Issue 106413: Heap-use-after-free in WebCore::RenderBlock::checkFloatsInCleanLine

Upstreamed - https://bugs.webkit.org/show_bug.cgi?id=74056

Bulk edit for pending m17 beta release.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4741649

Uploader: inferno@chromium.org

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x7f4b0dffe0b8
Crash State:
  - crash stack -
  WebCore::RenderBoxModelObject::hasSelfPaintingLayer
  WebCore::RenderBlock::addOverhangingFloats
  - free stack -
  WebCore::Node::detach
  WebCore::Element::detach
  

Minimized Testcase (2.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96AYa0983Om-v8B_IE1MR0Blkv1iLXyZ_H4KO3d4KElNzmndpSDssQyfXbpnB8ttjpJ3lurF96nbcHJidj4rrfvqoyMfoI-9f3czf3f2yT73iWpPYBVsiWBa56Hb5gb6Cau4Rzl2rljP9rX1RFGR7FbednSiQ

This is not fixed by Robert's fix in http://trac.webkit.org/changeset/105120.

The last M16 patch is already gone. Mass-updating all of these to M17

 Issue 112136  has been merged into this issue.

here's a link to miaubiz' test case from 112136: https://cluster-fuzz.appspot.com/testcase?key=17424502

attaching patch using my left hand, someone needs to help through review, layouttest. this fixes both mine and miaubiz testcase.

Deleted: fix 765 bytes

fix 765 bytes View Download

 Issue 112438  has been merged into this issue.

 Issue 117577  has been merged into this issue.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=25009803

Fuzzer: Marty_html_twiddler

Crash Type: Heap-use-after-free READ 4
Crash Address: 0x7f02ca06b4b0
Crash State:
  - crash stack -
  WebCore::RenderBlock::checkFloatsInCleanLine
  WebCore::RenderBlock::determineEndPosition
  - free stack -
  WebCore::Node::detach
  WebCore::Element::detach
  
Regressed: https://cluster-fuzz.appspot.com/revisions?range=110080:110106

Minimized Testcase (6.29 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96HnvSVa_zAZymgO5gBeRwxKg4LOC37SWD4XIB6bWH7OwFrPkycrBGFuCveyqs8naYjVEJ3Vn3MvNTOQK3uHUQGfrgvhq1CLcibrVVUPgaZ8ggVqRUKO6ta6aCzUJfYdV2v78-3_XpdbsfJQVSnla9b7PQctA

Updating milestone. m18 is already out.

Reverting wrong marking of security bugs by release management.

Committed r112935: <http://trac.webkit.org/changeset/112935>

M18: http://trac.webkit.org/changeset/114853
M19: http://trac.webkit.org/changeset/114854

M19 compile fix from Abhishek at r114916
Reverted from M18 at r114853

Remerged to M18 with MOAR COMPILE WIN

M18: http://trac.webkit.org/changeset/114940

Marking old security bugs Fixed..

This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot