Bug 132337 - REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox
Summary: REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Manuel Rego Casasnovas
URL: https://www.flickr.com/photos/goopyma...
Keywords: InRadar
Depends on:
Reported: 2014-04-29 08:31 PDT by Simon Fraser (smfr)
Modified: 2014-04-29 10:35 PDT (History)
12 users (show)

See Also:

Patch (7.55 KB, patch)
2014-04-29 09:38 PDT, Manuel Rego Casasnovas
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Simon Fraser (smfr) 2014-04-29 08:31:48 PDT
WebContent often crashes at in RenderBlock::paint at <https://www.flickr.com/photos/goopymart/14052958504/>.

We think this may have been caused by r167879.

Exception Codes: KERN_INVALID_ADDRESS at 0x0000000100000520

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000010870cd82 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 274
1   com.apple.WebCore             	0x0000000107e0d1b8 WebCore::RenderFlexibleBox::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 88
2   com.apple.WebCore             	0x0000000107cbce26 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 214
3   com.apple.WebCore             	0x0000000107cbc0db WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 459
4   com.apple.WebCore             	0x0000000107cbe36b WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 283
5   com.apple.WebCore             	0x0000000107cbccc7 WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*) + 391
6   com.apple.WebCore             	0x0000000107cbc911 WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::GraphicsContext*, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*, bool, bool) + 337
7   com.apple.WebCore             	0x0000000107cba9f1 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 1953
8   com.apple.WebCore             	0x0000000107ce4334 WebCore::RenderLayerBacking::paintIntoLayer(WebCore::GraphicsLayer const*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, unsigned int) + 404
9   com.apple.WebCore             	0x000000010876cbdf WebCore::RenderLayerBacking::paintContents(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, unsigned int, WebCore::FloatRect const&) + 687
10  com.apple.WebCore             	0x000000010819c9ff WebCore::GraphicsLayer::paintGraphicsLayerContents(WebCore::GraphicsContext&, WebCore::FloatRect const&) + 143
11  com.apple.WebCore             	0x0000000108998b59 WebCore::drawLayerContents(CGContext*, WebCore::PlatformCALayer*, WTF::Vector<WebCore::FloatRect, 5ul, WTF::CrashOnOverflow>&) + 361
12  com.apple.WebCore             	0x0000000107d0a96d -[WebLayer drawInContext:] + 61
Comment 1 Simon Fraser (smfr) 2014-04-29 08:32:02 PDT
Comment 2 Simon Fraser (smfr) 2014-04-29 08:32:30 PDT
Manuel, could you take a look?
Comment 3 Manuel Rego Casasnovas 2014-04-29 09:37:46 PDT
(In reply to comment #2)
> Manuel, could you take a look?

Yes, it seems it was introduced by my changes in OrderIterator.

I'm uploading a new patch porting https://codereview.chromium.org/19558006 that seems to be fixing the issue here. It would be great if you could very it.
Comment 4 Manuel Rego Casasnovas 2014-04-29 09:38:55 PDT
Created attachment 230382 [details]
Comment 5 Simon Fraser (smfr) 2014-04-29 09:56:14 PDT
Comment on attachment 230382 [details]

View in context: https://bugs.webkit.org/attachment.cgi?id=230382&action=review

> Source/WebCore/ChangeLog:15
> +        The solution is simple: just clear the memory when we remove a child.

"clear the memory" doesn't really match removing all items from the m_children vector.
Comment 6 WebKit Commit Bot 2014-04-29 10:35:03 PDT
Comment on attachment 230382 [details]

Clearing flags on attachment: 230382

Committed r167942: <http://trac.webkit.org/changeset/167942>
Comment 7 WebKit Commit Bot 2014-04-29 10:35:08 PDT
All reviewed patches have been landed.  Closing bug.