187654 2018-07-13 12:18:27 -0700 WebResourceLoader may try to send a IPC with a destination ID that is 0 2018-07-13 13:40:53 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez achristensen beidson commit-queue webkit-bug-importer youennf oldest_to_newest 1441953 0 cdumez 2018-07-13 12:18:27 -0700 WebResourceLoader may try to send a IPC with a destination ID that is 0: Exception Type: EXC_BREAKPOINT (SIGTRAP) Exception Codes: 0x0000000000000001, 0x00000001b067bee0 Termination Signal: Trace/BPT trap: 5 Termination Reason: Namespace SIGNAL, Code 0x5 Terminating Process: exc handler [5462] Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed ↩: 0 WebKit 0x00000001b067bee0 WebKit::WebResourceLoader::messageSenderDestinationID() + 56 (WebResourceLoader.cpp:77) 1 WebKit 0x00000001b067bebc WebKit::WebResourceLoader::messageSenderDestinationID() + 20 (WebResourceLoader.cpp:76) 2 WebKit 0x00000001b067cfa8 WTF::Function<void ()>::CallableWrapper<WebKit::WebResourceLoader::didReceiveResponse(WebCore::ResourceResponse const&, bool)::$_1>::call() + 48 (MessageSender.h:39) 3 WebCore 0x00000001aa41f584 WebCore::SubresourceLoader::didReceiveResponsePolicy() + 44 (Function.h:56) 4 WebCore 0x00000001aa3d86cc WTF::Function<void (WebCore::PolicyAction)>::CallableWrapper<WebCore::DocumentLoader::responseReceived(WebCore::ResourceResponse const&, WTF::CompletionHandler<void ()>&&)::$_7>::call(WebCore::PolicyAction) + 36 (DocumentLoader.cpp:838) 5 WebKit 0x00000001b056254c WebKit::WebFrame::invalidatePolicyListener() + 64 (Function.h:56) 6 WebCore 0x00000001aa3cdb70 WebCore::DocumentLoader::detachFromFrame() + 476 (DocumentLoader.cpp:1818) 7 WebCore 0x00000001aa3ee2cc WebCore::FrameLoader::clearProvisionalLoad() + 52 (FrameLoader.cpp:1898) 8 WebCore 0x00000001aa3ef760 WebCore::FrameLoader::checkLoadCompleteForThisFrame() + 1716 (FrameLoader.cpp:2418) 9 WebCore 0x00000001aa3e7af8 WebCore::FrameLoader::checkLoadComplete() + 408 (FrameLoader.cpp:2629) 10 WebCore 0x00000001aa3f139c WebCore::FrameLoader::receivedMainResourceError(WebCore::ResourceError const&) + 324 (FrameLoader.cpp:3030) 11 WebCore 0x00000001aa44c5e8 WebCore::CachedResource::checkNotify() + 292 (CachedResource.cpp:341) 12 WebCore 0x00000001aa41fbe4 WebCore::SubresourceLoader::didFail(WebCore::ResourceError const&) + 264 (SubresourceLoader.cpp:677) 13 WebKit 0x00000001b058a51c WebKit::WebLoaderStrategy::internallyFailedLoadTimerFired() + 92 (WebLoaderStrategy.cpp:362) 14 JavaScriptCore 0x00000001a7dee02c WTF::RunLoop::TimerBase::timerFired(__CFRunLoopTimer*, void*) + 44 (RunLoopCF.cpp:84) 15 CoreFoundation 0x00000001a00ef148 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 28 (CFRunLoop.c:1830) 16 CoreFoundation 0x00000001a00eee74 __CFRunLoopDoTimer + 864 (CFRunLoop.c:2417) 17 CoreFoundation 0x00000001a00ee6a8 __CFRunLoopDoTimers + 248 (CFRunLoop.c:2564) 18 CoreFoundation 0x00000001a00e9558 __CFRunLoopRun + 1884 (CFRunLoop.c:0) 19 CoreFoundation 0x00000001a00e8ad8 CFRunLoopRunSpecific + 436 (CFRunLoop.c:3247) 20 Foundation 0x00000001a0ada314 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 300 (NSRunLoop.m:367) 21 Foundation 0x00000001a0b16328 -[NSRunLoop(NSRunLoop) run] + 88 (NSRunLoop.m:389) 22 libxpc.dylib 0x000000019fdba078 _xpc_objc_main + 532 (main.m:170) 23 libxpc.dylib 0x000000019fdbcab8 xpc_main + 184 (init.c:1471) 24 com.apple.WebKit.WebContent 0x00000001009d759c main + 380 (XPCServiceMain.mm:160) 25 libdyld.dylib 0x000000019fba9dd8 0x19fba9000 + 3544 This can lead to HashMap corruption on recipient side when trying to lookup a key that is 0. 1441954 1 cdumez 2018-07-13 12:18:38 -0700 <rdar://problem/39265927> 1441957 2 344966 cdumez 2018-07-13 12:26:00 -0700 Created attachment 344966 Patch 1441992 3 344966 commit-queue 2018-07-13 13:40:52 -0700 Comment on attachment 344966 Patch Clearing flags on attachment: 344966 Committed r233815: <https://trac.webkit.org/changeset/233815> 1441993 4 commit-queue 2018-07-13 13:40:53 -0700 All reviewed patches have been landed. Closing bug. 344966 2018-07-13 12:26:00 -0700 2018-07-13 13:40:52 -0700 Patch bug-187654-20180713122555.patch text/plain 5028 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjMzODA4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDQ5YWU3YjQ2ZDA4NDExM2Nl MmFhNjY4ODc1MWIxNDg3MmU5MjIxYjIuLmJiNWY3ZjkzZGNlODM4MzRmOTI4OTU2MzQ3MGJkMjY3 OTNiNjRlZmIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMzYgQEAKKzIwMTgtMDctMTMgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBXZWJSZXNvdXJjZUxvYWRlciBtYXkg dHJ5IHRvIHNlbmQgYSBJUEMgd2l0aCBhIGRlc3RpbmF0aW9uIElEIHRoYXQgaXMgMAorICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTg3NjU0CisgICAgICAg IDxyZGFyOi8vcHJvYmxlbS8zOTI2NTkyNz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBXZWJSZXNvdXJjZUxvYWRlciBtYXkgdHJ5IHRvIHNlbmQgYSBJ UEMgd2l0aCBhIGRlc3RpbmF0aW9uIElEIHRoYXQgaXMgMCBhY2NvcmRpbmcgdG8gcmVsZWFzZQor ICAgICAgICBhc3NlcnRpb24gaGl0cyB3ZSBzZWUgaW4gdGhlIHdpbGQuIFRoaXMgY2FuIGxlYWQg dG8gSGFzaE1hcCBjb3JydXB0aW9uIG9uIHJlY2lwaWVudCBzaWRlIHdoZW4KKyAgICAgICAgdHJ5 aW5nIHRvIGxvb2t1cCBhIGtleSB0aGF0IGlzIDAuCisKKyAgICAgICAgQXMgcGVyIHRoZSBjcmFz aCB0cmFjZXMsIHdlIHNlZSBpdCBzdGFydHMgZnJvbSBXZWJMb2FkZXJTdHJhdGVneTo6aW50ZXJu YWxseUZhaWxlZExvYWRUaW1lckZpcmVkKCkKKyAgICAgICAgd2hpY2ggaXMgbGlrZWx5IGR1ZSB0 byB0aGUgTmV0d29yayBwcm9jZXNzIGNyYXNoaW5nLiBXZWJMb2FkZXJTdHJhdGVneTo6bmV0d29y a1Byb2Nlc3NDcmFzaGVkKCkKKyAgICAgICAgY2FsbHMgc2NoZWR1bGVJbnRlcm5hbGx5RmFpbGVk TG9hZCgpIG9uIGVhY2ggUmVzb3VyY2VMb2FkZXIgYW5kIGNsZWFycyB0aGUgV2ViUmVzb3VyY2VM b2FkZXJzIGluCisgICAgICAgIG1fd2ViUmVzb3VyY2VMb2FkZXJzLiBXaGVuIGEgUmVzb3VyY2VM b2FkZXIgaXMgY2FuY2VsbGVkIChtYXJrZWQgYXMgZmFpbGVkKSwgd2UgY2xlYXIgaXRzIGlkZW50 aWZpZXIKKyAgICAgICAgYW5kIHdlIG5vcm1hbGx5IG51bGwgb3V0IHRoZSBXZWJMb2FkZXJTdHJh dGVneSdzIGNvcmVMb2FkZXIuIEhvd2V2ZXIsIGlmIHdlIGNhbm5vdCBmaW5kIHRoZQorICAgICAg ICBXZWJSZXNvdXJjZUxvYWRlciBpbiBtX3dlYlJlc291cmNlTG9hZGVycyAoYmVjYXVzZSB0aGF0 IG1hcCB3YXMgYWxyZWFkeSBjbGVhcmVkKSB0aGVuIHRoZQorICAgICAgICBXZWJSZXNvdXJjZUxv YWRlcidzIGNvcmVMb2FkZXIgbWF5IG5vdCBnZXQgbnVsbGVkIG91dCwgZXZlbiBpZiB0aGUgY29y ZUxvYWRlcidzIGlkZW50aWZpZXIgaGFzCisgICAgICAgIGJlZW4gcmVzZXQuIFdlIGhhdmUgMiBs YW1iZGFzIGluIFdlYlJlc291cmNlTG9hZGVyIHdoaWNoIGtlZXAgdGhlIFdlYlJlc291cmNlTG9h ZGVyIGFsaXZlIGFuZAorICAgICAgICB0cnkgdG8gc2VuZCBJUEMgYW5kIGFyZSBtZXJlbHkgZG9p bmcgYSBudWxsIGNoZWNrIG9uIHRoZSBjb3JlTG9hZGVyIGJlZm9yZSB0cnlpbmcgdG8gc2VuZCB0 aGUKKyAgICAgICAgSVBDLgorCisgICAgICAgIFRvIGFkZHJlc3MgdGhlIGlzc3VlLCB3ZSBub3cg Y2xlYXIgdGhlIFdlYlJlc291cmNlTG9hZGVyJ3MgY29yZUxvYWRlciBpbgorICAgICAgICBXZWJM b2FkZXJTdHJhdGVneTo6bmV0d29ya1Byb2Nlc3NDcmFzaGVkKCkuIEZvciByb2J1c3RuZXNzLCB3 ZSBhbHNvIGNoZWNrIHRoYXQgYSBjb3JlTG9hZGVyJ3MKKyAgICAgICAgaWRlbnRpZmllciBpcyBu b3QgMCBiZWZvcmUgdHJ5aW5nIHRvIHNlbmQgSVBDLgorCisgICAgICAgICogV2ViUHJvY2Vzcy9O ZXR3b3JrL1dlYkxvYWRlclN0cmF0ZWd5LmNwcDoKKyAgICAgICAgKFdlYktpdDo6V2ViTG9hZGVy U3RyYXRlZ3k6Om5ldHdvcmtQcm9jZXNzQ3Jhc2hlZCk6CisgICAgICAgICogV2ViUHJvY2Vzcy9O ZXR3b3JrL1dlYlJlc291cmNlTG9hZGVyLmNwcDoKKyAgICAgICAgKFdlYktpdDo6V2ViUmVzb3Vy Y2VMb2FkZXI6OndpbGxTZW5kUmVxdWVzdCk6CisgICAgICAgIChXZWJLaXQ6OldlYlJlc291cmNl TG9hZGVyOjpkaWRSZWNlaXZlUmVzcG9uc2UpOgorCiAyMDE4LTA3LTEzICBDaHJpcyBEdW1leiAg PGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAgQWRkIG1vcmUgdGhyZWFkaW5nIHJlbGVhc2Ug YXNzZXJ0aW9ucwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL05ldHdvcmsv V2ViTG9hZGVyU3RyYXRlZ3kuY3BwIGIvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL05ldHdvcmsv V2ViTG9hZGVyU3RyYXRlZ3kuY3BwCmluZGV4IGJmZGYyZmQ5Yjc3ZTg3OWM5ZjE5YjNlZDc2MWZl ZGM2Njg3NzIyMjUuLjFmZmNjNTJjZDZlZTNhY2Y3MGIwYjI1YmM0MWU4M2VhNGI0NWYzYWMgMTAw NjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9OZXR3b3JrL1dlYkxvYWRlclN0cmF0 ZWd5LmNwcAorKysgYi9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvTmV0d29yay9XZWJMb2FkZXJT dHJhdGVneS5jcHAKQEAgLTQ1MCw4ICs0NTAsMTAgQEAgdm9pZCBXZWJMb2FkZXJTdHJhdGVneTo6 bmV0d29ya1Byb2Nlc3NDcmFzaGVkKCkKIHsKICAgICBSRUxFQVNFX0xPR19FUlJPUihOZXR3b3Jr LCAiV2ViTG9hZGVyU3RyYXRlZ3k6Om5ldHdvcmtQcm9jZXNzQ3Jhc2hlZDogZmFpbGluZyBhbGwg cGVuZGluZyByZXNvdXJjZSBsb2FkZXJzIik7CiAKLSAgICBmb3IgKGF1dG8mIGxvYWRlciA6IG1f d2ViUmVzb3VyY2VMb2FkZXJzKQotICAgICAgICBzY2hlZHVsZUludGVybmFsbHlGYWlsZWRMb2Fk KCpsb2FkZXIudmFsdWUtPnJlc291cmNlTG9hZGVyKCkpOworICAgIGZvciAoYXV0byYgbG9hZGVy IDogbV93ZWJSZXNvdXJjZUxvYWRlcnMudmFsdWVzKCkpIHsKKyAgICAgICAgc2NoZWR1bGVJbnRl cm5hbGx5RmFpbGVkTG9hZCgqbG9hZGVyLT5yZXNvdXJjZUxvYWRlcigpKTsKKyAgICAgICAgbG9h ZGVyLT5kZXRhY2hGcm9tQ29yZUxvYWRlcigpOworICAgIH0KIAogICAgIG1fd2ViUmVzb3VyY2VM b2FkZXJzLmNsZWFyKCk7CiAKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9O ZXR3b3JrL1dlYlJlc291cmNlTG9hZGVyLmNwcCBiL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9O ZXR3b3JrL1dlYlJlc291cmNlTG9hZGVyLmNwcAppbmRleCA2YTFiY2YzNTc2MjQ5ZDEwYmQ3ZDY4 MTE1ZDcwZTY0ZWYzZDEwZWUxLi4wYzVlZDZkOTA1ZjZjMWU1MDQyNTg0N2I1OTdlY2Y0YmJmNTA3 YWY2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvTmV0d29yay9XZWJSZXNv dXJjZUxvYWRlci5jcHAKKysrIGIvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL05ldHdvcmsvV2Vi UmVzb3VyY2VMb2FkZXIuY3BwCkBAIC05MiwxMSArOTIsMTEgQEAgdm9pZCBXZWJSZXNvdXJjZUxv YWRlcjo6d2lsbFNlbmRSZXF1ZXN0KFJlc291cmNlUmVxdWVzdCYmIHByb3Bvc2VkUmVxdWVzdCwg UmVzb3UKICAgICBpZiAobV9jb3JlTG9hZGVyLT5kb2N1bWVudExvYWRlcigpLT5hcHBsaWNhdGlv bkNhY2hlSG9zdCgpLm1heWJlTG9hZEZhbGxiYWNrRm9yUmVkaXJlY3QobV9jb3JlTG9hZGVyLmdl dCgpLCBwcm9wb3NlZFJlcXVlc3QsIHJlZGlyZWN0UmVzcG9uc2UpKQogICAgICAgICByZXR1cm47 CiAKLSAgICBtX2NvcmVMb2FkZXItPndpbGxTZW5kUmVxdWVzdChXVEZNb3ZlKHByb3Bvc2VkUmVx dWVzdCksIHJlZGlyZWN0UmVzcG9uc2UsIFtwcm90ZWN0ZWRUaGlzID0gbWFrZVJlZigqdGhpcyld KFJlc291cmNlUmVxdWVzdCYmIHJlcXVlc3QpIHsKLSAgICAgICAgaWYgKCFwcm90ZWN0ZWRUaGlz LT5tX2NvcmVMb2FkZXIpCisgICAgbV9jb3JlTG9hZGVyLT53aWxsU2VuZFJlcXVlc3QoV1RGTW92 ZShwcm9wb3NlZFJlcXVlc3QpLCByZWRpcmVjdFJlc3BvbnNlLCBbdGhpcywgcHJvdGVjdGVkVGhp cyA9IG1ha2VSZWYoKnRoaXMpXShSZXNvdXJjZVJlcXVlc3QmJiByZXF1ZXN0KSB7CisgICAgICAg IGlmICghbV9jb3JlTG9hZGVyIHx8ICFtX2NvcmVMb2FkZXItPmlkZW50aWZpZXIoKSkKICAgICAg ICAgICAgIHJldHVybjsKIAotICAgICAgICBwcm90ZWN0ZWRUaGlzLT5zZW5kKE1lc3NhZ2VzOjpO ZXR3b3JrUmVzb3VyY2VMb2FkZXI6OkNvbnRpbnVlV2lsbFNlbmRSZXF1ZXN0KHJlcXVlc3QsIHBy b3RlY3RlZFRoaXMtPm1fY29yZUxvYWRlci0+aXNBbGxvd2VkVG9Bc2tVc2VyRm9yQ3JlZGVudGlh bHMoKSkpOworICAgICAgICBzZW5kKE1lc3NhZ2VzOjpOZXR3b3JrUmVzb3VyY2VMb2FkZXI6OkNv bnRpbnVlV2lsbFNlbmRSZXF1ZXN0KHJlcXVlc3QsIG1fY29yZUxvYWRlci0+aXNBbGxvd2VkVG9B c2tVc2VyRm9yQ3JlZGVudGlhbHMoKSkpOwogICAgIH0pOwogfQogCkBAIC0xMjUsNyArMTI1LDcg QEAgdm9pZCBXZWJSZXNvdXJjZUxvYWRlcjo6ZGlkUmVjZWl2ZVJlc3BvbnNlKGNvbnN0IFJlc291 cmNlUmVzcG9uc2UmIHJlc3BvbnNlLCBib28KICAgICAgICAgICAgIG1faXNQcm9jZXNzaW5nTmV0 d29ya1Jlc3BvbnNlID0gZmFsc2U7CiAjZW5kaWYKICAgICAgICAgICAgIC8vIElmIG1fY29yZUxv YWRlciBiZWNvbWVzIG51bGwgYXMgYSByZXN1bHQgb2YgdGhlIGRpZFJlY2VpdmVSZXNwb25zZSBj YWxsYmFjaywgd2UgY2FuJ3QgdXNlIHRoZSBzZW5kIGZ1bmN0aW9uKCkuCi0gICAgICAgICAgICBp ZiAobV9jb3JlTG9hZGVyKQorICAgICAgICAgICAgaWYgKG1fY29yZUxvYWRlciAmJiBtX2NvcmVM b2FkZXItPmlkZW50aWZpZXIoKSkKICAgICAgICAgICAgICAgICBzZW5kKE1lc3NhZ2VzOjpOZXR3 b3JrUmVzb3VyY2VMb2FkZXI6OkNvbnRpbnVlRGlkUmVjZWl2ZVJlc3BvbnNlKCkpOwogICAgICAg ICB9OwogICAgIH0K