Bug 218499

Summary: Null Ptr Deref @ WebCore::RenderDeprecatedFlexibleBox::applyLineClamp+0
Product: WebKit Reporter: Ian Gilbert <iang>
Component: Layout and RenderingAssignee: Rob Buis <rbuis>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, cgarcia, ews-feeder, product-security, rbuis, rniwa, rwlbuis, simon.fraser, svillar, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Crashing input
none
Reduced crashing input
none
Patch
none
Patch
none
Patch none

Description Ian Gilbert 2020-11-03 03:32:38 PST 
Stack Trace
=========

frame #0: WebCore`WebCore::InlineBox::renderer() const+0
frame #1: WebCore`WebCore::RenderDeprecatedFlexibleBox::applyLineClamp(WebCore::FlexBoxIterator&, bool)+0
frame #2: WebCore`WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox(bool)+0
frame #3: WebCore`WebCore::RenderDeprecatedFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit)+0
frame #4: WebCore`WebCore::RenderBlock::layout()+0
frame #5: WebCore`WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0
frame #6: WebCore`WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0
frame #7: WebCore`WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)+0
frame #8: WebCore`WebCore::RenderBlock::layout()+0
frame #9: WebCore`WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)+0
frame #10: WebCore`WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)+0
Comment 1 Radar WebKit Bug Importer 2020-11-03 03:32:58 PST 
<rdar://problem/70988379>
Comment 2 Ian Gilbert 2020-11-03 03:33:42 PST 
Created attachment 413035 [details]
Crashing input
Comment 3 Ryosuke Niwa 2020-11-03 13:09:13 PST 
<rdar://problem/66166850>
Comment 4 Ian Gilbert 2020-11-05 00:26:51 PST 
Created attachment 413267 [details]
Reduced crashing input
Comment 5 Ryosuke Niwa 2020-11-05 00:27:41 PST 
(In reply to Ian Gilbert from comment #4)
> Created attachment 413267 [details]
> Reduced crashing input

Nice!
Comment 6 Rob Buis 2020-11-06 00:34:22 PST 
Created attachment 413409 [details]
Patch
Comment 7 EWS 2020-11-06 13:45:39 PST 
Committed r269537: <https://trac.webkit.org/changeset/269537>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 413409 [details].
Comment 8 Ryosuke Niwa 2020-11-06 19:48:25 PST 
Are there any security implications here? If not, we should move it to non-security component and add a test.
Comment 9 zalan 2020-11-06 20:35:17 PST 
I don' think there is any.
Comment 10 Ryosuke Niwa 2020-11-06 20:49:17 PST 
Can we add a test?
Comment 11 Rob Buis 2020-11-07 02:36:14 PST 
Created attachment 413523 [details]
Patch
Comment 12 Ryosuke Niwa 2020-11-07 16:05:59 PST 
Comment on attachment 413523 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=413523&action=review

> LayoutTests/fast/overflow/line-clamp-crash.html:6
> +    if (window.testRunner)

Remove the indentation here?
Comment 13 Rob Buis 2020-11-07 23:39:56 PST 
Created attachment 413541 [details]
Patch
Comment 14 EWS 2020-11-08 00:32:00 PST 
Committed r269567: <https://trac.webkit.org/changeset/269567>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 413541 [details].
Comment 15 Ryosuke Niwa 2020-11-09 16:19:08 PST 
*** Bug 218497 has been marked as a duplicate of this bug. ***