[Webkit-unassigned] [Bug 63934] New: event handler loop NULL ptr

Tue Jul 5 05:35:42 PDT 2011

https://bugs.webkit.org/show_bug.cgi?id=63934

           Summary: event handler loop NULL ptr
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skylined at chromium.org
                CC: eric at webkit.org


Created an attachment (id=99705)
 --> (https://bugs.webkit.org/attachment.cgi?id=99705&action=review)
Repro

Chromium: https://code.google.com/p/chromium/issues/detail?id=88443
Repro:
<body onload="go()"></body>
<script>
  function go() {
    document.open();
    document.addEventListener("load", document.dispatchEvent, true);
    document.write("<x>");
    document.addEventListener("load", window.MouseEvent, true);
    document.documentElement.innerHTML += "<iframe>";
  }
</script>

id:             chrome.dll!WebCore::V8AbstractEventListener::invokeEventHandler ReadAV at NULL (f2d876aa7adcf71aaf4a1a1a3b32680c)
description:    Attempt to read from unallocated NULL pointer in chrome.dll!WebCore::V8AbstractEventListener::invokeEventHandler
application:    Chromium 14.0.811.0
stack:          chrome.dll!WebCore::V8AbstractEventListener::invokeEventHandler
                chrome.dll!WebCore::V8AbstractEventListener::handleEvent
                chrome.dll!WebCore::EventTarget::fireEventListeners
                chrome.dll!WebCore::EventTarget::fireEventListeners
                chrome.dll!WebCore::Node::handleLocalEvents
                chrome.dll!WebCore::EventDispatcher::dispatchEvent
                chrome.dll!WebCore::EventDispatchMediator::dispatchEvent
                chrome.dll!WebCore::EventDispatcher::dispatchEvent
                chrome.dll!WebCore::Node::dispatchEvent
                chrome.dll!WebCore::EventTarget::dispatchEvent
                chrome.dll!WebCore::EventSourceInternal::dispatchEventCallback
                chrome.dll!v8::internal::HandleApiCallHelper<...>
                chrome.dll!v8::internal::Builtin_HandleApiCall
                chrome.dll!v8::internal::Invoke
                chrome.dll!v8::internal::Execution::Call
                chrome.dll!v8::Function::Call
                chrome.dll!WebCore::V8Proxy::callFunction
                chrome.dll!WebCore::V8EventListener::callListenerFunction
                chrome.dll!WebCore::V8AbstractEventListener::invokeEventHandler
                ...etc...

The repro causes an infinite loop. v8 code detects this using a recursion counter and throws an exception. The event's target is set to NULL, which later causes a NULL ptr exception in V8AbsractEventListener (webkit\source\webcore\bindings\v8\V8AbstractEventListener.cpp at 156):
            event->target()->uncaughtExceptionInEventHandler();

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.