113016 2013-03-22 01:00:39 -0700 HTMLStackItem should include <template> as a special tag 2013-03-26 10:26:36 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P1 Normal --- 1 tasak rafaelw abarth adamk eric esprehn+autocc inferno ojan.autocc rafaelw webkit.review.bot oldest_to_newest 861186 0 tasak 2013-03-22 01:00:39 -0700 Timestamp 2013-03-14 03:00:22 Fuzzer Dstockwell-css-fuzzer Job Type Linux_asan_drt Crash type UNKNOWN Crash address 0x000000000000 Crash state - crash stack - WebCore::HTMLStackItem::HTMLStackItem WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately WebCore::HTMLTreeBuilder::processTemplateEndTag Redzone 32 bytes https://cluster-fuzz.appspot.com/testcase?key=171557060 861190 1 194463 tasak 2013-03-22 01:02:08 -0700 Created attachment 194463 repro.html 861193 2 tasak 2013-03-22 01:04:47 -0700 I guess, the crash reason would be that HTMLTreeBuilder::processAnyOtherEndTagForInBody checks items out of <template>. 861202 3 tasak 2013-03-22 01:09:59 -0700 When token type is end and toke name is dummy (c.f. repro.html), processAnyOtherEndTagForInBody(dummy), mode(7) HTMLStackItem(span) HTMLStackItem(template) HTMLStackItem(dummy) <---- this dummy will be removed, but this is not a child of <template>. 861579 4 rafaelw 2013-03-22 09:45:25 -0700 This is an oversight in the implementation of template element. Note the spec instructs that <template> should be considered a "special" tag: https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html#parsing 861582 5 194575 rafaelw 2013-03-22 09:46:46 -0700 Created attachment 194575 Patch 862429 6 rafaelw 2013-03-24 15:49:16 -0700 ping. 863784 7 194575 eric 2013-03-26 10:21:11 -0700 Comment on attachment 194575 Patch Thanks. 863798 8 194575 webkit.review.bot 2013-03-26 10:26:33 -0700 Comment on attachment 194575 Patch Clearing flags on attachment: 194575 Committed r146904: <http://trac.webkit.org/changeset/146904> 863799 9 webkit.review.bot 2013-03-26 10:26:36 -0700 All reviewed patches have been landed. Closing bug. 194463 2013-03-22 01:02:08 -0700 2013-03-22 01:02:08 -0700 repro.html repro.html text/html 46 tasak PGR1bW15PgogIDx0ZW1wbGF0ZT4KICAgIDxzcGFuPgogICAgPC9kdW1teT4KCg== 194575 2013-03-22 09:46:46 -0700 2013-03-26 10:26:33 -0700 Patch bug-113016-20130322094233.patch text/plain 2596 rafaelw U3VidmVyc2lvbiBSZXZpc2lvbjogMTQ2NjIwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzhlYTA0MjM5MGFlN2Qx M2ZiYzE4YzgwZGE1MjNkZTcyZTQ2MDhjOC4uYzdkZDllYmE0OTFiNTBmZmFjM2VkNGUwMGQ4NTYw MzI1NzZiODJjMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDEzLTAzLTIyICBSYWZh ZWwgV2VpbnN0ZWluICA8cmFmYWVsd0BjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgSFRNTFN0YWNr SXRlbSBzaG91bGQgaW5jbHVkZSA8dGVtcGxhdGU+IGFzIGEgc3BlY2lhbCB0YWcKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExMzAxNgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE5ldyB0ZXN0IGFkZGVkIHRv IGh0bWw1bGliIHN1aXRlLgorCisgICAgICAgICogaHRtbC9wYXJzZXIvSFRNTFN0YWNrSXRlbS5o OgorICAgICAgICAoV2ViQ29yZTo6SFRNTFN0YWNrSXRlbTo6aXNTcGVjaWFsTm9kZSk6CisKIDIw MTMtMDMtMjIgIFRpYW5jaGVuZyBKaWFuZyAgPHRpamlhbmdAcmltLmNvbT4KIAogICAgICAgICBb QmxhY2tCZXJyeV0gVXBkYXRlIElucHV0IGZpZWxkIEJhY2tncm91bmQgQ29sb3IKZGlmZiAtLWdp dCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxTdGFja0l0ZW0uaCBiL1NvdXJjZS9X ZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxTdGFja0l0ZW0uaAppbmRleCA3NmRmNjQ2ODRhMmRkMDRj MGQ1MDcxNTc3NGJlYWFjY2JmYjBlYTA4Li5kOTM1NGJiZWI0ZmNlNmE4M2NiYjFiNjBkZDllZTBl MjEzOWUzNDQ5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9IVE1MU3Rh Y2tJdGVtLmgKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTFN0YWNrSXRlbS5o CkBAIC0xOTYsNiArMTk2LDkgQEAgcHVibGljOgogICAgICAgICAgICAgfHwgdGFnTmFtZSA9PSBI VE1MTmFtZXM6OnRhYmxlVGFnCiAgICAgICAgICAgICB8fCBpc1RhYmxlQm9keUNvbnRleHRFbGVt ZW50KCkKICAgICAgICAgICAgIHx8IHRhZ05hbWUgPT0gSFRNTE5hbWVzOjp0ZFRhZworI2lmIEVO QUJMRShURU1QTEFURV9FTEVNRU5UKQorICAgICAgICAgICAgfHwgdGFnTmFtZSA9PSBIVE1MTmFt ZXM6OnRlbXBsYXRlVGFnCisjZW5kaWYKICAgICAgICAgICAgIHx8IHRhZ05hbWUgPT0gSFRNTE5h bWVzOjp0ZXh0YXJlYVRhZwogICAgICAgICAgICAgfHwgdGFnTmFtZSA9PSBIVE1MTmFtZXM6OnRo VGFnCiAgICAgICAgICAgICB8fCB0YWdOYW1lID09IEhUTUxOYW1lczo6dGl0bGVUYWcKZGlmZiAt LWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRl eCA5ZmQ0ZDdiMDU0NTczODY4OGIwZGQ1NmJlYTViMzEwNGI4YWUxMzk3Li4zN2M3ZDdkOGM0OTM0 ODYyMzQ5ZThiYzhkNWY2Yzc0MmNhNjhkODNmIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFu Z2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTIgQEAKKzIwMTMt MDMtMjIgIFJhZmFlbCBXZWluc3RlaW4gIDxyYWZhZWx3QGNocm9taXVtLm9yZz4KKworICAgICAg ICBIVE1MU3RhY2tJdGVtIHNob3VsZCBpbmNsdWRlIDx0ZW1wbGF0ZT4gYXMgYSBzcGVjaWFsIHRh ZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTEzMDE2 CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBodG1s NWxpYi9yZXNvdXJjZXMvdGVtcGxhdGUuZGF0OgorCiAyMDEzLTAzLTIyICBZdXJ5IFNlbWlraGF0 c2t5ICA8eXVyeXNAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFVucmV2aWV3ZWQuIFVwZGF0ZSB0 ZXN0IGV4cGVjdGF0aW9ucyBmb3IgYSBidW5jaCBvZiBzb2Z0d2FyZWNvbXBvc2l0aW5nIHRlc3Rz LgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaHRtbDVsaWIvcmVzb3VyY2VzL3RlbXBsYXRlLmRh dCBiL0xheW91dFRlc3RzL2h0bWw1bGliL3Jlc291cmNlcy90ZW1wbGF0ZS5kYXQKaW5kZXggNjVh YTliNTg3YzlmNDMwYTA4YWU2MTFhYmIyZDNjZTM1MjBmMjhkOC4uMjA2YWQ0NmI5OTM1MjViMzAz MzU4ZDRjZjQ5YmIxZmJkMDBmNWQ5MSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvaHRtbDVsaWIv cmVzb3VyY2VzL3RlbXBsYXRlLmRhdAorKysgYi9MYXlvdXRUZXN0cy9odG1sNWxpYi9yZXNvdXJj ZXMvdGVtcGxhdGUuZGF0CkBAIC0xMjU4LDMgKzEyNTgsMTUgQEAKIHwgICAgICAgICAgICAgICAg IDxkaXY+CiB8ICAgPGJvZHk+CiB8ICAgICA8ZGl2PgorCisjZGF0YQorPGR1bW15Pjx0ZW1wbGF0 ZT48c3Bhbj48L2R1bW15PgorI2Vycm9ycworI2RvY3VtZW50Cit8IDxodG1sPgorfCAgIDxoZWFk PgorfCAgIDxib2R5PgorfCAgICAgPGR1bW15PgorfCAgICAgICA8dGVtcGxhdGU+Cit8ICAgICAg ICAgY29udGVudAorfCAgICAgICAgICAgPHNwYW4+Cg==