Bug 29313 – Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare fastRealloc edge case

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Dimitri Glazkov (Google)]

From bug 29026:

"
.. I found a case in WebKit which attempts to
realloc(ptr, 0):
WTF::fastRealloc+0x10
WebCore::HTMLTokenizer::enlargeScriptBuffer+0x41
WebCore::HTMLTokenizer::parseComment+0x2a
WebCore::HTMLTokenizer::parseTag+0x1141
WebCore::HTMLTokenizer::write+0x414
WebCore::FrameLoader::write+0x36b
WebCore::FrameLoader::addData+0x12

To get here, we have to read data input off the socket which contains a partial
page ending with "<!--".  It's a little hard to reproduce.
"

[Dimitri Glazkov (Google)]

Created attachment 39660 [details]
Fix HTMLTokenizer crash, v1.

 WebCore/ChangeLog              |   15 +++++++++++++++
 WebCore/html/HTMLTokenizer.cpp |    8 ++++++++
 2 files changed, 23 insertions(+), 0 deletions(-)

[Darin Adler]

We have other test cases like this done with HTTP tests that deliver text slowly. Can we make a regression test case?

[Dimitri Glazkov (Google)]

(In reply to comment #2)
> We have other test cases like this done with HTTP tests that deliver text
> slowly. Can we make a regression test case?

Mike (the original finder of the problem), what do you think?

[Alexey Proskuryakov]

+    // If we allow fastRealloc(ptr, 0), it will call CRASH(). 

Given bug 29026, this may be too strong a statement. Will this change even be needed if bug 29026 is fixed the way we seem to have consensus on?

[Eric Seidel (no email)]

Ping?

[Yong Li]

Comment on attachment 39660 [details]
Fix HTMLTokenizer crash, v1.

Let commit bot land it

[WebKit Commit Bot]

Comment on attachment 39660 [details]
Fix HTMLTokenizer crash, v1.

Clearing flags on attachment: 39660

Committed r49788: <http://trac.webkit.org/changeset/49788>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.