Bug 221667 – [GTK] nullptr crash in WebCore::Frame::pageZoomFactor

• Status: NEW
• Component: WebKitGTK

[Frédéric Wang Nélar]

Created attachment 419823 [details]
Test

See attached testcase. It seems this requires TOUCH_EVENTS to be enabled, and only happens on GTK (not macos or ios internal ports).

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007fd8edae50ce in WebCore::Frame::pageZoomFactor (this=0x0)
    at DerivedSources/ForwardingHeaders/WebCore/Frame.h:217
217	    float pageZoomFactor() const { return m_pageZoomFactor; }
(rr) bt
#0  0x00007fd8edae50ce in WebCore::Frame::pageZoomFactor() const (this=0x0)
    at DerivedSources/ForwardingHeaders/WebCore/Frame.h:217
#1  0x00007fd8efc86a63 in WebCore::Touch::Touch(WebCore::Frame*, WebCore::EventTarget*, unsigned int, int, int, int, int, int, int, float, float)
    (this=0x7fd8884d8630, frame=0x0, target=
    0x0, identifier=0, screenX=0, screenY=0, pageX=0, pageY=0, radiusX=0, radiusY=0, rotationAngle=nan(0x400000), force=nan(0x400000))
    at ../../Source/WebCore/dom/Touch.cpp:72
#2  0x00007fd8efa828d0 in WebCore::Touch::create(WebCore::Frame*, WebCore::EventTarget*, unsigned int, int, int, int, int, int, int, float, float)
    (frame=0x0, target=0x0, identifier=0, screenX=0, screenY=0, pageX=0, pageY=0, radiusX=0, radiusY=0, rotationAngle=nan(0x400000), force=nan(0x400000))
    at ../../Source/WebCore/dom/Touch.h:48
#3  0x00007fd8efa827d4 in WebCore::DocumentTouch::createTouch(WebCore::Document&, WTF::RefPtr<WebCore::WindowProxy, WTF::RawPtrTraits<WebCore::WindowProxy>, WTF::DefaultRefDerefTraits<WebCore::WindowProxy> >&&, WebCore::EventTarget*, int, int, int, int, int, int, int, float, float)
    (document=..., window=..., target=0x0, identifier=0, pageX=0, pageY=0, screenX=0, screenY=0, radiusX=0, radiusY=0, rotationAngle=nan(0x400000), force=nan(0x400000)) at ../../Source/WebCore/dom/DocumentTouch.cpp:51
#4  0x00007fd8ee3c52d0 in WebCore::jsDocumentPrototypeFunction_createTouchBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::IDLOperation<WebCore::JSDocument>::ClassParameter)
    (lexicalGlobalObject=0x7fd8d3325068, callFrame=0x7ffe72475830, castedThis=0x7fd88843c458) at DerivedSources/WebCore/JSDocument.cpp:6144
#5  0x00007fd8ee3e72c4 in WebCore::IDLOperation<WebCore::JSDocument>::call<WebCore::jsDocumentPrototypeFunction_createTouchBody>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) (lexicalGlobalObject=..., callFrame=..., operationName=0x7fd8f35cc4e8 "createTouch") at ../../Source/WebCore/bindings/js/JSDOMOperation.h:53
#6  0x00007fd8ee3c542a in WebCore::jsDocumentPrototypeFunction_createTouch(JSC::JSGlobalObject*, JSC::CallFrame*) (lexicalGlobalObject=0x7fd8d3325068, callFrame=0x7ffe72475830) at DerivedSources/WebCore/JSDocument.cpp:6149

[Radar WebKit Bug Importer]

<rdar://problem/74179777>

[Frédéric Wang Nélar]

Created attachment 419824 [details]
Patch (changes DocumentTouch IDL)

This fix changes the DocumentTouch IDL API, so not sure this can be reviewed only by GTK ports maintainer.

[Frédéric Wang Nélar]

Created attachment 419825 [details]
Patch (test)

[Carlos Alberto Lopez Perez]

(In reply to Frédéric Wang (:fredw) from comment #2)
> Created attachment 419824 [details]
> Patch (changes DocumentTouch IDL)
> 
> This fix changes the DocumentTouch IDL API, so not sure this can be reviewed
> only by GTK ports maintainer.

Is this change OK regarding the specification? Can Document.createTouch() return a null value according to it?

I'm reading https://www.w3.org/TR/touch-events/ and I can't see where it says this is ok, maybe I'm overlooking something.

[Carlos Alberto Lopez Perez]

I confirm this crashes WebKitGTK (non-developer release builds)

Maybe another option is to return an empty/default touch object instead of null in this case

[Michael Catanzaro]

(Removing security component since impact of null pointer dereference is limited to denial of service only.)