Bug 192357 - [iOS] Using file upload can trigger a crash under RenderThemeIOS::paintFileUploadIconDecorations()
Summary: [iOS] Using file upload can trigger a crash under RenderThemeIOS::paintFileUp...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 12
Hardware: iPhone / iPad iOS 12
: P2 Normal
Assignee: zalan
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-12-04 01:48 PST by michal
Modified: 2018-12-21 16:02 PST (History)
6 users (show)

See Also:


Attachments
crash log from iphone, ios12 (70.63 KB, text/plain)
2018-12-04 01:48 PST, michal
no flags Details
Patch (1.51 KB, patch)
2018-12-21 15:01 PST, zalan
no flags Details | Formatted Diff | Diff
Patch (1.61 KB, patch)
2018-12-21 15:33 PST, zalan
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description michal 2018-12-04 01:48:41 PST
Created attachment 356477 [details]
crash log from iphone, ios12

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000000
appear when trying to upload image
Comment 1 Wenson Hsieh 2018-12-04 12:19:28 PST
Symbolicated:

0   WebCore::GraphicsContext::platformContext() const
1   WebCore::RenderThemeIOS::paintFileUploadIconDecorations(WebCore::RenderObject const&, WebCore::RenderObject const&, WebCore::PaintInfo const&, WebCore::IntRect const&, WebCore::Icon*, WebCore::RenderTheme::FileUploadDecorations)
2   WebCore::RenderFileUploadControl::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
3   WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
4   WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*)
5   WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::GraphicsContext&, WebCore::GraphicsContext&, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*)
6   WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
7   WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
8   WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
9   WebCore::RenderLayer::paint(WebCore::GraphicsContext&, WebCore::LayoutRect const&, WebCore::LayoutSize const&, unsigned int, WebCore::RenderObject*, unsigned int, WebCore::RenderLayer::SecurityOriginPaintPolicy)
10  WebCore::FrameView::paintContents(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy)
11  WebCore::ScrollView::paint(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy)
12  WebCore::FrameView::traverseForPaintInvalidation(WebCore::GraphicsContext::PaintInvalidationReasons)
13  WebKit::RemoteLayerTreeDrawingArea::flushLayers()
14  WebCore::ThreadTimers::sharedTimerFiredInternal()
15  WebCore::timerFired(__CFRunLoopTimer*, void*)

Seems like <rdar://problem/42852260>
Comment 2 David Kilzer (:ddkilzer) 2018-12-04 17:55:35 PST
<rdar://problem/42852260>
Comment 3 Radar WebKit Bug Importer 2018-12-04 17:56:08 PST
<rdar://problem/46473200>
Comment 4 David Kilzer (:ddkilzer) 2018-12-04 17:57:18 PST
Which website were you using when the crash happened?

Obviously this doesn't crash on every file upload form or we would have fixed it long ago.  :)
Comment 5 David Kilzer (:ddkilzer) 2018-12-04 17:57:53 PST
<rdar://problem/42852260>
Comment 7 zalan 2018-12-21 15:01:06 PST
Created attachment 357985 [details]
Patch
Comment 8 Simon Fraser (smfr) 2018-12-21 15:27:21 PST
Comment on attachment 357985 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=357985&action=review

> Source/WebCore/ChangeLog:3
> +        Do not try to paint the file picker when painting is disabled.

Maybe use my bug title.
Comment 9 zalan 2018-12-21 15:33:55 PST
Created attachment 357989 [details]
Patch
Comment 10 WebKit Commit Bot 2018-12-21 16:02:27 PST
Comment on attachment 357989 [details]
Patch

Clearing flags on attachment: 357989

Committed r239526: <https://trac.webkit.org/changeset/239526>
Comment 11 WebKit Commit Bot 2018-12-21 16:02:28 PST
All reviewed patches have been landed.  Closing bug.