Bug 107292 – Assertion failure during the expansion of an unloaded subresource

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: SVG

[Renata Hodovan]

During SVG fuzzing I've got an assertion failure in SVGUseElement::expandUseElementsInShadowTree().
If we were referring to a <use> element what were referring to a subresource of an external file and that part is invalid then we run into an assertion failure during the expansion of the shadowtree.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4afc89c in WebCore::SVGUseElement::expandUseElementsInShadowTree (this=0x98fac0, element=0x98ab70)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGUseElement.cpp:732
732	        ASSERT(!use->cachedDocumentIsStillLoading());
(gdb) bt
#0  0x00007ffff4afc89c in WebCore::SVGUseElement::expandUseElementsInShadowTree (this=0x98fac0, element=0x98ab70)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGUseElement.cpp:732
#1  0x00007ffff4afcd91 in WebCore::SVGUseElement::expandUseElementsInShadowTree (this=0x98fac0, element=0x99b050)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGUseElement.cpp:776
#2  0x00007ffff4afb9d0 in WebCore::SVGUseElement::buildShadowAndInstanceTree (this=0x98fac0, target=0x98c4e0)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGUseElement.cpp:500
#3  0x00007ffff4afb5ac in WebCore::SVGUseElement::buildPendingResource (this=0x98fac0) at /home/reni/WebKit-git/Source/WebCore/svg/SVGUseElement.cpp:440
#4  0x00007ffff4afddb0 in WebCore::SVGUseElement::finishParsingChildren (this=0x98fac0) at /home/reni/WebKit-git/Source/WebCore/svg/SVGUseElement.cpp:986
#5  0x00007ffff485579b in WebCore::XMLDocumentParser::endElementNs (this=0x72aaf0)
    at /home/reni/WebKit-git/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:849
#6  0x00007ffff4856747 in endElementNsHandler (closure=0x72b2f0) at /home/reni/WebKit-git/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:1098
...

[Renata Hodovan]

Created attachment 183474 [details]
Test

Test to reproduce.

[Brent Fulgham]

I don't get an assert with the attached test case in GMalloc. Are you still able to reproduce this problem. We may have corrected things in the THREE YEARS since you reported this problem.

I'm sorry this was ignored for so long. :-(

[Brent Fulgham]

I cannot reproduce the assert (or any other error) under ASAN with this test case. I assume we should not actually have a "dummy.svg" file, per your comments.

I do see console errors complaining that 'dummy.svg' could not be loaded since the URL was not found on the server.

I'm closing this as unable to reproduce. Please reopen the bug with a reproducible test case. Otherwise I will assume we fixed this via other changes in the past few years.