Bug 206106 – Null Ptr Deref READ @ WebCore::RenderMultiColumnFlow::lastMultiColumnSet const

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Jack]

<rdar://problem/56685305>

[Jack]

Created attachment 387725 [details]
Patch

[Jack]

In this test case RenderMultiColumnFlowThread is being detached from LI RenderListItem, so the code tries to move its children to its parent (by searching for sibling and creating new RenderMultiColumnSet). However, because the nodes are being destroyed in preorder in function RenderTreeBuilder::destroy, no parent can be found for child insertion.

Tried changing the destroy function to call detach in post-order, and the problem can be solved.

[Jack]

After discussing with Geoff

[Jack]

After discussing with Geoff, Alan and Antti, it was determined that the best approach is to check null multicolumn container (parent) and just exit the column processing functions.

Doing so help expedite destroy process. If later other functions also try to refer container in destroy process, we should exit the function immediately.

Ideally we should avoid moving children altogether, but that will require some refactoring, so we put null check for now.

(In reply to Jack from comment #3)
> After discussing with Geoff

[Jack]

Alan also verified with setting multi-column to 2 then 1 to make sure an element will be correctly attached back to multi-column container when RenderMultiColumnFlowThread is detached.

Below is the html to verify RenderMultiColumnFlowThread attach/detach:
<div id = container>
<div>foo</div>
<div>bar</div>
</div>
<script>
    container.style.webkitColumnCount = "2";
    setTimeout(function() {
              container.style.webkitColumnCount = "1";
              }, 5000);
</script>

[Jack]

Change the bug to non-security since the parent pointer is correctly set to null when a render element is detached. The pointer will not point to random or freed address.

[WebKit Commit Bot]

The commit-queue encountered the following flaky tests while processing attachment 387725 [details]:

editing/spelling/spellcheck-attribute.html bug 206178 (authors: [e-mail], [e-mail], and [e-mail])
The commit-queue is continuing to process your patch.

[WebKit Commit Bot]

Comment on attachment 387725 [details]
Patch

Clearing flags on attachment: 387725

Committed r255113: <https://trac.webkit.org/changeset/255113>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.