Bug 236941 – [QuickLook] WKPasswordView crash when re-enter password.

• Component: WebKit2
• Status: NEW

[yianzhou]

Created attachment 452692 [details]
backtrace

The way to reproduce:

1. Use iPhone WKWebView to open a document need password.
2. When the WKPasswordView has shown, enter the right password. Now the WebKit is about to navigate.
3. Enter the password again immediately. Crash happens with "EXC_BAD_ACCESS".

There is a property in WKPasswordView: `@property (nonatomic, copy) void (^userDidEnterPassword)(NSString *);`

Things the block `userDidEnterPassword` captured were released after the user enter the right password. If the user enter the password again in a short time, execute the `userDidEnterPassword` block again triggered the "EXC_BAD_ACCESS" crash.

Attachment is the backtrace.

[Alexey Proskuryakov]

I do not understand the steps to reproduce. How can one enter the password again immediately? This just sounds like it's not a WebKit bug, but a bug in the application that invokes -userDidEnterPassword:forPasswordView: twice.

The title contains "[QuickLook]", can you please clarify how QuickLook is involved?

Perhaps it would be easiest to attach a screen recording of steps to reproduce.

For Apple employees, this is the same stack trace as:

rdar://69366428

[yianzhou]

Created attachment 452974 [details]
Screen recording the crash

[yianzhou]

Hello Alexey, I agree with you that it's a bug that invokes `-userDidEnterPassword:forPasswordView:` twice.

I think UIKit pass a block to WebKit, and WKPassword retain the block as property `userDidEnterPassword`. When the user double enter the password, it will crash.

I just upload a screen recording to reproduce the issue. Please check. Thanks.

[yianzhou]

(In reply to Alexey Proskuryakov from comment #1)
> I do not understand the steps to reproduce. How can one enter the password
> again immediately? This just sounds like it's not a WebKit bug, but a bug in
> the application that invokes -userDidEnterPassword:forPasswordView: twice.
> 
> The title contains "[QuickLook]", can you please clarify how QuickLook is
> involved?
> 
> Perhaps it would be easiest to attach a screen recording of steps to
> reproduce.
> 
> For Apple employees, this is the same stack trace as:
> 
> rdar://69366428

Hello Alexey, I agree with you that it's a bug that invokes `-userDidEnterPassword:forPasswordView:` twice.

I think UIKit pass a block to WebKit, and WKPassword retain the block as property `userDidEnterPassword`. When the user double enter the password, it will crash.

I just upload a screen recording to reproduce the issue. Please check. Thanks.

[yianzhou]

As you see in the screen recording, I created a new project just show a single WKWebView to load a password-protected document from main bundle. 

So firstly I enter the correct password "1234", it works. And maybe somehow WebKit was trying to navigate to the document content. At the moment, I click the text field and enter a random password, it crashes!

[yianzhou]

Created attachment 452975 [details]
The password is 1234

[yianzhou]

AS you may need, I also upload a password-protected document for your test.