[Webkit-unassigned] [Bug 227340] New: Crash in legacy WebView due to unguarded makeSimpleRange dereference

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=227340

            Bug ID: 227340
           Summary: Crash in legacy WebView due to unguarded
                    makeSimpleRange dereference
           Product: WebKit
           Version: Other
          Hardware: Mac (Intel)
                OS: macOS 11
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: haisenko at equinux.com

Created attachment 432136

  --> https://bugs.webkit.org/attachment.cgi?id=432136&action=review

Crash log 1

Starting with macOS 11.3, we are seeing a lot more WebKit crashes in our app that uses the legacy WebView. With the help of the crash reports (which already told us in which method the crash is happening), disassembler and WebKit sources I was able to trace the crash to two lines in `WebEditorClient::requestCandidatesForSelection`. They call `makeSimpleRange` and dereference the result, assuming the return value is never NULL. Unfortunately, it now sometimes is and thus crashes (_why_ that is happening now may also be interesting, apart from fixing the crash).

See lines 1110 and 1111 in WebEditorClient.mm.

https://trac.webkit.org/browser/webkit/trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm?rev=278253#L1110

    auto selectionStartOffsetInParagraph = characterCount(*makeSimpleRange(startOfParagraph(selectionStart), selectionStart));
    auto selectionLength = characterCount(*makeSimpleRange(selectionStart, selection.visibleEnd()));

We see this crash on macOS 11.3 and newer, both Intel and M1. (It might have happened on earlier versions as well but there definitely is an increase since macOS 11.3.) Unfortunately, I don't have a recipe for reproducing the crash yet (we are not able to reproduce it in-house but see lots of crash reports from users and have users that contact us because of this). It seems there are multiple paths leading to this crash, but they all end up crashing in `WebEditorClient::requestCandidatesForSelection + 2505` on Intel (macOS 11.4) or `WebEditorClient::requestCandidatesForSelection + 2528` on M1 (macOS 11.4).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210624/c3ddf5ec/attachment-0001.htm>