OOPS!). Need more coffee :( Created attachment 421913 [details]
Patch
Committed r273727: <https://commits.webkit.org/r273727> All reviewed patches have been landed. Closing bug and clearing flags on attachment 421913 [details]. Re-opened since this is blocked by bug 222689 https://results.webkit.org/?suite=layout-tests&test=ipc%2Fpasteboard-write-custom-data.html https://build.webkit.org/results/Apple-BigSur-Debug-WK2-Tests/r273832%20(488)/ipc/pasteboard-write-custom-data-crash-log.txt Application Specific Information: CRASHING TEST: ipc/pasteboard-write-custom-data.html Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x0000000101d5c58e WTFCrash + 14 (Assertions.cpp:295) 1 com.apple.WebKit 0x000000010d90d1bb WTFCrashWithInfo(int, char const*, char const*, int) + 27 (Assertions.h:671) 2 com.apple.WebKit 0x000000010de137c9 IPC::MessageReceiverMap::dispatchSyncMessage(IPC::Connection&, IPC::Decoder&, std::__1::unique_ptr<IPC::Encoder, std::__1::default_delete<IPC::Encoder> >&) + 169 (MessageReceiverMap.cpp:133) 3 com.apple.WebKit 0x000000010ebccdc6 WebKit::AuxiliaryProcessProxy::dispatchSyncMessage(IPC::Connection&, IPC::Decoder&, std::__1::unique_ptr<IPC::Encoder, std::__1::default_delete<IPC::Encoder> >&) + 54 (AuxiliaryProcessProxy.cpp:226) 4 com.apple.WebKit 0x000000010ef2db7f WebKit::WebProcessProxy::didReceiveSyncMessage(IPC::Connection&, IPC::Decoder&, std::__1::unique_ptr<IPC::Encoder, std::__1::default_delete<IPC::Encoder> >&) + 63 (WebProcessProxy.cpp:835) 5 com.apple.WebKit 0x000000010d98c973 IPC::Connection::dispatchSyncMessage(IPC::Decoder&) + 483 (Connection.cpp:915) 6 com.apple.WebKit 0x000000010d98d6e2 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 610 (Connection.cpp:1053) 7 com.apple.WebKit 0x000000010d98bee1 IPC::Connection::dispatchIncomingMessages() + 913 (Connection.cpp:1159) 8 com.apple.WebKit 0x000000010d9ac9d2 IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_9::operator()() + 66 (Connection.cpp:977) 9 com.apple.WebKit 0x000000010d9ac8fe WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_9, void>::call() + 30 (Function.h:52) 10 com.apple.JavaScriptCore 0x0000000101d87a82 WTF::Function<void ()>::operator()() const + 130 (Function.h:83) 11 com.apple.JavaScriptCore 0x0000000101e09925 WTF::RunLoop::performWork() + 341 (RunLoop.cpp:128) 12 com.apple.JavaScriptCore 0x0000000101e0e1e1 WTF::RunLoop::performWork(void*) + 33 (RunLoopCF.cpp:46) 13 com.apple.CoreFoundation 0x00007fff2046da0c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 14 com.apple.CoreFoundation 0x00007fff2046d974 __CFRunLoopDoSource0 + 180 Created attachment 422182 [details]
Patch
Comment on attachment 421913 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=421913&action=review > LayoutTests/ipc/pasteboard-write-custom-data.html:9 > + IPC.sendMessage('UI',9,IPC.messages.WebPasteboardProxy_WriteCustomData.name,[buf]); Oh yeah, 9, wouldn't work LOL. Sorry, should have caught that during the code review. Committed r273886: <https://commits.webkit.org/r273886> All reviewed patches have been landed. Closing bug and clearing flags on attachment 422182 [details]. Reverted this due to consistent crashing. HISTORY URL: https://results.webkit.org/?suite=layout-tests&test=ipc%2Fpasteboard-write-custom-data.html CRASHLOG: https://build.webkit.org/results/Apple-BigSur-Debug-WK2-Tests/r273832%20(488)/ipc/pasteboard-write-custom-data-crash-log.txt (In reply to Robert Jenner from comment #23) > Reverted this due to consistent crashing. > > HISTORY URL: > https://results.webkit.org/?suite=layout-tests&test=ipc%2Fpasteboard-write- > custom-data.html > > > CRASHLOG: > https://build.webkit.org/results/Apple-BigSur-Debug-WK2-Tests/ > r273832%20(488)/ipc/pasteboard-write-custom-data-crash-log.txt Reverted in https://webkit.org/b/222689 Reopening to attach new patch. Created attachment 422279 [details]
Patch
Committed r274016: <https://commits.webkit.org/r274016> All reviewed patches have been landed. Closing bug and clearing flags on attachment 422279 [details]. |