Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

REGRESSION (261793@main): [Mail] Clicking markup button causes image/attachment to go blank/disappear #12887

Merged
merged 1 commit into from Apr 18, 2023
Merged

REGRESSION (261793@main): [Mail] Clicking markup button causes image/attachment to go blank/disappear #12887

merged 1 commit into from Apr 18, 2023

Conversation

whsieh
Copy link
Member

@whsieh whsieh commented Apr 18, 2023 •
edited by webkit-early-warning-system

bbae082

REGRESSION (261793@main): [Mail] Clicking markup button causes image/attachment to go blank/disappear
https://bugs.webkit.org/show_bug.cgi?id=255627
rdar://107635311

Reviewed by Aditya Keerthi.

After the changes in 261793@main, `WebKit::ContextMenuContextData` no longer decodes properly in the
UI process, when created via service controls codepaths (i.e. when clicking the services rollover
button over an attachment in Mail). This is because one of the new members, `m_hasEntireImage`, is
uninitialized to either `true` or `false` and ends up triggering undefined behavior; in turn, code
in the UI process expects either a value of exactly 0 or 1 when decoding `bool` types, so we
subsequently fail to decode and `MESSAGE_CHECK` the Mail web content process.

Fix this by simple initializing `m_hasEntireImage` (I've also added a few more initial values to
harden against similar bugs in the future).

Covered by the existing API test: ImageAnalysisTests.RemoveBackgroundItemInServicesMenu, which began
timing out after 261793@main. Also, credit to Aditya for being the first to spot that
`m_hasEntireImage` is uninitialized.

* Source/WebCore/page/ContextMenuContext.h:
* Source/WebKit/Shared/ContextMenuContextData.h:
* Source/WebKit/UIProcess/API/APIContextMenuElementInfoMac.h:

Canonical link: https://commits.webkit.org/263109@main

03728dd

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style   🛠 ios ✅ 🛠 mac ✅ 🛠 wpe   🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2
✅ 🧪 webkitperl   🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🛠 gtk
  🧪 ios-wk2-wpt ✅ 🧪 mac-wk1   🧪 gtk-wk2
❌ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🧪 api-gtk
✅ 🛠 tv   🧪 mac-AS-debug-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress
✅ 🛠 🧪 merge ✅ 🛠 watch
✅ 🛠 watch-sim

@whsieh whsieh requested a review from cdumez as a code owner April 18, 2023 22:09
@whsieh whsieh self-assigned this Apr 18, 2023
@whsieh whsieh changed the title ??? REGRESSION (261793@main): [Mail] Clicking markup button causes image/attachment to go blank/disappear Apr 18, 2023
@whsieh whsieh added the Platform Portability improvements and other general platform improvements not driven directly by site bugs. label Apr 18, 2023
@webkit-early-warning-system
Copy link
Collaborator

EWS run on current version of this PR (hash 03728dd)

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style   🛠 ios ✅ 🛠 mac ✅ 🛠 wpe   🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2
✅ 🧪 webkitperl   🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🛠 gtk
  🧪 ios-wk2-wpt ✅ 🧪 mac-wk1   🧪 gtk-wk2
❌ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🧪 api-gtk
✅ 🛠 tv   🧪 mac-AS-debug-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress
✅ 🛠 🧪 merge ✅ 🛠 watch
✅ 🛠 watch-sim

@whsieh
Copy link
Member Author

whsieh commented Apr 18, 2023

Thanks for the review!

@whsieh whsieh added the merge-queue Applied to send a pull request to merge-queue label Apr 18, 2023
@whsieh
REGRESSION (261793@main): [Mail] Clicking markup button causes image/…
bbae082 
…attachment to go blank/disappear

https://bugs.webkit.org/show_bug.cgi?id=255627
rdar://107635311

Reviewed by Aditya Keerthi.

After the changes in 261793@main, `WebKit::ContextMenuContextData` no longer decodes properly in the
UI process, when created via service controls codepaths (i.e. when clicking the services rollover
button over an attachment in Mail). This is because one of the new members, `m_hasEntireImage`, is
uninitialized to either `true` or `false` and ends up triggering undefined behavior; in turn, code
in the UI process expects either a value of exactly 0 or 1 when decoding `bool` types, so we
subsequently fail to decode and `MESSAGE_CHECK` the Mail web content process.

Fix this by simple initializing `m_hasEntireImage` (I've also added a few more initial values to
harden against similar bugs in the future).

Covered by the existing API test: ImageAnalysisTests.RemoveBackgroundItemInServicesMenu, which began
timing out after 261793@main. Also, credit to Aditya for being the first to spot that
`m_hasEntireImage` is uninitialized.

* Source/WebCore/page/ContextMenuContext.h:
* Source/WebKit/Shared/ContextMenuContextData.h:
* Source/WebKit/UIProcess/API/APIContextMenuElementInfoMac.h:

Canonical link: https://commits.webkit.org/263109@main
@webkit-commit-queue
Copy link
Collaborator

Committed 263109@main (bbae082): https://commits.webkit.org/263109@main

Reviewed commits have been landed. Closing PR #12887 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit bbae082 into WebKit:main Apr 18, 2023
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Apr 18, 2023
@whsieh whsieh deleted the eng/255627 branch April 19, 2023 00:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pxlcoder pxlcoder pxlcoder approved these changes

@cdumez cdumez Awaiting requested review from cdumez cdumez is a code owner

@hortont424 hortont424 Awaiting requested review from hortont424

@megangardner megangardner Awaiting requested review from megangardner

@jeffmapple jeffmapple Awaiting requested review from jeffmapple

Assignees

@whsieh whsieh

Labels
Platform Portability improvements and other general platform improvements not driven directly by site bugs.
Projects
None yet
Milestone
No milestone
4 participants
@whsieh @webkit-early-warning-system @webkit-commit-queue @pxlcoder