Bug 21063 – NULL pointer crash in dispatchEvent(null);

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Dean McNamee]

We found this a while ago, looks like it never got filed:

  var xhr = new XMLHttpRequest();
  xhr.dispatchEvent(null);

I don't have a mac, or a webkit build where I can test and make a layout test.  However, it should be trivial to turn the above into a layout test, and apply and test this patch:

diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index 4b4bc96..0303d01 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -309,7 +309,7 @@ void XMLHttpRequest::removeEventListener(const AtomicString&
 bool XMLHttpRequest::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec, bo
 {
     // FIXME: check for other error conditions enumerated in the spec.
-    if (evt->type().isEmpty()) {
+    if (!evt || evt->type().isEmpty()) {
         ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
         return true;
     }

[Alexey Proskuryakov]

We seem to have the same issue in other dispatchEvent() implementations (why are there so many?). E.g. XMLHttpRequestUpload::dispatchEvent, DOMApplicationCache::dispatchEvent, MessagePort::dispatchEvent.

[Sam Weinig]

(In reply to comment #1)
> We seem to have the same issue in other dispatchEvent() implementations (why
> are there so many?). E.g. XMLHttpRequestUpload::dispatchEvent,
> DOMApplicationCache::dispatchEvent, MessagePort::dispatchEvent.

Anders and I just discussed this yesterday.  The functions seem generic enough that we should be able to factor them up to EventTarget (or elsewhere).

[Dean McNamee]

Any word on this?  Could we check in the simple NULL checks for now until it gets refactored?

[Alexey Proskuryakov]

Yes. Would you be willing to make a patch with test cases?

[Sam Weinig]

Created attachment 25601 [details]
patch

[Alexey Proskuryakov]

Comment on attachment 25601 [details]
patch

r=me

[Sam Weinig]

Fixed in r38845.