Bug 4269

Summary: reproducible crash in updateFirstLetter
Product: WebKit Reporter: David Carson <dacarson>
Component: Layout and RenderingAssignee: Beth Dakin <bdakin>
Status: RESOLVED DUPLICATE    
Severity: Critical CC: bdakin, dan, darin, mrowe
Priority: P1 Keywords: InRadar
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
URL: http://ducati.homedns.org/photos/upload/phototemplate.html
Attachments:
Description Flags
Test content to reproduce the bug none

Description David Carson 2005-08-02 09:40:06 PDT
 
Comment 1 Mark Rowe (bdash) 2005-08-31 23:54:26 PDT
The provided test case attempts to load data from 192.168.1.10, so fails to do anything for me.  Altering 
it to load data from the correct hostname results in the images being displayed correctly and no crash 
occurring using ToT WebKit.  Can you please provide a reduced test case or instructions on how to reliably 
reproduce the crash?
Comment 2 David Carson 2005-09-06 11:27:16 PDT
Created attachment 3787 [details]
Test content to reproduce the bug

The problem as I see it is that when the location.hash is set (in function
updatePageNumbers(), called from updateTable(), the variable headingElement is
no longer valid.
Code from updateTable() function:
--
    updatePageNumbers();
    headingElement.innerHTML = "flowers";
--
Comment 3 Joost de Valk (AlthA) 2005-10-06 01:36:00 PDT
Confirmed this one in ToT, moving to p1 since it's a reproducible crash. All you have to do is click the 
links in the testcase and wait a bit...
Comment 4 Darin Adler 2005-10-10 08:44:07 PDT
This looks like some kind of object lifetime problem in the render tree. The crash is in updateFirstLetter. I 
don't think the cause is the headingElement issue mentioned above.
Comment 5 Darin Adler 2005-12-11 20:18:27 PST
I bet this is the same thing as bug 3560.
Comment 6 Alice Liu 2006-01-09 17:40:22 PST
<rdar://problem/4330356>
Comment 7 Alice Liu 2006-01-09 17:41:44 PST

*** This bug has been marked as a duplicate of 3560 ***