Bug 15507 – Calling removeChild() on a textarea with selected text causes safari crash

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: WebCore JavaScript

[Daniel Pasco]

We see this consistently using the Mentat Task Service (http://gomentat.com) using a variety of Safari versions, including Version 3.0 (5522.11).

This has been reported to us independently by multiple users, does not occur with Firefox or Internet Explorer.

It can be worked around by unselected the code before calling removeChild(), in which case it works fine.  I have guessed on the component.


Process:         Safari [201]
Path:            /Applications/Safari.app/Contents/MacOS/Safari
Identifier:      com.apple.Safari
Version:         5522.11 (5522.11)
Build Info:      WebBrowser-55221100~2
Code Type:       X86 (Native)
Parent Process:  launchd [128]

Date/Time:       2007-10-10 21:49:04.487 -0700
OS Version:      Mac OS X 10.5 (9A499)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000004
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore                   0x90e496c4 WebCore::RenderTextControl::updatePlaceholder() + 164
1   com.apple.WebCore                   0x90e49d3f WebCore::RenderTextControl::updateFromElement() + 95
2   com.apple.WebCore                   0x90ef6582 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 306
3   com.apple.WebCore                   0x90ef6582 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 306
4   com.apple.WebCore                   0x90ef6582 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 306
5   com.apple.WebCore                   0x90ef6582 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 306
6   com.apple.WebCore                   0x90ef6582 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 306
7   com.apple.WebCore                   0x90ef6582 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 306
8   com.apple.WebCore                   0x90ef6582 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 306
9   com.apple.WebCore                   0x90d7c57f WebCore::Document::recalcStyle(WebCore::Node::StyleChange) + 95
10  com.apple.WebCore                   0x90d75093 WebCore::Document::updateRendering() + 51
11  com.apple.WebCore                   0x90cb0736 WebCore::HTMLElement::isContentEditable() const + 70
12  com.apple.WebCore                   0x90ef088b WebCore::Node::isContentEditable() const + 27
13  com.apple.WebCore                   0x90ef0bdb WebCore::Node::rootEditableElement() const + 43
14  com.apple.WebCore                   0x90df0cb0 WebCore::RenderBlock::isSelectionRoot() const + 240
15  com.apple.WebCore                   0x90df0d08 WebCore::RenderBlock::shouldPaintSelectionGaps() const + 56
16  com.apple.WebCore                   0x90dfb3fc WebCore::RenderBlock::selectionGapRects() + 28
17  com.apple.WebCore                   0x90e0b840 WebCore::RenderView::setSelection(WebCore::RenderObject*, int, WebCore::RenderObject*, int) + 6128
18  com.apple.WebCore                   0x90e0bce1 WebCore::RenderView::clearSelection() + 49
19  com.apple.WebCore                   0x90e0e140 WebCore::RenderContainer::removeChildNode(WebCore::RenderObject*, bool) + 416
20  com.apple.WebCore                   0x90e0cd9e WebCore::RenderContainer::removeChild(WebCore::RenderObject*) + 46
21  com.apple.WebCore                   0x90df65a3 WebCore::RenderBlock::removeChild(WebCore::RenderObject*) + 67
22  com.apple.WebCore                   0x90e2b591 WebCore::RenderObject::destroy() + 113
23  com.apple.WebCore                   0x90e0ce4c WebCore::RenderContainer::destroyLeftoverChildren() + 76
24  com.apple.WebCore                   0x90e14c2c WebCore::RenderFlow::destroy() + 44
25  com.apple.WebCore                   0x90e0ce4c WebCore::RenderContainer::destroyLeftoverChildren() + 76
26  com.apple.WebCore                   0x90e14c2c WebCore::RenderFlow::destroy() + 44
27  com.apple.WebCore                   0x90ef0f4f WebCore::Node::detach() + 47
28  com.apple.WebCore                   0x90d541c2 WebCore::HTMLInputElement::detach() + 18
29  com.apple.WebCore                   0x90d8ce9f WebCore::ContainerNode::removeChild(WebCore::Node*, int&) + 767
30  com.apple.WebCore                   0x90d8d7c3 WebCore::ContainerNode::replaceChild(WTF::PassRefPtr<WebCore::Node>, WebCore::Node*, int&) + 179
31  com.apple.WebCore                   0x91126d67 WebCore::JSNode::replaceChild(KJS::ExecState*, KJS::List const&) + 119
32  com.apple.WebCore                   0x90f28d3c WebCore::JSNodePrototypeFunction::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 1116
33  com.apple.JavaScriptCore            0x96009989 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 857
34  com.apple.JavaScriptCore            0x96005095 KJS::ExprStatementNode::execute(KJS::ExecState*) + 69
35  com.apple.JavaScriptCore            0x96002831 KJS::SourceElementsNode::execute(KJS::ExecState*) + 657
36  com.apple.JavaScriptCore            0x95ff0031 KJS::BlockNode::execute(KJS::ExecState*) + 49
37  com.apple.JavaScriptCore            0x96005047 KJS::IfNode::execute(KJS::ExecState*) + 407
38  com.apple.JavaScriptCore            0x96002753 KJS::SourceElementsNode::execute(KJS::ExecState*) + 435
39  com.apple.JavaScriptCore            0x95ff0031 KJS::BlockNode::execute(KJS::ExecState*) + 49
40  com.apple.JavaScriptCore            0x95ffac78 KJS::TryNode::execute(KJS::ExecState*) + 72
41  com.apple.JavaScriptCore            0x9600262b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139
42  com.apple.JavaScriptCore            0x95ff0031 KJS::BlockNode::execute(KJS::ExecState*) + 49
43  com.apple.JavaScriptCore            0x95ff008c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28
44  com.apple.JavaScriptCore            0x95ffa96f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 527
45  com.apple.JavaScriptCore            0x96009623 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 915
46  com.apple.JavaScriptCore            0x96002db5 KJS::ReturnNode::execute(KJS::ExecState*) + 133
47  com.apple.JavaScriptCore            0x9600262b KJS::SourceElementsNode::execute(KJS::ExecState*) + 139
48  com.apple.JavaScriptCore            0x95ff0031 KJS::BlockNode::execute(KJS::ExecState*) + 49
49  com.apple.JavaScriptCore            0x95ff008c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 28
50  com.apple.JavaScriptCore            0x95ffa96f KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 527
51  com.apple.JavaScriptCore            0x95ffe707 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 135
52  com.apple.WebCore                   0x90f09062 WebCore::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 1074
53  com.apple.WebCore                   0x90ed1576 WebCore::EventTargetNode::handleLocalEvents(WebCore::Event*, bool) + 182
54  com.apple.WebCore                   0x90ed1e22 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 1058
55  com.apple.WebCore                   0x90ed2150 WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool, WebCore::EventTarget*) + 160
56  com.apple.WebCore                   0x90ed221d WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 61
57  com.apple.WebCore                   0x90ed193f WebCore::EventTargetNode::dispatchHTMLEvent(WebCore::AtomicString const&, bool, bool) + 127
58  com.apple.WebCore                   0x90ed19b2 WebCore::EventTargetNode::dispatchBlurEvent() + 50
59  com.apple.WebCore                   0x90d8010b WebCore::Document::setFocusedNode(WTF::PassRefPtr<WebCore::Node>) + 459
60  com.apple.WebCore                   0x910f2571 WebCore::FocusController::advanceFocus(WebCore::FocusDirection, WebCore::KeyboardEvent*) + 769
61  com.apple.WebCore                   0x910f26d5 WebCore::FocusController::advanceFocus(WebCore::KeyboardEvent*) + 69
62  com.apple.WebCore                   0x910d8fcc WebCore::EventHandler::defaultTabEventHandler(WebCore::Event*, bool) + 172
63  com.apple.WebCore                   0x910da46e WebCore::EventHandler::defaultTextInputEventHandler(WebCore::TextEvent*) + 78
64  com.apple.WebCore                   0x90ed2428 WebCore::EventTargetNode::defaultEventHandler(WebCore::Event*) + 152
65  com.apple.WebCore                   0x90d567d2 WebCore::HTMLInputElement::defaultEventHandler(WebCore::Event*) + 546
66  com.apple.WebCore                   0x90ed1ce3 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 739
67  com.apple.WebCore                   0x90ed2150 WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool, WebCore::EventTarget*) + 160
68  com.apple.WebCore                   0x90ed221d WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 61
69  com.apple.WebCore                   0x910db8d2 WebCore::EventHandler::handleTextInputEvent(WebCore::String const&, WebCore::Event*, bool, bool) + 226
70  com.apple.WebCore                   0x9108033d WebCore::execInsertTab(WebCore::Frame*, WebCore::Event*) + 125
71  com.apple.WebCore                   0x91084937 WebCore::Editor::execCommand(WebCore::AtomicString const&, WebCore::Event*) + 215
72  com.apple.WebKit                    0x90a71488 -[WebHTMLView(WebNSTextInputSupport) doCommandBySelector:] + 840
73  com.apple.WebKit                    0x90a6ef5a -[WebHTMLView(WebInternal) _interceptEditingKeyEvent:shouldSaveCommand:] + 570
74  com.apple.WebKit                    0x90aa8a60 WebEditorClient::handleKeypress(WebCore::KeyboardEvent*) + 112
75  com.apple.WebCore                   0x9107f748 WebCore::Editor::handleKeypress(WebCore::KeyboardEvent*) + 184
76  com.apple.WebCore                   0x910db3dc WebCore::EventHandler::defaultKeyboardEventHandler(WebCore::KeyboardEvent*) + 108
77  com.apple.WebCore                   0x90ed2461 WebCore::EventTargetNode::defaultEventHandler(WebCore::Event*) + 209
78  com.apple.WebCore                   0x90d567d2 WebCore::HTMLInputElement::defaultEventHandler(WebCore::Event*) + 546
79  com.apple.WebCore                   0x90ed1ce3 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 739
80  com.apple.WebCore                   0x90ed2150 WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool, WebCore::EventTarget*) + 160
81  com.apple.WebCore                   0x90ed221d WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 61
82  com.apple.WebCore                   0x910db623 WebCore::EventHandler::defaultKeyboardEventHandler(WebCore::KeyboardEvent*) + 691
83  com.apple.WebCore                   0x90ed2461 WebCore::EventTargetNode::defaultEventHandler(WebCore::Event*) + 209
84  com.apple.WebCore                   0x90d567d2 WebCore::HTMLInputElement::defaultEventHandler(WebCore::Event*) + 546
85  com.apple.WebCore                   0x90ed1ce3 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 739
86  com.apple.WebCore                   0x90ed2150 WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool, WebCore::EventTarget*) + 160
87  com.apple.WebCore                   0x90ed221d WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 61
88  com.apple.WebCore                   0x90ed258a WebCore::EventTargetNode::dispatchKeyEvent(WebCore::PlatformKeyboardEvent const&) + 122
89  com.apple.WebCore                   0x910d90ea WebCore::EventHandler::keyEvent(WebCore::PlatformKeyboardEvent const&) + 58
90  com.apple.WebCore                   0x910d8460 WebCore::EventHandler::keyEvent(NSEvent*) + 304
91  com.apple.WebKit                    0x90a68719 -[WebHTMLView keyDown:] + 233
92  com.apple.AppKit                    0x901b02ae -[NSWindow sendEvent:] + 8252
93  com.apple.Safari                    0x000a9443 0x1000 + 689219
94  com.apple.AppKit                    0x901a04b0 -[NSApplication sendEvent:] + 2781
95  com.apple.Safari                    0x00017268 0x1000 + 90728
96  com.apple.AppKit                    0x900d149e -[NSApplication run] + 847
97  com.apple.AppKit                    0x900c46e5 NSApplicationMain + 663
98  com.apple.Safari                    0x0004bb56 0x1000 + 306006
99  ???                                 0x00000002 0 + 2

Thread 1:
0   libSystem.B.dylib                   0x94b77333 mach_msg_trap + 7
1   com.apple.CoreFoundation            0x966c032e CFRunLoopRunSpecific + 1774
2   com.apple.CoreFoundation            0x966c0f68 CFRunLoopRunInMode + 88
3   com.apple.Foundation                0x95eabc80 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] + 320
4   com.apple.Foundation                0x95ea2ded -[NSThread main] + 45
5   com.apple.Foundation                0x95ea2994 __NSThread__main__ + 308
6   libSystem.B.dylib                   0x94b6dc9d _pthread_start + 321
7   libSystem.B.dylib                   0x94b41a0e thread_start + 34

Thread 2:
0   libSystem.B.dylib                   0x94b77333 mach_msg_trap + 7
1   com.apple.CoreFoundation            0x966c032e CFRunLoopRunSpecific + 1774
2   com.apple.CoreFoundation            0x966c0f68 CFRunLoopRunInMode + 88
3   com.apple.CFNetwork                 0x951773e4 CFURLCacheWorkerThread(void*) + 320
4   libSystem.B.dylib                   0x94b6dc9d _pthread_start + 321
5   libSystem.B.dylib                   0x94b41a0e thread_start + 34

Thread 3:
0   libSystem.B.dylib                   0x94b120d4 select$DARWIN_EXTSN + 12
1   libSystem.B.dylib                   0x94b6dc9d _pthread_start + 321
2   libSystem.B.dylib                   0x94b41a0e thread_start + 34

Thread 4:
0   libSystem.B.dylib                   0x94b69d18 __semwait_signal + 12
1   libSystem.B.dylib                   0x94af50d4 pthread_cond_wait$UNIX2003 + 73
2   com.apple.ColorSync                 0x90ae8e14 pthreadSemaphoreWait(t_pthreadSemaphore*) + 42
3   com.apple.ColorSync                 0x90b1a9be CMMConvTask(void*) + 54
4   libSystem.B.dylib                   0x94b6dc9d _pthread_start + 321
5   libSystem.B.dylib                   0x94b41a0e thread_start + 34

Thread 5:
0   libSystem.B.dylib                   0x94b6e07c __workq_ops + 12
1   libSystem.B.dylib                   0x94b58792 start_wqthread + 30

Thread 6:

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0x00000000  ebx: 0x90e49634  ecx: 0x00000009  edx: 0x0051a0bc
  edi: 0x176a1460  esi: 0xbfffd678  ebp: 0xbfffd698  esp: 0xbfffd620
   ss: 0x0000001f  efl: 0x00010216  eip: 0x90e496c4   cs: 0x00000017
   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
  cr2: 0x00000004

Binary Images:
    0x1000 -   0x12afef  com.apple.Safari 3.0 (5522.11) /Applications/Safari.app/Contents/MacOS/Safari
  0x170000 -   0x17fff8  SyndicationUI ??? (???) <051420896ee0c07d4e7321143bfe7f92> /System/Library/PrivateFrameworks/SyndicationUI.framework/Versions/A/SyndicationU
I
  0x5b8000 -   0x678ff7  com.apple.RawCamera.bundle 2.0 (2.0) /System/Library/CoreServices/RawCamera.bundle/Contents/MacOS/RawCamera
0x15648000 - 0x1564dff3  libCGXCoreImage.A.dylib ??? (???) <a3d1c5240d3449e40fb50dc24ccabd40> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Fra
meworks/CoreGraphics.framework/Versions/A/Resources/libCGXCoreImage.A.dylib
0x16427000 - 0x1642cfff  com.apple.DictionaryServiceComponent 1.0.2 (1.0.2) /System/Library/Components/DictionaryService.component/Contents/MacOS/DictionaryService
0x16abd000 - 0x16abdffe  com.apple.JavaPluginCocoa 12.0.0 (12.0.0) <040894dc369a19a4f6ec3b021de8d3b6> /Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacO
S/JavaPluginCocoa
0x16ac3000 - 0x16acaffd  com.apple.JavaVM 12.0.0 (12.0.0) <29199b30aaea99503c26e1bf096aea7c> /System/Library/Frameworks/JavaVM.framework/Versions/A/JavaVM
0x8fe00000 - 0x8fe2d693  dyld 92.0 (???) <4eff1c8bc77e9dd83a623bb8fc4c767f> /usr/lib/dyld
0x90003000 - 0x9004fffb  com.apple.ISSupport 1.6 (23) /System/Library/PrivateFrameworks/ISSupport.framework/Versions/A/ISSupport
0x90050000 - 0x9005fffc  com.apple.LangAnalysis 1.6.4 (1.6.4) <35ea36931f31e8e8d86789c9ba79e801> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/
Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x90060000 - 0x9006cff5  libGL.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x900a1000 - 0x900a1fff  com.apple.installserver.framework 1.0 (8) /System/Library/PrivateFrameworks/InstallServer.framework/Versions/A/InstallServer
0x900a2000 - 0x900bfff7  com.apple.QuickLookFramework 1.0 (126.0) /System/Library/Frameworks/QuickLook.framework/Versions/A/QuickLook
0x900c0000 - 0x9089bfef  com.apple.AppKit 6.5 (920) <c609d75b9d7485afb4c3f2cf6200297d> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x9089c000 - 0x908a1fff  com.apple.backup.framework 1.0 (1.0) /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup
0x908a2000 - 0x908fbfff  libGLU.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x908fc000 - 0x908fefff  com.apple.securityhi 3.0 (30817) <2afef5a32713cc4de4126e93a3010b2f> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Securi
tyHI.framework/Versions/A/SecurityHI
0x90904000 - 0x90926fff  com.apple.CoreMediaPrivate 1.0 (1.0) <0981b774957b6d39ec736fbb0860500d> /System/Library/PrivateFrameworks/CoreMediaPrivate.framework/Version
s/A/CoreMediaPrivate
0x90927000 - 0x90927ffd  com.apple.vecLib 3.4 (vecLib 3.4) /System/Library/Frameworks/vecLib.framework/Versions/A/vecLib
0x90944000 - 0x909c2ff5  com.apple.SearchKit 1.2.0 (1.2.0) <a24f13588295582e11fe3cdd06c36bb6> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks
/SearchKit.framework/Versions/A/SearchKit
0x909c3000 - 0x909c9fff  com.apple.print.framework.Print 218 (218) <39652ea85308cd98b4101fd48f9f37e9> /System/Library/Frameworks/Carbon.framework/Versions/A/Framewor
ks/Print.framework/Versions/A/Print
0x909ca000 - 0x909ccfff  com.apple.help 1.1 (34) <4e34e2cdf99cfda36cade938b7b8dee3> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/
Versions/A/Help
0x909cd000 - 0x909f1fff  libxslt.1.dylib ??? (???) <f240a2b5c611bcbee9c628883dbb64d1> /usr/lib/libxslt.1.dylib
0x909fc000 - 0x90a0bfff  libsasl2.2.dylib ??? (???) <51b3ff15e55d3572c71b6053d7e12a3b> /usr/lib/libsasl2.2.dylib
0x90a0c000 - 0x90a29fea  libJPEG.dylib ??? (???) <79ff4880e5ad4568f60208ef07733f44> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/Im
ageIO.framework/Versions/A/Resources/libJPEG.dylib
0x90a2a000 - 0x90a32fff  com.apple.DiskArbitration 2.2 (2.2) <7ae4ffa2d63dabdb415bddc4c70b22fe> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskA
rbitration
0x90a33000 - 0x90ae4fe3  com.apple.WebKit 5522.11 (5522.11) <db39aefad726f4e32c8ab0439063d3ac> /System/Library/Frameworks/WebKit.framework/Versions/A/WebKit
0x90ae5000 - 0x90bb8fef  com.apple.ColorSync 4.5.0 (4.5.0) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Version
s/A/ColorSync
0x90bb9000 - 0x90bdefff  libauto.dylib ??? (???) <dd43007da38f10af533ed71a4433c58b> /usr/lib/libauto.dylib
0x90bdf000 - 0x90ca6ff2  com.apple.vImage 3.0 (3.0) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x90ca7000 - 0x911a3fff  com.apple.WebCore 5522.11.2 (5522.11.2) /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebCore.framework/Versions/A/WebCo
re
0x911a4000 - 0x911d3fe3  com.apple.AE 399 (399) <5636e3a10b3b9d0f07227c4dc568a0d5> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framewo
rk/Versions/A/AE
0x911d4000 - 0x9120afef  libtidy.A.dylib ??? (???) <254dc3449bf164ea9d2a55db5bd85c82> /usr/lib/libtidy.A.dylib
0x9120b000 - 0x91317fef  com.apple.PubSub 1.0.0 (47) /System/Library/Frameworks/PubSub.framework/Versions/A/PubSub
0x91318000 - 0x91318ffa  com.apple.quartzframework 1.5 (1.5) <5424365772b1b3cc506a435440bb1edb> /System/Library/Frameworks/Quartz.framework/Versions/A/Quartz
0x91319000 - 0x91320fff  libCGATS.A.dylib ??? (???) <e2c39cafa73c47c840bbc7d76cea291c> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks
/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x91321000 - 0x91329ff9  com.apple.helpdata 1.0 (7) /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/HelpData
0x9132a000 - 0x91398fff  com.apple.PDFKit 2.0 (2.0) /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/PDFKit.framework/Versions/A/PDFKit
0x91399000 - 0x91413ff8  com.apple.print.framework.PrintCore 5.5 (237) <1dc1b948d41812875583f217d43331f4> /System/Library/Frameworks/ApplicationServices.framework/Ve
rsions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x91414000 - 0x9146dfe7  com.apple.CoreText 2.0.0 (???) <0aeba7bf56d974c6a8181f71a3cdbafd> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Framew
orks/CoreText.framework/Versions/A/CoreText
0x9146e000 - 0x91478feb  com.apple.audio.SoundManager 3.9.2 (3.9.2) <7912eb6f16eb98a7d79990e6f6d3239c> /System/Library/Frameworks/Carbon.framework/Versions/A/Framewo
rks/CarbonSound.framework/Versions/A/CarbonSound
0x914a9000 - 0x9155bffb  libcrypto.0.9.7.dylib ??? (???) <23a3110a9d6cbd0e82d5af9e92fd4067> /usr/lib/libcrypto.0.9.7.dylib
0x9155c000 - 0x91694ff7  libicucore.A.dylib ??? (???) <af4f4658f8b485e361710687a17bbb01> /usr/lib/libicucore.A.dylib
0x91695000 - 0x916bdfe7  com.apple.shortcut 1 (1.0) <d0f7b38bd9bd181f0a83ad112aa7d905> /System/Library/PrivateFrameworks/Shortcut.framework/Versions/A/Shortcut
0x916be000 - 0x91d50fe3  com.apple.CoreGraphics 1.323.0 (???) <1237e021e62012eff325f7c1177f0ffc> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/
Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x91d51000 - 0x91d5fffd  libz.1.dylib ??? (???) <137d8c1b7787613d9b7c0f50e8604f7a> /usr/lib/libz.1.dylib
0x91d60000 - 0x92170fef  libBLAS.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x92171000 - 0x921a2fff  com.apple.LDAPFramework 1.4.3 (94.1) <0d93eb40f6258d7a7c1b1fdee5904404> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x921a3000 - 0x921aafff  com.apple.agl 3.0.9 (AGL-3.0.9) <3119b440fcb9f0882f7659f4944d1070> /System/Library/Frameworks/AGL.framework/Versions/A/AGL
0x921ab000 - 0x92669fde  libGLProgrammability.dylib ??? (???) <84b01e1105d9725bf4a0db16d9d5664e> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/lib
GLProgrammability.dylib
0x9266a000 - 0x9267ffff  com.apple.DictionaryServices 1.0.0 (1.0.0) /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framew
ork/Versions/A/DictionaryServices
0x933d3000 - 0x933dffe7  com.apple.opengl 1.5.2 (1.5.2) <907b5f1ec397c08dcba0b4887effc5ae> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x933e0000 - 0x9342cfff  com.apple.QuickLookUIFramework 1.0 (126.0) /System/Library/PrivateFrameworks/QuickLookUI.framework/Versions/A/QuickLookUI
0x9342d000 - 0x9344bff3  com.apple.DirectoryService.Framework 3.5 (3.5) <ce4b7f5e3548b3967b0d14120a891607> /System/Library/Frameworks/DirectoryService.framework/Vers
ions/A/DirectoryService
0x9344c000 - 0x934ddfef  com.apple.ApplicationServices.ATS 3.0 (???) <32e4ba5d77409afe57046f9d40e82c08> /System/Library/Frameworks/ApplicationServices.framework/Vers
ions/A/Frameworks/ATS.framework/Versions/A/ATS
0x934de000 - 0x934deffe  com.apple.CoreServices 31 (31) /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x934f1000 - 0x934f1ffc  com.apple.audio.units.AudioUnit 1.5 (1.5) /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x934f2000 - 0x9350afff  com.apple.openscripting 1.2.6 (???) <4323b7bc580af3e36f62c784706c3344> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ope
nScripting.framework/Versions/A/OpenScripting
0x9350b000 - 0x93512ffe  libbsm.dylib ??? (???) <4d1f862c7ab0ef5090733238ca0d6371> /usr/lib/libbsm.dylib
0x93513000 - 0x93518fff  com.apple.CommonPanels 1.2.4 (85) <f2f78333255a37042513bd30d8b42a47> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Commo
nPanels.framework/Versions/A/CommonPanels
0x93569000 - 0x935f2ff7  com.apple.QTKit 7.2.1 (7.2.1) /System/Library/Frameworks/QTKit.framework/Versions/A/QTKit
0x935f3000 - 0x93715ff3  com.apple.audio.toolbox.AudioToolbox 1.5 (1.5) /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x93716000 - 0x9379dfff  libobjc.A.dylib ??? (???) <c893633c26eef2772fc4df0c7db870dd> /usr/lib/libobjc.A.dylib
0x9379e000 - 0x9379ffef  libmathCommon.A.dylib ??? (???) /usr/lib/system/libmathCommon.A.dylib
0x937a0000 - 0x93833fe7  com.apple.ink.framework 101.3 (85) <9037a1c769cca4b15f1be4d00791839f> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.
framework/Versions/A/Ink
0x93834000 - 0x939ebfe3  com.apple.QuartzComposer 2.0 (81) <bd2dbceb6cb4f8d162d9546f525e8d75> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/Quart
zComposer.framework/Versions/A/QuartzComposer
0x939ec000 - 0x93a25ffe  com.apple.securityfoundation 3.0 (31982) <28621b0041c34fd143047b08e744ad2a> /System/Library/Frameworks/SecurityFoundation.framework/Versions
/A/SecurityFoundation
0x93a38000 - 0x93ae8fff  edu.mit.Kerberos 6.0.11 (6.0.11) <adb6ffd389745c33be65348c9951e01e> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x93ae9000 - 0x93b2bfef  com.apple.NavigationServices 3.5 (150) <58724d0f04c5f1f64eb3b04c4b1333e7> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/
NavigationServices.framework/Versions/A/NavigationServices
0x93b2c000 - 0x93b3cfff  com.apple.speech.synthesis.framework 3.6.45 (3.6.45) <c24ec5f6cc3f166ab58bdcc0bbe9ca46> /System/Library/Frameworks/ApplicationServices.frame
work/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x93b3d000 - 0x93b71fff  com.apple.coreui 0.1 (46) /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI
0x93b8b000 - 0x93bcefef  com.apple.Metadata 10.5.0 (357) <596f979df81ed1149d37bb6197aaefaf> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/M
etadata.framework/Versions/A/Metadata
0x93c21000 - 0x93cc7fef  com.apple.QD 3.11.42 (???) <5908b284fa456a30ee4c864823335e21> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks
/QD.framework/Versions/A/QD
0x94026000 - 0x943b8fef  com.apple.QuartzCore 1.5.0 (1.5.0) <fad47a892e1e7d0a908e02588d5e351f> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x943b9000 - 0x944fdff7  com.apple.ImageIO.framework 2.0.0 (2.0.0) <8494b054662b11c1494221fd3ca25c6e> /System/Library/Frameworks/ApplicationServices.framework/Versio
ns/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x94563000 - 0x94563ffe  com.apple.MonitorPanelFramework 1.2.0 (1.2.0) <2e381fcc9e6969166c4b1e0cf92f1181> /System/Library/PrivateFrameworks/MonitorPanel.framework/Ve
rsions/A/MonitorPanel
0x94564000 - 0x945d8fef  libvMisc.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x945d9000 - 0x945daffc  libffi.dylib ??? (???) <7efc58d57fd424e57e0362406d065256> /usr/lib/libffi.dylib
0x945de000 - 0x94613fff  com.apple.SystemConfiguration 1.9.0 (1.9.0) <ce5345acb76012bfcf51962548bb36b3> /System/Library/Frameworks/SystemConfiguration.framework/Vers
ions/A/SystemConfiguration
0x94614000 - 0x94618fff  libGIF.dylib ??? (???) <500e6f57bb53331a26ee180316b2eb15> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/Ima
geIO.framework/Versions/A/Resources/libGIF.dylib
0x94619000 - 0x94655ff7  com.apple.CoreMediaIOServicesPrivate 1.0 (1.0) /System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/CoreMediaIO
ServicesPrivate
0x94656000 - 0x9466aff3  com.apple.ImageCapture 4.0 (5.0.0) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/Image
Capture
0x9466b000 - 0x9466bffb  com.apple.Carbon 135 (135) /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x9466c000 - 0x946effe7  com.apple.framework.IOKit 1.5.0 (???) <30247b64804f6691b5bcbd0837837aa0> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x946f0000 - 0x9472cff7  libGLImage.dylib ??? (???) <2042f497e54f2d3e44842ee458db42a7> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dy
lib
0x9472d000 - 0x949fffeb  com.apple.CoreServices.CarbonCore 763.1 (763.1) <1f05a325269bfad8dfd041b936f51444> /System/Library/Frameworks/CoreServices.framework/Version
s/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x94a00000 - 0x94ae0ffb  com.apple.CoreData 100 (171) <255324969c103a8c833e1feea4ba5029> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x94ae1000 - 0x94c36fe3  libSystem.B.dylib ??? (???) <8e92efd851302bb02d97db74067d88aa> /usr/lib/libSystem.B.dylib
0x94c37000 - 0x94c37ffc  com.apple.ApplicationServices 33 (33) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x94cfe000 - 0x94da8fff  com.apple.DesktopServices 1.4.2 (1.4.2) <1eee92b7e85b9b200c9bc96ad43c15ef> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/V
ersions/A/DesktopServicesPriv
0x94da9000 - 0x94f1fff7  com.apple.AddressBook.framework 4.1 (671) /System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook
0x94f20000 - 0x95049ff7  com.apple.imageKit 1.0 (1.0) <66d653edefe587e1e7761efdb24771ca> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/ImageKit.f
ramework/Versions/A/ImageKit
0x9504a000 - 0x95099ff7  com.apple.HIServices 1.6.0 (???) <2f8c8c8814d63f3b87fd0d7d824c6bfd> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Fram
eworks/HIServices.framework/Versions/A/HIServices
0x9509a000 - 0x95122fff  com.apple.LaunchServices 267 (267) <45863ebb1a82c9616521226032ee6da5> /System/Library/Frameworks/CoreServices.framework/Versions/A/Framework
s/LaunchServices.framework/Versions/A/LaunchServices
0x95123000 - 0x95196ff3  com.apple.CFNetwork 197 (197) <afeb1bad524ebd496280692a5fb55c39> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFN
etwork.framework/Versions/A/CFNetwork
0x951a4000 - 0x951a6ff5  libRadiance.dylib ??? (???) <628a78c746b136eb840340998f3b2a0e> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Framework
s/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x951a7000 - 0x951cbfeb  libssl.0.9.7.dylib ??? (???) <74addee5837b076e78023d03284329f6> /usr/lib/libssl.0.9.7.dylib
0x951cc000 - 0x95229ffb  libstdc++.6.dylib ??? (???) <264c737c7eb0413bda0b0b3671bfec55> /usr/lib/libstdc++.6.dylib
0x9522a000 - 0x95233fff  com.apple.speech.recognition.framework 3.7.19 (3.7.19) <85f3281279d40a7d106125f09fdcd492> /System/Library/Frameworks/Carbon.framework/Versio
ns/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x95234000 - 0x9527dfe1  com.apple.securityinterface 3.0 (32358) <33fd50b2bfb73ff043ee3b01d4220c0f> /System/Library/Frameworks/SecurityInterface.framework/Versions/A
/SecurityInterface
0x95283000 - 0x95283ff8  com.apple.Cocoa 6.5 (???) <ece805c5914cb01e9383ac846da3031c> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x95284000 - 0x9529fffb  libPng.dylib ??? (???) <52072bbcf4cba909e609af6dfbc14e6d> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/Ima
geIO.framework/Versions/A/Resources/libPng.dylib
0x952a0000 - 0x952a0ffd  com.apple.Accelerate 1.4 (Accelerate 1.4) /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x952a1000 - 0x952c7fff  libcups.2.dylib ??? (???) <2ff4250a75c8f92df4779225d5f9c38d> /usr/lib/libcups.2.dylib
0x952c8000 - 0x953a9ff7  libxml2.2.dylib ??? (???) <939fb401ead4c578060ef20208fd7bb4> /usr/lib/libxml2.2.dylib
0x953aa000 - 0x953d7feb  libvDSP.dylib ??? (???) <f0133b3d0c92ec7969691d37b2cdf820> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.fram
ework/Versions/A/libvDSP.dylib
0x953d8000 - 0x95419fe7  libRIP.A.dylib ??? (???) <d0cc01dc7039d070608621cf9d95ba54> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/C
oreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x9541a000 - 0x9541fffb  com.apple.DisplayServicesFW 2.0 (2.0) <c7637d79234cf68555275fda709843fa> /System/Library/PrivateFrameworks/DisplayServices.framework/Version
s/A/DisplayServices
0x95420000 - 0x954c8fe3  com.apple.CoreServices.OSServices 185 (185) <d816cefa638ea140d1c595ef1e03f88b> /System/Library/Frameworks/CoreServices.framework/Versions/A/
Frameworks/OSServices.framework/Versions/A/OSServices
0x954c9000 - 0x954faffb  com.apple.quartzfilters 1.5.0 (1.5.0) <2e2c216424d1dee5c0c7567a759d367c> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/Q
uartzFilters.framework/Versions/A/QuartzFilters
0x954fb000 - 0x9550affe  com.apple.DSObjCWrappers.Framework 1.2 (1.2) <b9bd72dd5d63a86b92a6d0915bad2cf1> /System/Library/PrivateFrameworks/DSObjCWrappers.framework/V
ersions/A/DSObjCWrappers
0x9550b000 - 0x95516fe7  libCSync.A.dylib ??? (???) <b739528811bf3e83b80a7eb2044bc7b2> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks
/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x955b6000 - 0x95612ff7  com.apple.htmlrendering 68 (1.1.3) <6818a3b5ff144c17cbcc242739a77b57> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTML
Rendering.framework/Versions/A/HTMLRendering
0x95613000 - 0x9590cffb  com.apple.HIToolbox 1.5.0 (???) <aeca59dffc3079affc0b40c982eaaa1e> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolb
ox.framework/Versions/A/HIToolbox
0x9590d000 - 0x95923fef  com.apple.CoreVideo 1.5.0 (1.5.0) <8c3a2a9942fe388ede5df5e09f0de85e> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
0x95924000 - 0x95ce2fea  libLAPACK.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x95d27000 - 0x95fa0fe7  com.apple.Foundation 6.5 (654) <ead33a34016cd9db7cc93f239a3279b9> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x95fa1000 - 0x9604aff7  com.apple.JavaScriptCore 5522.11.1 (5522.11.1) /System/Library/Frameworks/JavaScriptCore.framework/Versions/A/JavaScriptCore
0x9604b000 - 0x96359fe2  com.apple.QuickTime 7.2.1 (7.2.1) <8f4544b7c632e6f0eda136937525dc94> /System/Library/Frameworks/QuickTime.framework/Versions/A/QuickTime
0x9635a000 - 0x96521fef  com.apple.security 5.0 (31122) <05bc71a2428a85da6f4fbcbc999782e7> /System/Library/Frameworks/Security.framework/Versions/A/Security
0x96522000 - 0x9659efef  com.apple.audio.CoreAudio 3.1.0 (3.1) <073f88dfcf0075951f186b748a36c865> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x9659f000 - 0x965a6fe9  libgcc_s.1.dylib ??? (???) <c884b86212d86db06b7dc6826b56973c> /usr/lib/libgcc_s.1.dylib
0x965a7000 - 0x965c5fff  libresolv.9.dylib ??? (???) <3ad8e554037509b518936011df58485f> /usr/lib/libresolv.9.dylib
0x965c6000 - 0x9664cff7  libsqlite3.0.dylib ??? (???) <5f5c59c41e9b56f5fc4af30772b1d297> /usr/lib/libsqlite3.0.dylib
0x9664d000 - 0x9664dffd  com.apple.Accelerate.vecLib 3.4 (vecLib 3.4) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions
/A/vecLib
0x9664e000 - 0x9677bff7  com.apple.CoreFoundation 6.5 (455) <5d0c5859a7894a337ec2e00f936f7452> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFou
ndation
0x9677c000 - 0x967b9fef  libTIFF.dylib ??? (???) <366a4112591ec364d097ded1638bc690> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/Im
ageIO.framework/Versions/A/Resources/libTIFF.dylib
0xfffe8000 - 0xfffebfff  libobjc.A.dylib ??? (???) /usr/lib/libobjc.A.dylib
0xffff0000 - 0xffff1780  libSystem.B.dylib ??? (???) /usr/lib/libSystem.B.dylib

[Mark Rowe (bdash)]

Daniel, can you please provide specific instructions on how we can reproduce this crash ourselves?  A test case that easily reproduces the crash would be great.

[David Kilzer (:ddkilzer)]

I created a test account:

U: webkit
P: w3bk1t
Email: [e-mail]

[David Kilzer (:ddkilzer)]

(In reply to comment #1)
> Daniel, can you please provide specific instructions on how we can reproduce
> this crash ourselves?  A test case that easily reproduces the crash would be
> great.

I can't figure out how to make gomentat.com crash by selecting text in a textarea, then doing something else with the interface.  A set of reproducible steps (using the web site) would be great.

[David Kilzer (:ddkilzer)]

I also noticed this is on the Leopard 9A499 seed:

> OS Version:      Mac OS X 10.5 (9A499)

Is this only reproducible on that seed, or are you able to reproduce it with Safari 3 Public Beta for Tiger (with or without a WebKit Nightly build from http://nightly.webkit.org/)?

[Daniel Pasco]

Hi.  We actually came up with a Safari 3.0 workaround, but I hadn't had a chance to update the bug report with the information yet.

First, you can see the old behavior on our test server at http://brainmurmurs.com:3000/home/list.  You'll need to sign up on the test machine to try it, but it is pretty straightforward.  Once the account is created,  click on "my agenda" at the upper lefthand corner of the screen.  

Then click the 'create new task' button, entry a task summary, and hit the return key.  The task summary you entered should appear in the agenda window.

Click on the summary and it will change to a text control with the text selected.  Hit tab to dismiss the edit control and safari will crash.

--
This is the simplest way I can think of to demonstrate the problem.  I'm a little buried right now but will try to throw together some sample code to reproduce it.  It may not happen until the weekend at the going rate.
--

Workaround (evidently Safari 3 only):

call window.getSelection().removeAllRanges() before removing the textarea from the DOM tree.

[David Kilzer (:ddkilzer)]

(In reply to comment #5)
> First, you can see the old behavior on our test server at
> http://brainmurmurs.com:3000/home/list.  You'll need to sign up on the test
> machine to try it, but it is pretty straightforward.  Once the account is
> created,  click on "my agenda" at the upper lefthand corner of the screen.  

Created a test account with the same credentials.  See Comment #2.

[David Kilzer (:ddkilzer)]

(In reply to comment #5)
> Click on the summary and it will change to a text control with the text
> selected.  Hit tab to dismiss the edit control and safari will crash.

I can't get it to crash using a local debug build of WebKit r26376 with Safari 3 Public Beta v. 3.0.3 (522.12.1) on Mac OS X 10.4.10 (8R218).

Does this only crash on the Leopard seed you were using?

[Daniel Pasco]

No, we've had complaints about it from people running Safari 2.x on Tiger as well.  I'll update to the latest Safari release and see what happens. 

[Ojan Vafai]

The test server is no longer up. There's no way to reproduce this and this bug is years old. If the crash still occurs and/or you have a way to reproduce it, please reopen.