Bug 177905 - Nullptr deref in WebCore::Node::computeEditability
Summary: Nullptr deref in WebCore::Node::computeEditability
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-10-04 17:13 PDT by Brent Fulgham
Modified: 2017-10-08 00:48 PDT (History)
9 users (show)

See Also:


Attachments
Patch (1.47 KB, patch)
2017-10-04 17:34 PDT, Brent Fulgham
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews114 for mac-elcapitan (1.96 MB, application/zip)
2017-10-04 21:54 PDT, Build Bot
no flags Details
Patch (3.73 KB, patch)
2017-10-05 12:19 PDT, Brent Fulgham
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2017-10-04 17:13:58 PDT
Focus events can cause the current focused node to be cleared, resulting in a nullptr deref. Let's fix this!
Comment 1 Brent Fulgham 2017-10-04 17:33:06 PDT
<rdar://problem/34138402>
Comment 2 Brent Fulgham 2017-10-04 17:34:20 PDT
Created attachment 322748 [details]
Patch
Comment 3 Daniel Bates 2017-10-04 18:16:12 PDT
Comment on attachment 322748 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=322748&action=review

Can we write a test for this change?

> Source/WebCore/dom/Document.cpp:3864
> +        // Focus change can run script, changing the node.

Can you please elaborate on what script/DOM event is dispatched by calling setFocus()?

> Source/WebCore/dom/Document.cpp:3865
> +        if (!m_focusedElement || m_focusedElement != newFocusedElement) {

Is the first disjunct necessary?
Comment 4 Build Bot 2017-10-04 21:54:27 PDT
Comment on attachment 322748 [details]
Patch

Attachment 322748 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/4762529

New failing tests:
workers/wasm-long-compile.html
Comment 5 Build Bot 2017-10-04 21:54:28 PDT
Created attachment 322779 [details]
Archive of layout-test-results from ews114 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews114  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 6 Brent Fulgham 2017-10-05 10:57:09 PDT
Comment on attachment 322748 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=322748&action=review

>> Source/WebCore/dom/Document.cpp:3864
>> +        // Focus change can run script, changing the node.
> 
> Can you please elaborate on what script/DOM event is dispatched by calling setFocus()?

Yes. I've got a reduced test case now, and I'll add some comments.

>> Source/WebCore/dom/Document.cpp:3865
>> +        if (!m_focusedElement || m_focusedElement != newFocusedElement) {
> 
> Is the first disjunct necessary?

Probably not. I'll remove it.
Comment 7 Brent Fulgham 2017-10-05 12:19:37 PDT
Created attachment 322880 [details]
Patch
Comment 8 WebKit Commit Bot 2017-10-08 00:47:46 PDT
Comment on attachment 322880 [details]
Patch

Clearing flags on attachment: 322880

Committed r223028: <http://trac.webkit.org/changeset/223028>
Comment 9 WebKit Commit Bot 2017-10-08 00:47:48 PDT
All reviewed patches have been landed.  Closing bug.
Comment 10 Radar WebKit Bug Importer 2017-10-08 00:48:16 PDT
<rdar://problem/34874846>