WPEWebProcess Crash in SpaceSplitString.h

[aazamansari]

#0 checkOne libWPEWebKit.so.0.0.20161117 Source/WebCore/dom/SpaceSplitString.h:39 (0x0)
#1 matchRecursively libWPEWebKit.so.0.0.20161117 Source/WebCore/css/SelectorChecker.cpp:275 (0x0)
#2 match libWPEWebKit.so.0.0.20161117 Source/WebCore/css/SelectorChecker.cpp:186 (0x0)
#3 collectMatchingRulesForList libWPEWebKit.so.0.0.20161117 Source/WebCore/css/ElementRuleCollector.cpp:470 (0xc)
#4 collectMatchingRules libWPEWebKit.so.0.0.20161117 Source/WebCore/css/ElementRuleCollector.cpp:155 (0xc)
#5 matchUARules libWPEWebKit.so.0.0.20161117 Source/WebCore/css/ElementRuleCollector.cpp:368 (0x0)
#6 matchUARules libWPEWebKit.so.0.0.20161117 Source/WebCore/css/ElementRuleCollector.cpp:355 (0x8)
#7 matchAllRules libWPEWebKit.so.0.0.20161117 Source/WebCore/css/ElementRuleCollector.cpp:533 (0x0)
#8 styleForElement libWPEWebKit.so.0.0.20161117 Source/WebCore/css/StyleResolver.cpp:426 (0x10)
#9 styleForElement libWPEWebKit.so.0.0.20161117 Source/WebCore/style/StyleTreeResolver.cpp:152 (0x20)
#10 resolveElement libWPEWebKit.so.0.0.20161117 Source/WebCore/style/StyleTreeResolver.cpp:198 (0x1c)
#11 resolveComposedTree libWPEWebKit.so.0.0.20161117 Source/WebCore/style/StyleTreeResolver.cpp:402 (0xc)
#12 resolve libWPEWebKit.so.0.0.20161117 Source/WebCore/style/StyleTreeResolver.cpp:458 (0x0)
#13 recalcStyle libWPEWebKit.so.0.0.20161117 Source/WebCore/dom/Document.cpp:1822 (0xc)
#14 sharedTimerFiredInternal libWPEWebKit.so.0.0.20161117 Source/WebCore/platform/ThreadTimers.cpp:121 (0x0)
#15 _FUN libWPEWebKit.so.0.0.20161117 Source/WTF/wtf/glib/RunLoopGLib.cpp:165 (0x0)
#16 g_main_context_dispatch libglib-2.0.so.0.4800.1 glib-2.48.1/glib/gmain.c:3154 (0x0)
#17 g_main_context_iterate libglib-2.0.so.0.4800.1 glib-2.48.1/glib/gmain.c:3840 (0x4)
#18 g_main_loop_run libglib-2.0.so.0.4800.1 glib-2.48.1/glib/gmain.c:4034 (0x8)
#19 run libWPEWebKit.so.0.0.20161117 Source/WTF/wtf/glib/RunLoopGLib.cpp:97 (0x4)
#20 ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> libWPEWebKit.so.0.0.20161117 Source/WebKit2/Shared/unix/ChildProcessMain.h:61 (0x4)
#21 main WPEWebProcess Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:52 (0x8)
#22 libc-2.19.so@0x19554 libc-2.19.so
#23 libc-2.19.so@0x19510 libc-2.19.so
#24 ld-2.19.so@0xd90 ld-2.19.so

[aazamansari]

Shouldn't there be a null check before dereferencing the data pointer in below code?

bool contains(const AtomicString& string)
{
const AtomicString* data = tokenArrayStart();
unsigned i = 0;
do {
if (data[i] == string)
return true;
++i;
} while (i < m_size);
return false;
}

Hi @aazam,
can you please suggest the steps to reproduce the crash. Meanwhile I tried to write JS test app to reproduce the crash.

[aazamansari]

We have been trying to reproduce this issue on our side but is not reproducible anymore. I think we can close this issue.