Bug 1728026 - NULL dereference in webkitWebViewResourceLoadStarted()
Summary: NULL dereference in webkitWebViewResourceLoadStarted()
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Fedora
Classification: Fedora
Component: webkit2gtk3
Version: rawhide
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Eike Rathke
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1732230 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-08 20:07 UTC by Adam Williamson
Modified: 2019-08-01 16:19 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-07-09 15:49:55 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
backtrace from coredumpctl/gdb (94.23 KB, text/plain)
2019-07-08 20:07 UTC, Adam Williamson
no flags Details


Links
System ID Private Priority Status Summary Last Updated
WebKit Project 199621 0 None None None 2019-07-09 15:49:54 UTC

Description Adam Williamson 2019-07-08 20:07:51 UTC
Created attachment 1588531 [details]
backtrace from coredumpctl/gdb

Evolution is crashing regularly for me in Rawhide. It's usually when I click on a folder or email, I think. I'm attaching the best backtrace I could get. abrt doesn't seem to be working in Rawhide ATM, so this is via coredumpctl.

Comment 1 Yanko Kaneti 2019-07-09 06:14:58 UTC
I have many of those too. The crash is in webkit - WebKit::WebFrameProxy::isMainFrame() , and started happening after the webkit2gtk3-2.25.2  update so I am not sure its evolutions fault.

Comment 2 Milan Crha 2019-07-09 09:10:14 UTC
Thanks for a bug report and the backtrace. It really shows a crash in WebKitGTK+ code, thus I move this there for further investigation. I didn't find anything related in the WebKit's bugzilla (using some simple search terms).

Comment 3 Michael Catanzaro 2019-07-09 15:30:16 UTC
Milan, do you want to move this to WebKit Bugzilla?

Some observations:

 * The main change in 2.25.2 is PSON (process swap on navigation), which is surely related
 * We don't know from the backtrace why the WebFrameProxy is invalid, because the invalid message is coming from the web process (from PageResourceLoadClient::didInitiateLoadForResource)
 * There are at least two bugs here: first that the web process is sending an invalid frame, second that this crashes the UI process. The UI process must be robust to a malicious web process sending invalid messages.

Comment 4 Milan Crha 2019-07-09 15:49:55 UTC
(In reply to Michael Catanzaro from comment #3)
> Milan, do you want to move this to WebKit Bugzilla?

Sure thing. See it for any further updates:
https://bugs.webkit.org/show_bug.cgi?id=199621

Comment 5 Adam Williamson 2019-07-09 18:11:50 UTC
Michael: "* There are at least two bugs here: first that the web process is sending an invalid frame, second that this crashes the UI process. The UI process must be robust to a malicious web process sending invalid messages."

Is "the UI process" there something that's part of Evolution, or part of Webkit? If it's the former, should we file an Evo bug for that?

Comment 6 Michael Catanzaro 2019-07-09 19:44:33 UTC
Well the UI process is the evolution process, but it's a WebKit bug. The WebKitWebProcess should not be able to crash the main evolution process due to a missing null check in WebKit.

Comment 7 Adam Williamson 2019-07-22 15:15:05 UTC
So since this crash was fixed, quite often I click on a mail in Evolution and the preview pane goes to 'Retrieving message "XXXXX"', but never clears and actually shows the message. If I click on another message and then back to the one I was trying to view, it'll usually work.

I'm guessing this is probably the same scenario that previously triggered the crash, right? Is there anything I can do to help figure out what's going on and avoid the 'mail doesn't load' problem?

Comment 8 Milan Crha 2019-08-01 16:00:51 UTC
*** Bug 1732230 has been marked as a duplicate of this bug. ***

Comment 9 Milan Crha 2019-08-01 16:19:35 UTC
I can provide you a test build of Evolution with some added debug prints related to the message load and the web view update. That won't show anything from the webkit code, it would show only things as Evolution sees them.


Note You need to log in before you can comment on or make changes to this bug.