193456 2019-01-15 12:13:49 -0800 [iOS] Attempting to open a Keynote document to iCloud.com from iCloud Files causes crash 2019-02-04 15:01:35 -0800 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 joepeck joepeck ap bfulgham commit-queue joepeck pvollan webkit-bug-importer wenson_hsieh oldest_to_newest 1494752 0 joepeck 2019-01-15 12:13:49 -0800 Attempting to open a Keynote document to iCloud.com from iCloud Files causes crash Steps To Reproduce: 1. Log in to icloud.com 2. Open Keynote 3. Tap the Cloud+Arrow icon at the top 4. Tap "Browse" to access iCloud Files 5. Select a "On My iPad" file (create one using Keynote app outside of Safari for example) => WebContent crashes Crash: Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFY Triggered by Thread: 0 Application Specific Information: *** Terminating app due to uncaught exception 'NSRangeException', reason: '*** -[__NSArrayM objectAtIndexedSubscript:]: index 0 beyond bounds for empty array' terminating with uncaught exception of type NSException abort() called Last Exception Backtrace: 0 CoreFoundation 0x1a2c3fb08 __exceptionPreprocess + 232 (NSException.m:198) 1 libobjc.A.dylib 0x1a3144a58 objc_exception_throw + 56 (objc-exception.mm:557) 2 CoreFoundation 0x1a2ba5174 _CFThrowFormattedException + 112 (CFObject.m:1969) 3 CoreFoundation 0x1a2b2a418 -[__NSArrayM objectAtIndexedSubscript:] + 180 (NSArrayM.m:299) 4 WebKit 0x19bc14c74 WebKit::fallbackIconForFile(NSURL*) + 60 (WebIconUtilities.mm:101) 5 WebKit 0x19bc15164 WebKit::iconForFile(NSURL*) + 160 (WebIconUtilities.mm:157) 6 WebKit 0x19bdb734c WebKit::WebChromeClient::createIconForFiles(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul> const&) + 100 (WebChromeClientIOS.mm:155) 7 WebKit 0x19be5de7c WebKit::WebChromeClient::loadIconForFiles(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::FileIconLoader&) + 28 (WebChromeClient.cpp:819) 8 WebCore 0x1a8b3de44 WebCore::FileInputType::setFiles(WTF::RefPtr<WebCore::FileList, WTF::DumbPtrTraits<WebCore::FileList> >&&, WebCore::FileInputType::RequestIcon) + 600 (FileInputType.cpp:393) 9 WebCore 0x1a8b47768 WTF::Function<void (WTF::Ref<WebCore::FileList, WTF::DumbPtrTraits<WebCore::FileList> >&&)>::CallableWrapper<WebCore::FileInputType::filesChosen(WTF::Vector<WebCore::FileChooserFileInfo, 0ul, WTF::CrashOnOverflow, 16ul> const&, WTF::String const&, WebCore::Icon*)::$_0>::call(WTF::Ref<WebCore::FileList, WTF::DumbPtrTraits<WebCore::FileList> >&&) + 56 (FileInputType.cpp:418) ... 1494753 1 joepeck 2019-01-15 12:14:02 -0800 <rdar://problem/47275642> 1494754 2 359190 joepeck 2019-01-15 12:15:23 -0800 Created attachment 359190 [PATCH] Proposed Fix 1494802 3 359190 wenson_hsieh 2019-01-15 13:54:05 -0800 Comment on attachment 359190 [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=359190&action=review > Source/WebKit/Shared/ios/WebIconUtilities.mm:101 > + if (!interactionController.icons.count) This check seems a bit strange. According to https://developer.apple.com/documentation/uikit/uidocumentinteractioncontroller/1616801-icons?language=objc, the resulting icons should be non-empty. I wonder if <rdar://problem/37157837> has resurfaced... 1494842 4 joepeck 2019-01-15 15:08:51 -0800 > I wonder if <rdar://problem/37157837> has resurfaced... Likely. I filed <rdar://problem/47292126> which seems related. Should we bother trying to protect against this or rely on other components to make a fix? 1494856 5 wenson_hsieh 2019-01-15 15:35:13 -0800 (In reply to Joseph Pecoraro from comment #4) > > I wonder if <rdar://problem/37157837> has resurfaced... > > Likely. I filed <rdar://problem/47292126> which seems related. > > Should we bother trying to protect against this or rely on other components > to make a fix? Hm...IMO, we should keep this in the backburner, and wait to see if the relevant folks are willing to pull <rdar://problem/47292126> into the relevant release. If that bug is punted, then it's probably for the better to land this as a mitigation (preferably with a comment citing that the check shouldn't be needed once <rdar://problem/47292126> is addressed). 1498637 6 360210 joepeck 2019-01-25 19:04:34 -0800 Created attachment 360210 [PATCH] Proposed Fix 1498639 7 360210 joepeck 2019-01-25 19:05:24 -0800 Comment on attachment 360210 [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=360210&action=review > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:173 > (allow mach-lookup > (xpc-service-name "com.apple.lsdiconservice") ;; Remove this line after <rdar://problem/47151295> is fixed. > (xpc-service-name "com.apple.iconservice")) I'm not sure if we should get rid of these at this point, but I'm leaving them to be safe. 1498650 8 360210 bfulgham 2019-01-25 19:37:21 -0800 Comment on attachment 360210 [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=360210&action=review > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:175 > + (global-name "com.apple.iconservices")) I think the prior line might be a typo: "com.apple.iconservice" -> "com.apple.iconservice". Can you try just adding the 's' to icon service and see if it fixes it? 1498653 9 bfulgham 2019-01-25 19:39:10 -0800 (In reply to Brent Fulgham from comment #8) > Comment on attachment 360210 [details] > I think the prior line might be a typo: "com.apple.iconservice" -> > "com.apple.iconservice". See! I did it again! "com.apple.iconservice" -> "com.apple.iconservices". 1499090 10 joepeck 2019-01-28 11:06:27 -0800 (In reply to Brent Fulgham from comment #8) > Comment on attachment 360210 [details] > [PATCH] Proposed Fix > > View in context: > https://bugs.webkit.org/attachment.cgi?id=360210&action=review > > > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:175 > > + (global-name "com.apple.iconservices")) > > I think the prior line might be a typo: "com.apple.iconservice" -> > "com.apple.iconservice[s]". This does not solve the issue. Note that even though there is: (xpc-service-name "com.apple.lsdiconservice") There is also (further down): (global-name "com.apple.lsdiconservice") --- Would you rather I move the addition: (allow mach-lookup (global-name "com.apple.iconservices")) Down into the section at the bottom which has "with report": (allow mach-lookup (with report) ...) 1499178 11 bfulgham 2019-01-28 14:16:00 -0800 (In reply to Joseph Pecoraro from comment #10) > (In reply to Brent Fulgham from comment #8) > > Comment on attachment 360210 [details] > > [PATCH] Proposed Fix > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=360210&action=review > > > > > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:175 > > > + (global-name "com.apple.iconservices")) > > > > I think the prior line might be a typo: "com.apple.iconservice" -> > > "com.apple.iconservice[s]". > > This does not solve the issue. Okay. Thank you for checking. 1499180 12 360210 bfulgham 2019-01-28 14:17:56 -0800 Comment on attachment 360210 [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=360210&action=review >>>> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:175 >>>> + (global-name "com.apple.iconservices")) >>> >>> I think the prior line might be a typo: "com.apple.iconservice" -> "com.apple.iconservice". >>> >>> Can you try just adding the 's' to icon service and see if it fixes it? >> >> This does not solve the issue. >> >> Note that even though there is: >> >> (xpc-service-name "com.apple.lsdiconservice") >> >> There is also (further down): >> >> (global-name "com.apple.lsdiconservice") >> >> --- >> >> Would you rather I move the addition: >> >> (allow mach-lookup >> (global-name "com.apple.iconservices")) >> >> Down into the section at the bottom which has "with report": >> >> (allow mach-lookup (with report) >> ...) > > Okay. Thank you for checking. Can you please change the incorrect string: (xpc-service-name "com.apple.iconservice") To the correct service name: (xpc-service-name "com.apple.iconservices") ... and then add your new rule for global-name? (allow mach-lookup (global-name "com.apple.iconservices")) 1499181 13 bfulgham 2019-01-28 14:18:43 -0800 (In reply to Joseph Pecoraro from comment #10) > Would you rather I move the addition down into the section at the bottom which has "with report": No, please leave it separate. The 'with-report' section is for something Per Arne and I are working on. Thanks! 1499192 14 360376 joepeck 2019-01-28 14:38:54 -0800 Created attachment 360376 [PATCH] For Landing 1499221 15 360376 commit-queue 2019-01-28 15:18:08 -0800 Comment on attachment 360376 [PATCH] For Landing Clearing flags on attachment: 360376 Committed r240606: <https://trac.webkit.org/changeset/240606> 359190 2019-01-15 12:15:23 -0800 2019-01-25 19:04:34 -0800 [PATCH] Proposed Fix bail-1.patch text/plain 1325 joepeck ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nIGIvU291cmNlL1dlYktpdC9DaGFu Z2VMb2cKaW5kZXggMTMxOWRkZTE3OWEuLmUxODcwMGYxMTBjIDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViS2l0L0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViS2l0L0NoYW5nZUxvZwpAQCAtMSwzICsx LDE1IEBACisyMDE5LTAxLTE1ICBKb3NlcGggUGVjb3Jhcm8gIDxwZWNvcmFyb0BhcHBsZS5jb20+ CisKKyAgICAgICAgW2lPU10gQXR0ZW1wdGluZyB0byBvcGVuIGEgS2V5bm90ZSBkb2N1bWVudCB0 byBpQ2xvdWQuY29tIGZyb20gaUNsb3VkIEZpbGVzIGNhdXNlcyBjcmFzaAorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTkzNDU2CisgICAgICAgIDxyZGFy Oi8vcHJvYmxlbS80NzI3NTY0Mj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KKworICAgICAgICAqIFNoYXJlZC9pb3MvV2ViSWNvblV0aWxpdGllcy5tbToKKyAgICAgICAg KFdlYktpdDo6ZmFsbGJhY2tJY29uRm9yRmlsZSk6CisgICAgICAgIEJhaWwgaWYgd2UgZGlkIG5v dCBnZXQgYSBsaXN0IG9mIGljb25zLgorCiAyMDE5LTAxLTA3ICBEZWFuIEphY2tzb24gIDxkaW5v QGFwcGxlLmNvbT4KIAogICAgICAgICBUdXJuIG9uIFBvaW50ZXIgRXZlbnRzIGJ5IGRlZmF1bHQg Zm9yIGlPUwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9TaGFyZWQvaW9zL1dlYkljb25VdGls aXRpZXMubW0gYi9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9pb3MvV2ViSWNvblV0aWxpdGllcy5tbQpp bmRleCAzNjcwNTgwODgwYy4uM2FmNjI5MzFmY2MgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQv U2hhcmVkL2lvcy9XZWJJY29uVXRpbGl0aWVzLm1tCisrKyBiL1NvdXJjZS9XZWJLaXQvU2hhcmVk L2lvcy9XZWJJY29uVXRpbGl0aWVzLm1tCkBAIC05OCw2ICs5OCw5IEBAIFVJSW1hZ2UqIGZhbGxi YWNrSWNvbkZvckZpbGUoTlNVUkwgKmZpbGUpCiAgICAgQVNTRVJUX0FSRyhmaWxlLCBbZmlsZSBp c0ZpbGVVUkxdKTsKIAogICAgIFVJRG9jdW1lbnRJbnRlcmFjdGlvbkNvbnRyb2xsZXIgKmludGVy YWN0aW9uQ29udHJvbGxlciA9IFtVSURvY3VtZW50SW50ZXJhY3Rpb25Db250cm9sbGVyIGludGVy YWN0aW9uQ29udHJvbGxlcldpdGhVUkw6ZmlsZV07CisgICAgaWYgKCFpbnRlcmFjdGlvbkNvbnRy b2xsZXIuaWNvbnMuY291bnQpCisgICAgICAgIHJldHVybiBuaWw7CisKICAgICByZXR1cm4gdGh1 bWJuYWlsU2l6ZWRJbWFnZUZvckltYWdlKGludGVyYWN0aW9uQ29udHJvbGxlci5pY29uc1swXS5D R0ltYWdlKTsKIH0KIAo= 360210 2019-01-25 19:04:34 -0800 2019-01-28 14:17:56 -0800 [PATCH] Proposed Fix better-1.patch text/plain 1388 joepeck ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nIGIvU291cmNlL1dlYktpdC9DaGFu Z2VMb2cKaW5kZXggM2Y3MTFlYWEzZjguLmU3NGEyZjFhMGFkIDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViS2l0L0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViS2l0L0NoYW5nZUxvZwpAQCAtMSwzICsx LDE0IEBACisyMDE5LTAxLTI1ICBKb3NlcGggUGVjb3Jhcm8gIDxwZWNvcmFyb0BhcHBsZS5jb20+ CisKKyAgICAgICAgW2lPU10gQXR0ZW1wdGluZyB0byBvcGVuIGEgS2V5bm90ZSBkb2N1bWVudCB0 byBpQ2xvdWQuY29tIGZyb20gaUNsb3VkIEZpbGVzIGNhdXNlcyBjcmFzaAorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTkzNDU2CisgICAgICAgIDxyZGFy Oi8vcHJvYmxlbS80NzI3NTY0Mj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KKworICAgICAgICAqIFJlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5X ZWJLaXQuV2ViQ29udGVudC5zYjoKKyAgICAgICAgQWxsb3cgYWNjZXNzIHRvIGljb25zZXJ2aWNl cy4KKwogMjAxOS0wMS0yNCAgUnlvc3VrZSBOaXdhICA8cm5pd2FAd2Via2l0Lm9yZz4KIAogICAg ICAgICBpT1M6IFNwbGl0IGtleWJvYXJkIHNob3VsZCBub3Qgc2hyaW5rIHZpc3VhbFZpZXdwb3J0 LmhlaWdodApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2Zp bGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IgYi9Tb3VyY2UvV2ViS2l0L1Jl c291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5z YgppbmRleCBlYjlmMDQ2MzFiMy4uZTI1NWIxYTZlMTEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJL aXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250 ZW50LnNiCisrKyBiL1NvdXJjZS9XZWJLaXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3Mv Y29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNiCkBAIC0xNzEsNiArMTcxLDggQEAKIChhbGxv dyBtYWNoLWxvb2t1cAogICAgICh4cGMtc2VydmljZS1uYW1lICJjb20uYXBwbGUubHNkaWNvbnNl cnZpY2UiKSA7OyBSZW1vdmUgdGhpcyBsaW5lIGFmdGVyIDxyZGFyOi8vcHJvYmxlbS80NzE1MTI5 NT4gaXMgZml4ZWQuCiAgICAgKHhwYy1zZXJ2aWNlLW5hbWUgImNvbS5hcHBsZS5pY29uc2Vydmlj ZSIpKQorKGFsbG93IG1hY2gtbG9va3VwCisgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuaWNv bnNlcnZpY2VzIikpCiAKIDs7IENvbW1vbiBtYWNoIHNlcnZpY2VzIG5lZWRlZCBieSBVSUtpdC4K IChhbGxvdyBtYWNoLWxvb2t1cAo= 360376 2019-01-28 14:38:54 -0800 2019-01-28 15:18:08 -0800 [PATCH] For Landing for-landing-sb-1.patch text/plain 1507 joepeck ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nIGIvU291cmNlL1dlYktpdC9DaGFu Z2VMb2cKaW5kZXggNWQwZjVkOWNmNDkuLjJlMTEyNjE2NzEzIDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViS2l0L0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViS2l0L0NoYW5nZUxvZwpAQCAtMSwzICsx LDE0IEBACisyMDE5LTAxLTI4ICBKb3NlcGggUGVjb3Jhcm8gIDxwZWNvcmFyb0BhcHBsZS5jb20+ CisKKyAgICAgICAgW2lPU10gQXR0ZW1wdGluZyB0byBvcGVuIGEgS2V5bm90ZSBkb2N1bWVudCB0 byBpQ2xvdWQuY29tIGZyb20gaUNsb3VkIEZpbGVzIGNhdXNlcyBjcmFzaAorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTkzNDU2CisgICAgICAgIDxyZGFy Oi8vcHJvYmxlbS80NzI3NTY0Mj4KKworICAgICAgICBSZXZpZXdlZCBieSBCcmVudCBGdWxnaGFt LgorCisgICAgICAgICogUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldl YktpdC5XZWJDb250ZW50LnNiOgorICAgICAgICBBbGxvdyBhY2Nlc3MgdG8gaWNvbnNlcnZpY2Vz LgorCiAyMDE5LTAxLTI4ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAg ICAgUmVncmVzc2lvbihQU09OKSBDcmFzaCB1bmRlciBXZWJQYWdlUHJveHk6OmRpZFN0YXJ0UHJv Z3Jlc3MoKQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2Zp bGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IgYi9Tb3VyY2UvV2ViS2l0L1Jl c291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5z YgppbmRleCAyMDlmNDZjZTBhMS4uYTYwYjg3ZjI3MmIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJL aXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250 ZW50LnNiCisrKyBiL1NvdXJjZS9XZWJLaXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3Mv Y29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNiCkBAIC0xNzAsNyArMTcwLDggQEAKICAgICAo d2VsbC1rbm93bi1zeXN0ZW0tZ3JvdXAtY29udGFpbmVyLXN1YnBhdGggIi9zeXN0ZW1ncm91cC5j b20uYXBwbGUubHNkLmljb25zY2FjaGUiKSkKIChhbGxvdyBtYWNoLWxvb2t1cAogICAgICh4cGMt c2VydmljZS1uYW1lICJjb20uYXBwbGUubHNkaWNvbnNlcnZpY2UiKSA7OyBSZW1vdmUgdGhpcyBs aW5lIGFmdGVyIDxyZGFyOi8vcHJvYmxlbS80NzE1MTI5NT4gaXMgZml4ZWQuCi0gICAgKHhwYy1z ZXJ2aWNlLW5hbWUgImNvbS5hcHBsZS5pY29uc2VydmljZSIpKQorICAgICh4cGMtc2VydmljZS1u YW1lICJjb20uYXBwbGUuaWNvbnNlcnZpY2VzIikKKyAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBs ZS5pY29uc2VydmljZXMiKSkKIAogOzsgQ29tbW9uIG1hY2ggc2VydmljZXMgbmVlZGVkIGJ5IFVJ S2l0LgogKGFsbG93IG1hY2gtbG9va3VwCg==