Bug 208244 - [iOS] nullptr deref in FileInputType::iconLoaded when the input's type attribute is modified by a change event listener
Summary: [iOS] nullptr deref in FileInputType::iconLoaded when the input's type attrib...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: Safari 13
Hardware: iPhone / iPad iOS 13
: P2 Normal
Assignee: Andy Estes
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-02-26 08:41 PST by Dave Jack
Modified: 2020-06-11 12:43 PDT (History)
9 users (show)

See Also:


Attachments
Crash Report (81.87 KB, text/plain)
2020-02-26 08:41 PST, Dave Jack
no flags Details
Patch (18.73 KB, patch)
2020-06-10 10:46 PDT, Andy Estes
no flags Details | Formatted Diff | Diff
Patch (23.84 KB, patch)
2020-06-10 11:56 PDT, Andy Estes
no flags Details | Formatted Diff | Diff
Patch (24.77 KB, patch)
2020-06-11 12:05 PDT, Andy Estes
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dave Jack 2020-02-26 08:41:13 PST
Created attachment 391747 [details]
Crash Report

This page occasionally crashes WebKit on my phone once a file is selected:

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="utf-8">
    <title>upload test</title>
</head>

<body>
    <input type="file" id="file-input" />
    <script>
        const fileInput = document.querySelector('#file-input');
        fileInput.addEventListener('change', (evt) => {
            // from bootstrap-vue's form-file.js
            fileInput.type = '';
        });
    </script>
</body>

</html>

Crash report attached, top of the stack trace (for searchability): WebCore::FileInputType::filesChosen+ 17175144 (WTF::Vector<WebCore::FileChooserFileInfo, 0ul, WTF::CrashOnOverflow, 16ul> const&, WTF::String const&, WebCore::Icon*) + 744
Comment 1 Alexey Proskuryakov 2020-02-26 12:36:09 PST
Thank you for the repro!

rdar://problem/41855350
Comment 2 Andy Estes 2020-06-03 13:05:09 PDT
I can reproduce the crash on iOS 13.5.
Comment 3 Andy Estes 2020-06-09 19:02:15 PDT
Thread 1: EXC_BAD_ACCESS (code=1, address=0xbbadbeef)

Thread 1 Queue : com.apple.main-thread (serial)
#0	0x0000000114c55b54 in ::WTFCrash() at /Volumes/Data/Projects/OpenSource/Source/WTF/wtf/Assertions.cpp:303
#1	0x000000011be9f390 in WTFCrashWithInfo(int, char const*, char const*, int) at /Volumes/Data/Projects/OpenSource/WebKitBuild/Debug-iphoneos/usr/local/include/wtf/Assertions.h:671
#2	0x000000011e62646c in WebCore::FileInputType::iconLoaded(WTF::RefPtr<WebCore::Icon, WTF::DumbPtrTraits<WebCore::Icon> >&&) at /Volumes/Data/Projects/OpenSource/Source/WebCore/html/FileInputType.cpp:440
#3	0x000000011e624d70 in WebCore::FileInputType::filesChosen(WTF::Vector<WebCore::FileChooserFileInfo, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, WebCore::Icon*) at /Volumes/Data/Projects/OpenSource/Source/WebCore/html/FileInputType.cpp:426
#4	0x000000011f1acc54 in WebCore::FileChooser::chooseMediaFiles(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, WebCore::Icon*) at /Volumes/Data/Projects/OpenSource/Source/WebCore/platform/FileChooser.cpp:92
#5	0x0000000105bd1628 in WebKit::WebOpenPanelResultListener::didChooseFilesWithDisplayStringAndIcon(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, WebCore::Icon*) at /Volumes/Data/Projects/OpenSource/Source/WebKit/WebProcess/WebPage/WebOpenPanelResultListener.cpp:57
#6	0x0000000105dda924 in WebKit::WebPage::didChooseFilesForOpenPanelWithDisplayStringAndIcon(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, IPC::DataReference const&, WebKit::SandboxExtension::Handle&&, WebKit::SandboxExtension::Handle&&) at /Volumes/Data/Projects/OpenSource/Source/WebKit/WebProcess/WebPage/WebPage.cpp:4267
#7	0x0000000105eed808 in void IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, IPC::DataReference const&, WebKit::SandboxExtension::Handle&&, WebKit::SandboxExtension::Handle&&), std::__1::tuple<WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WTF::String, IPC::DataReference, WebKit::SandboxExtension::Handle, WebKit::SandboxExtension::Handle>, 0ul, 1ul, 2ul, 3ul, 4ul>(WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, IPC::DataReference const&, WebKit::SandboxExtension::Handle&&, WebKit::SandboxExtension::Handle&&), std::__1::tuple<WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WTF::String, IPC::DataReference, WebKit::SandboxExtension::Handle, WebKit::SandboxExtension::Handle>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul>) at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/HandleMessage.h:41
#8	0x0000000105eea36c in void IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, IPC::DataReference const&, WebKit::SandboxExtension::Handle&&, WebKit::SandboxExtension::Handle&&), std::__1::tuple<WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WTF::String, IPC::DataReference, WebKit::SandboxExtension::Handle, WebKit::SandboxExtension::Handle>, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul> >(std::__1::tuple<WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WTF::String, IPC::DataReference, WebKit::SandboxExtension::Handle, WebKit::SandboxExtension::Handle>&&, WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, IPC::DataReference const&, WebKit::SandboxExtension::Handle&&, WebKit::SandboxExtension::Handle&&)) at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/HandleMessage.h:47
#9	0x0000000105e48378 in void IPC::handleMessage<Messages::WebPage::DidChooseFilesForOpenPanelWithDisplayStringAndIcon, WebKit::WebPage, void (WebKit::WebPage::*)(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, IPC::DataReference const&, WebKit::SandboxExtension::Handle&&, WebKit::SandboxExtension::Handle&&)>(IPC::Decoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::String const&, IPC::DataReference const&, WebKit::SandboxExtension::Handle&&, WebKit::SandboxExtension::Handle&&)) at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/HandleMessage.h:114
#10	0x0000000105e3bf90 in WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) at /Volumes/Data/Projects/OpenSource/WebKitBuild/Debug-iphoneos/DerivedSources/WebKit2/WebPageMessageReceiver.cpp:2066
#11	0x0000000105ddbf14 in WebKit::WebPage::didReceiveMessage(IPC::Connection&, IPC::Decoder&) at /Volumes/Data/Projects/OpenSource/Source/WebKit/WebProcess/WebPage/WebPage.cpp:4606
#12	0x0000000104510318 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/MessageReceiverMap.cpp:123
#13	0x000000010589ac74 in WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) at /Volumes/Data/Projects/OpenSource/Source/WebKit/WebProcess/WebProcess.cpp:758
#14	0x000000010445c92c in IPC::Connection::dispatchMessage(IPC::Decoder&) at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/Connection.cpp:1001
#15	0x000000010445d2c4 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/Connection.cpp:1070
#16	0x000000010445d95c in IPC::Connection::dispatchOneIncomingMessage() at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/Connection.cpp:1139
#17	0x000000010447e238 in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_7::operator()() at /Volumes/Data/Projects/OpenSource/Source/WebKit/Platform/IPC/Connection.cpp:978
#18	0x000000010447e148 in WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_7, void>::call() at /Volumes/Data/Projects/OpenSource/WebKitBuild/Debug-iphoneos/usr/local/include/wtf/Function.h:52
#19	0x0000000114c79b88 in WTF::Function<void ()>::operator()() const at /Volumes/Data/Projects/OpenSource/WebKitBuild/Debug-iphoneos/usr/local/include/wtf/Function.h:84
#20	0x0000000114ce2f48 in WTF::RunLoop::performWork() at /Volumes/Data/Projects/OpenSource/Source/WTF/wtf/RunLoop.cpp:119
#21	0x0000000114ce3a18 in WTF::RunLoop::performWork(void*) at /Volumes/Data/Projects/OpenSource/Source/WTF/wtf/cf/RunLoopCF.cpp:38
Comment 4 Andy Estes 2020-06-09 19:05:52 PDT
By the time FileChooser::chooseMediaFiles is called, its client (a FileInputType) has been detached from its element by HTMLInputElement::updateType(). When FileInputType::iconLoaded is called, we crash on the ASSERT(element()).
Comment 5 Andy Estes 2020-06-10 10:46:40 PDT Comment hidden (obsolete)
Comment 6 Andy Estes 2020-06-10 11:56:02 PDT
Created attachment 401564 [details]
Patch
Comment 7 Andy Estes 2020-06-11 12:05:11 PDT
Created attachment 401662 [details]
Patch
Comment 8 EWS 2020-06-11 12:43:06 PDT
Committed r262918: <https://trac.webkit.org/changeset/262918>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 401662 [details].