Bug 9743 – REGRESSION: crash dispatching JavaScript-created keyboard event to input element

• Status: RESOLVED
• Resolution: FIXED
• Component: Forms

[Geoffrey Garen]

Host Name:      geoffrey-garens-computer
Date/Time:      2006-07-05 13:38:52.943 -0700
OS Version:     10.4.7 (Build 8J2135a)
Report Version: 4

Command: Safari
Path:    /Volumes/Big/ggaren/symroots-TOT/Debug/Safari.app/Contents/MacOS/Safari
Parent:  WindowServer [405]

Version: 3.0 (521.14)

PID:    3329
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000004

Thread 0 Crashed:
0   com.apple.WebCore        	0x0207e08d WTF::RefPtr<WebCore::StringImpl>::RefPtr[in-charge](WTF::RefPtr<WebCore::StringImpl> const&) + 9 (HTMLElement.cpp:37)
1   com.apple.WebCore        	0x0207e8c2 WebCore::String::String[in-charge](WebCore::String const&) + 24 (PlatformString.h:41)
2   com.apple.WebCore        	0x020b386e WebCore::PlatformKeyboardEvent::unmodifiedText() const + 30 (PlatformKeyboardEvent.h:53)
3   com.apple.WebCore        	0x01dec2bf WebCore::selectorForKeyEvent(WebCore::PlatformKeyboardEvent const*) + 33 (FrameMac.mm:120)
4   com.apple.WebCore        	0x01dec494 WebCore::FrameMac::doTextFieldCommandFromEvent(WebCore::Element*, WebCore::PlatformKeyboardEvent const*) + 224 (FrameMac.mm:3237)
5   com.apple.WebCore        	0x01dc797a WebCore::HTMLInputElement::defaultEventHandler(WebCore::Event*) + 736 (HTMLInputElement.cpp:1245)
6   com.apple.WebCore        	0x01f43916 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 1608 (EventTargetNode.cpp:254)
7   com.apple.WebCore        	0x01f44114 WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 290 (EventTargetNode.cpp:290)
8   com.apple.WebCore        	0x01f70ce9 KJS::DOMEventTargetNodeProtoFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 745 (kjs_dom.cpp:694)
9   com.apple.JavaScriptCore 	0x0156bf94 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 210 (object.cpp:96)
10  com.apple.JavaScriptCore 	0x0156317d KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 777 (nodes.cpp:759)
11  com.apple.JavaScriptCore 	0x015609fc KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1662)
12  com.apple.JavaScriptCore 	0x0155db78 KJS::SourceElementsNode::execute(KJS::ExecState*) + 516 (nodes.cpp:2448)
13  com.apple.JavaScriptCore 	0x0155c3ac KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1638)
14  com.apple.JavaScriptCore 	0x0154ea90 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 50 (function.cpp:336)
15  com.apple.JavaScriptCore 	0x0154e406 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 552 (function.cpp:101)
16  com.apple.JavaScriptCore 	0x0156bf94 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 210 (object.cpp:96)
17  com.apple.JavaScriptCore 	0x01563858 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 650 (nodes.cpp:666)
18  com.apple.JavaScriptCore 	0x015609fc KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1662)
19  com.apple.JavaScriptCore 	0x0155da5b KJS::SourceElementsNode::execute(KJS::ExecState*) + 231 (nodes.cpp:2442)
20  com.apple.JavaScriptCore 	0x0155c3ac KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1638)
21  com.apple.JavaScriptCore 	0x0154ea90 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 50 (function.cpp:336)
22  com.apple.JavaScriptCore 	0x0154e406 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 552 (function.cpp:101)
23  com.apple.JavaScriptCore 	0x0156bf94 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 210 (object.cpp:96)
24  com.apple.WebCore        	0x01f7449f KJS::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 657 (kjs_events.cpp:114)
25  com.apple.WebCore        	0x01e00301 WebCore::Document::handleWindowEvent(WebCore::Event*, bool) + 223 (Document.cpp:2224)
26  com.apple.WebCore        	0x01f43ef4 WebCore::EventTargetNode::dispatchWindowEvent(WebCore::AtomicString const&, bool, bool) + 296 (EventTargetNode.cpp:321)
27  com.apple.WebCore        	0x01e02754 WebCore::Document::implicitClose() + 504 (Document.cpp:1195)
28  com.apple.WebCore        	0x01dda28a WebCore::Frame::checkEmitLoadEvent() + 450 (Frame.cpp:830)
29  com.apple.WebCore        	0x01dde5bf WebCore::Frame::checkCompleted() + 337 (Frame.cpp:795)
30  com.apple.WebCore        	0x01dde893 WebCore::Frame::finishedParsing() + 35 (Frame.cpp:750)
31  com.apple.WebCore        	0x01dfe1de WebCore::Document::finishedParsing() + 56 (Document.cpp:3275)
32  com.apple.WebCore        	0x01d33add WebCore::HTMLParser::finished() + 207 (HTMLParser.cpp:1345)
33  com.apple.WebCore        	0x01d3861f WebCore::HTMLTokenizer::end() + 283 (HTMLTokenizer.cpp:1531)
34  com.apple.WebCore        	0x01d389cf WebCore::HTMLTokenizer::finish() + 919 (HTMLTokenizer.cpp:1572)
35  com.apple.WebCore        	0x01dfcb94 WebCore::Document::finishParsing() + 40 (Document.cpp:1329)
36  com.apple.WebCore        	0x01ddea74 WebCore::Frame::endIfNotLoading() + 262 (Frame.cpp:706)
37  com.apple.WebCore        	0x01ddeaa2 WebCore::Frame::end() + 30 (Frame.cpp:689)
38  com.apple.WebCore        	0x01e0fe5c -[WebCoreFrameBridge end] + 30 (WebCoreFrameBridge.mm:708)
39  com.apple.WebKit         	0x01234fbb -[WebDataSource(WebPrivate) _finishedLoading] + 152 (WebDataSource.m:771)
40  com.apple.WebKit         	0x01261695 -[WebMainResourceLoader didFinishLoading] + 444 (WebMainResourceLoader.m:380)
41  com.apple.WebKit         	0x01231a96 -[WebLoader connectionDidFinishLoading:] + 129 (WebLoader.m:575)
42  com.apple.Foundation     	0x9278fa6c -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback] + 176
43  com.apple.Foundation     	0x9278db15 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 748
44  com.apple.Foundation     	0x9278d7b3 _sendCallbacks + 201
45  com.apple.CoreFoundation 	0x90823379 CFRunLoopRunSpecific + 1213
46  com.apple.CoreFoundation 	0x90822eb5 CFRunLoopRunInMode + 61
47  com.apple.HIToolbox      	0x92f02b90 RunCurrentEventLoopInMode + 285
48  com.apple.HIToolbox      	0x92f02297 ReceiveNextEventCommon + 385
49  com.apple.HIToolbox      	0x92f020ee BlockUntilNextEventMatchingListInMode + 81
50  com.apple.AppKit         	0x933a3771 _DPSNextEvent + 576
51  com.apple.AppKit         	0x933a335e -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 137
52  com.apple.Safari         	0x00024a75 -[BrowserApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 202 (BrowserApplication.m:166)
53  com.apple.AppKit         	0x9339d0e3 -[NSApplication run] + 512
54  com.apple.AppKit         	0x93391037 NSApplicationMain + 573
55  com.apple.Safari         	0x000ba399 main + 333 (main.m:37)
56  com.apple.Safari         	0x00002c3a _start + 228 (crt.c:272)
57  com.apple.Safari         	0x00002b55 start + 41

Thread 1:
0   libSystem.B.dylib        	0x9000a5c7 mach_msg_trap + 7
1   com.apple.CoreFoundation 	0x9082369a CFRunLoopRunSpecific + 2014
2   com.apple.CoreFoundation 	0x90822eb5 CFRunLoopRunInMode + 61
3   com.apple.Foundation     	0x9275eb4a -[NSRunLoop runMode:beforeDate:] + 182
4   com.apple.Foundation     	0x9275ea46 -[NSRunLoop run] + 75
5   com.apple.WebKit         	0x012821ed +[WebFileDatabase _syncLoop:] + 314 (WebFileDatabase.m:294)
6   com.apple.Foundation     	0x927291b0 forkThreadForFunction + 123
7   libSystem.B.dylib        	0x90024b07 _pthread_body + 84

Thread 2:
0   libSystem.B.dylib        	0x9000a5c7 mach_msg_trap + 7
1   com.apple.CoreFoundation 	0x9082369a CFRunLoopRunSpecific + 2014
2   com.apple.CoreFoundation 	0x90822eb5 CFRunLoopRunInMode + 61
3   com.apple.Foundation     	0x9275e861 +[NSURLConnection(NSURLConnectionInternal) _resourceLoadLoop:] + 259
4   com.apple.Foundation     	0x927291b0 forkThreadForFunction + 123
5   libSystem.B.dylib        	0x90024b07 _pthread_body + 84

Thread 3:
0   libSystem.B.dylib        	0x9000a5c7 mach_msg_trap + 7
1   com.apple.CoreFoundation 	0x9082369a CFRunLoopRunSpecific + 2014
2   com.apple.CoreFoundation 	0x90822eb5 CFRunLoopRunInMode + 61
3   com.apple.Foundation     	0x9278595a +[NSURLCache _diskCacheSyncLoop:] + 206
4   com.apple.Foundation     	0x927291b0 forkThreadForFunction + 123
5   libSystem.B.dylib        	0x90024b07 _pthread_body + 84

Thread 4:
0   libSystem.B.dylib        	0x900251a7 semaphore_wait_signal_trap + 7
1   com.apple.Foundation     	0x9277f008 -[NSConditionLock lockWhenCondition:] + 39
2   com.apple.Syndication    	0x9a61f052 -[AsyncDB _run:] + 181
3   com.apple.Foundation     	0x927291b0 forkThreadForFunction + 123
4   libSystem.B.dylib        	0x90024b07 _pthread_body + 84

Thread 5:
0   libSystem.B.dylib        	0x9001aafc select + 12
1   libSystem.B.dylib        	0x90024b07 _pthread_body + 84

Thread 0 crashed with i386 Thread State:
eax: 0x00000004    ebx: 0x01dec2aa ecx:0xbfffd8d4 edx: 0xbfffd898
edi: 0x01dec3b4    esi: 0xbfffd898 ebp:0xbfffd828 esp: 0xbfffd800
 ss: 0x0000002f    efl: 0x00010286 eip:0x0207e08d  cs: 0x00000027
 ds: 0x0000002f     es: 0x0000002f  fs:0x00000000  gs: 0x00000037

Binary Images Description:
    0x1000 -   0x18afff com.apple.Safari 3.0 (521.14)	/Volumes/Big/ggaren/symroots-TOT/Debug/Safari.app/Contents/MacOS/Safari
 0x1205000 -  0x12d0fff com.apple.WebKit 420+	/Users/ggaren/symroots/Debug/WebKit.framework/Versions/A/WebKit
 0x1541000 -  0x15e0fff com.apple.JavaScriptCore 420+	/Users/ggaren/symroots/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore
 0x1d09000 -  0x215bfff com.apple.WebCore 420+	/Users/ggaren/symroots/Debug/WebCore.framework/Versions/A/WebCore
0x8fe00000 - 0x8fe4bfff dyld 45.1	/usr/lib/dyld
0x90000000 - 0x9016efff libSystem.B.dylib 	/usr/lib/libSystem.B.dylib
0x901be000 - 0x901c0fff libmathCommon.A.dylib 	/usr/lib/system/libmathCommon.A.dylib
0x901c2000 - 0x901fefff com.apple.CoreText 1.1.1 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
0x90225000 - 0x902fafff ATS 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x9031a000 - 0x9076afff com.apple.CoreGraphics 1.258.33 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x90801000 - 0x908c9fff com.apple.CoreFoundation 6.4.6 (368.27)	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x90907000 - 0x90907fff com.apple.CoreServices 10.4 (???)	/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x90909000 - 0x909fcfff libicucore.A.dylib 	/usr/lib/libicucore.A.dylib
0x90a4c000 - 0x90acbfff libobjc.A.dylib 	/usr/lib/libobjc.A.dylib
0x90af4000 - 0x90b57fff libstdc++.6.dylib 	/usr/lib/libstdc++.6.dylib
0x90bc6000 - 0x90bcdfff libgcc_s.1.dylib 	/usr/lib/libgcc_s.1.dylib
0x90bd2000 - 0x90c42fff com.apple.framework.IOKit 1.4.4 (???)	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x90c57000 - 0x90c69fff libauto.dylib 	/usr/lib/libauto.dylib
0x90c6f000 - 0x90f14fff com.apple.CoreServices.CarbonCore 682.12	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x90f57000 - 0x90fbffff com.apple.CoreServices.OSServices 4.1	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x90ff7000 - 0x91035fff com.apple.CFNetwork 129.16	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x91047000 - 0x91057fff com.apple.WebServices 1.1.3 (1.1.0)	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/WebServicesCore.framework/Versions/A/WebServicesCore
0x91062000 - 0x910e0fff com.apple.SearchKit 1.0.5	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x91115000 - 0x91133fff com.apple.Metadata 10.4.4 (121.36)	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x9113f000 - 0x9114dfff libz.1.dylib 	/usr/lib/libz.1.dylib
0x91150000 - 0x91306fff com.apple.security 4.4.1 (27569)	/System/Library/Frameworks/Security.framework/Versions/A/Security
0x913f5000 - 0x913fdfff com.apple.DiskArbitration 2.1	/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x91404000 - 0x9142afff com.apple.SystemConfiguration 1.8.6	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x9143c000 - 0x91443fff libbsm.dylib 	/usr/lib/libbsm.dylib
0x91447000 - 0x914c0fff com.apple.audio.CoreAudio 3.0.4	/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x9150e000 - 0x9150efff com.apple.ApplicationServices 10.4 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x91510000 - 0x9153bfff com.apple.AE 314 (313)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x9154e000 - 0x91622fff com.apple.ColorSync 4.4.6	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x9165b000 - 0x916d8fff com.apple.print.framework.PrintCore 4.6 (177.13)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x91705000 - 0x917affff com.apple.QD 3.10.20 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x917d5000 - 0x91820fff com.apple.HIServices 1.5.2 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x9183f000 - 0x91855fff com.apple.LangAnalysis 1.6.3	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x91861000 - 0x9187bfff com.apple.FindByContent 1.5	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/FindByContent.framework/Versions/A/FindByContent
0x91885000 - 0x918c2fff com.apple.LaunchServices 180	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x918d6000 - 0x918e1fff com.apple.speech.synthesis.framework 3.4	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x918e8000 - 0x91920fff com.apple.ImageIO.framework 1.4.7	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x91932000 - 0x919e4fff libcrypto.0.9.7.dylib 	/usr/lib/libcrypto.0.9.7.dylib
0x91a2a000 - 0x91a40fff libcups.2.dylib 	/usr/lib/libcups.2.dylib
0x91a45000 - 0x91a61fff libJPEG.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x91a66000 - 0x91ac4fff libJP2.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
0x91ad4000 - 0x91ad8fff libGIF.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x91ada000 - 0x91b35fff libRaw.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRaw.dylib
0x91b39000 - 0x91b76fff libTIFF.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x91b7c000 - 0x91b96fff libPng.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x91b9b000 - 0x91b9dfff libRadiance.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x91b9f000 - 0x91b9ffff com.apple.Accelerate 1.2.2 (Accelerate 1.2.2)	/System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x91ba1000 - 0x91c2bfff com.apple.vImage 2.4	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x91c32000 - 0x91c32fff com.apple.Accelerate.vecLib 3.2.2 (vecLib 3.2.2)	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x91c34000 - 0x91c79fff libvMisc.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x91c81000 - 0x91ca6fff libvDSP.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x91cad000 - 0x92230fff libBLAS.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x9226d000 - 0x9261ffff libLAPACK.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x9264c000 - 0x926d0fff com.apple.DesktopServices 1.3.4	/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x9270c000 - 0x9293efff com.apple.Foundation 6.4.6 (567.27)	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x92a4a000 - 0x92b28fff libxml2.2.dylib 	/usr/lib/libxml2.2.dylib
0x92b45000 - 0x92c32fff libiconv.2.dylib 	/usr/lib/libiconv.2.dylib
0x92c42000 - 0x92c59fff libGL.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x92c64000 - 0x92cbbfff libGLU.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x92ccf000 - 0x92ccffff com.apple.Carbon 10.4 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x92cd1000 - 0x92ce1fff com.apple.ImageCapture 3.0.4	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x92cef000 - 0x92cf7fff com.apple.speech.recognition.framework 3.5	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x92cfd000 - 0x92d02fff com.apple.securityhi 2.0.1 (24742)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x92d08000 - 0x92d99fff com.apple.ink.framework 101.2.1 (71)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x92dad000 - 0x92db0fff com.apple.help 1.0.3 (32.1)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x92db3000 - 0x92dd0fff com.apple.openscripting 1.2.5 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x92de0000 - 0x92de6fff com.apple.print.framework.Print 5.2 (192.4)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x92dec000 - 0x92e4ffff com.apple.htmlrendering 66.1 (1.1.3)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x92e73000 - 0x92eb4fff com.apple.NavigationServices 3.4.4 (3.4.3)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x92edb000 - 0x92ee8fff com.apple.audio.SoundManager 3.9.1	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0x92eef000 - 0x92ef4fff com.apple.CommonPanels 1.2.3 (73)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x92ef9000 - 0x931ebfff com.apple.HIToolbox 1.4.8 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x932f0000 - 0x932fbfff com.apple.opengl 1.4.10	/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x93300000 - 0x9331bfff com.apple.DirectoryService.Framework 3.1	/System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService
0x9338a000 - 0x9338afff com.apple.Cocoa 6.4 (???)	/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x9338c000 - 0x93a45fff com.apple.AppKit 6.4.7 (824.41)	/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x93dc6000 - 0x93e40fff com.apple.CoreData 90	/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x93e79000 - 0x93f3afff com.apple.audio.toolbox.AudioToolbox 1.4.3	/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x93f7a000 - 0x93f7afff com.apple.audio.units.AudioUnit 1.4.2	/System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x93f7c000 - 0x9412afff com.apple.QuartzCore 1.4.8	/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x94178000 - 0x941b9fff libsqlite3.0.dylib 	/usr/lib/libsqlite3.0.dylib
0x941c1000 - 0x941fbfff libGLImage.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x94289000 - 0x942befff com.apple.vmutils 4.0.1 (87)	/System/Library/PrivateFrameworks/vmutils.framework/Versions/A/vmutils
0x94300000 - 0x94310fff com.apple.securityfoundation 2.2.1 (28150)	/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation
0x9431d000 - 0x9435afff com.apple.securityinterface 2.2.1 (27695)	/System/Library/Frameworks/SecurityInterface.framework/Versions/A/SecurityInterface
0x94376000 - 0x94385fff libCGATS.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x9438c000 - 0x94397fff libCSync.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x943e3000 - 0x943fdfff libRIP.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x9481b000 - 0x94964fff com.apple.AddressBook.framework 4.0.4 (485.1)	/System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook
0x949f0000 - 0x949fffff com.apple.DSObjCWrappers.Framework 1.1	/System/Library/PrivateFrameworks/DSObjCWrappers.framework/Versions/A/DSObjCWrappers
0x94a06000 - 0x94a2ffff com.apple.LDAPFramework 1.4.1 (69.0.1)	/System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x94a35000 - 0x94a44fff libsasl2.2.dylib 	/usr/lib/libsasl2.2.dylib
0x94a48000 - 0x94a6cfff libssl.0.9.7.dylib 	/usr/lib/libssl.0.9.7.dylib
0x94a78000 - 0x94a95fff libresolv.9.dylib 	/usr/lib/libresolv.9.dylib
0x957f6000 - 0x95819fff libxslt.1.dylib 	/usr/lib/libxslt.1.dylib
0x9a61c000 - 0x9a653fff com.apple.Syndication 1.0.6 (54)	/System/Library/PrivateFrameworks/Syndication.framework/Versions/A/Syndication
0x9a66f000 - 0x9a681fff com.apple.SyndicationUI 1.0.6 (54)	/System/Library/PrivateFrameworks/SyndicationUI.framework/Versions/A/SyndicationUI

[Geoffrey Garen]

Created attachment 9217 [details]
reduction

[Alice Liu]

<rdar://problem/4614228>

[Darin Adler]

The bug is in HTMLInputElement::defaultEventHandler. The call to doTextFieldCommandFromEvent assumes that keyEvent will return a non-0 value. But that's not true when the event is created in JavaScript -- in that case there is no platform event. Later you crash inside because the passed event is 0.

A check for 0 will eliminate the crash. That leaves us with a separate issue -- keyboard equivalents for editing commands won't work for synthesized events.

[David Carson]

KeyboardEvents that are being tested here is defined here:
http://www.w3.org/TR/DOM-Level-3-Events/events.html#Events-KeyboardEvent

The test case is testing "KeyPress" as the key event type. According to the spec, possible keyboard event types are: keydown and keyup. I am not sure what a KeyPress does.

[Geoffrey Garen]

Keypress is an HTML event that's not mentioned in the DOM spec. I doubt it matters which keyboard event you send.

[David Carson]

(In reply to comment #5)
> Keypress is an HTML event that's not mentioned in the DOM spec. I doubt it
> matters which keyboard event you send.
> 
If I send a keydown for keypress, there won't be a corresponding keyup. Don't know if this is going to be a problem. 
I am also very confused why there are two copies of the key event data, one copy is stored in the PlatformKeyboardEvent and another copy is stored in the actual KeyboardEvent DOM class. 
IMHO I think that the PlatformKeyboardEvent should only be used to parse the data and populate the values in KeyboardEvent, and hold a copy of the original platform key event in case it is needed.
However, it seems that the the KeyboardEvent data is not used, it is the PlatformKeyboardEvent that seems to be used.

[Darin Adler]

Committed revision 15454.