12353 2007-01-21 08:47:28 -0800 REGRESSION: Crash on load (mutation event dispatch under the image element constructor deletes the element) 2007-03-02 16:14:53 -0800 1 1 1 Unclassified WebKit WebCore JavaScript 420+ Mac OS X 10.4 RESOLVED FIXED http://eigenclass.org/hiki.rb?method+arguments+via+introspection HasReduction, InRadar, Regression P1 Normal --- 1 a webkit-unassigned ddkilzer gavin.sharp mitz mjs oldest_to_newest 33958 0 a 2007-01-21 08:47:28 -0800 http://eigenclass.org/hiki.rb?method+arguments+via+introspection crashes on load 33960 1 a 2007-01-21 08:48:38 -0800 1 com.apple.WebCore 0x01218edd WebCore::Element::setAttribute(WebCore::QualifiedName const&, WebCore::StringImpl*, int&) + 55 2 com.apple.WebCore 0x012190c1 WebCore::Element::setAttribute(WebCore::QualifiedName const&, WebCore::String const&) + 47 3 com.apple.WebCore 0x0127a7b9 WebCore::HTMLImageElement::setHeight(int) + 59 4 com.apple.WebCore 0x01230d1c KJS::ImageConstructorImp::construct(KJS::ExecState*, KJS::List const&) + 264 5 com.apple.JavaScriptCore 0x0012cb35 KJS::NewExprNode::evaluate(KJS::ExecState*) + 533 6 com.apple.JavaScriptCore 0x0012aae9 KJS::VarDeclNode::evaluate(KJS::ExecState*) + 55 7 com.apple.JavaScriptCore 0x0012aa5a KJS::VarDeclListNode::evaluate(KJS::ExecState*) + 42 8 com.apple.JavaScriptCore 0x00130a3b KJS::VarStatementNode::execute(KJS::ExecState*) + 117 9 com.apple.JavaScriptCore 0x0013385b KJS::SourceElementsNode::execute(KJS::ExecState*) + 163 10 com.apple.JavaScriptCore 0x00130b0d KJS::BlockNode::execute(KJS::ExecState*) + 67 11 com.apple.JavaScriptCore 0x00130d9a KJS::IfNode::execute(KJS::ExecState*) + 270 12 com.apple.JavaScriptCore 0x0013395d KJS::SourceElementsNode::execute(KJS::ExecState*) + 421 13 com.apple.JavaScriptCore 0x00130b0d KJS::BlockNode::execute(KJS::ExecState*) + 67 33946 2 ddkilzer 2007-01-21 08:56:39 -0800 Does not crash on shipping Safari 2.0.4 (419.3) on Mac OS X 10.4.8 (8N1037). 33947 3 12584 ddkilzer 2007-01-21 09:00:36 -0800 Created attachment 12584 Debug stack trace (r19008) Stack trace from locally-built debug build of WebKit r19008. 33933 4 ddkilzer 2007-01-21 11:04:38 -0800 The bug happens in urchin.js in this JavaScript code: if ((_userv==1 || _userv==2) && _uSP()) { var i2=new Image(1,1); // Safari dies executing this line i2.src=_ugifpath2+"?"+"utmwv="+_uwv+s+"&utmac="+_uacct+"&utmcc="+_uGCS(); i2.onload=function() { _uVoid(); } } When HTMLImageElement::setHeight() is called, it eventually reaches Element::attributes(bool readonly), and the call to updateStyleAttributeIfNeeded() in that method appears to simply "step off the the deep end" as if it doesn't know where to find that method. 33925 5 12585 mitz 2007-01-21 11:18:24 -0800 Created attachment 12585 Reduction (will crash) 33920 6 12586 mitz 2007-01-21 11:32:51 -0800 Created attachment 12586 Protect the image element from deletion during mutation event dispatch I don't know if it makes sense for the calls to setWidth and setHeight to on the newly created element to even fire DOM mutation events, but this patch ensures that the element survives it, and in any case it makes sense to take ownership of the element before doing anything with it. 33918 7 12587 ddkilzer 2007-01-21 12:18:50 -0800 Created attachment 12587 Another reduction (will crash) A different reduction based on the original web page. The patch in Attachment 12586 also fixes this reduction. 33883 8 12586 darin 2007-01-21 13:53:05 -0800 Comment on attachment 12586 Protect the image element from deletion during mutation event dispatch An equally good way to fix this would be to put the newly-created image element into a RefPtr; that's the model we're trying to move to. Reference-counted objects won't have an initial floating state -- instead they go straight into a PassRefPtr. But this fix is also good. r=me 33850 9 mrowe 2007-01-21 16:02:48 -0800 <rdar://problem/4944599> 33816 10 darin 2007-01-21 17:27:56 -0800 Committed revision 19018. 20458 11 KwhiteRight 2007-03-02 16:14:53 -0800 *** Bug 12658 has been marked as a duplicate of this bug. *** 12584 2007-01-21 09:00:36 -0800 2007-01-21 09:00:36 -0800 Debug stack trace (r19008) bug-12353-stack.txt text/plain 6818 ddkilzer RXhjZXB0aW9uOiAgRVhDX0JBRF9JTlNUUlVDVElPTiAoMHgwMDAyKQpDb2RlWzBdOiAgICAweDAw MDAwMDBkCkNvZGVbMV06ICAgIDB4MDAwMGViMjQKCgpUaHJlYWQgMCBDcmFzaGVkOgowICAgPDww MDAwMDAwMD4+IAkweDAwMGRlYjY4IDAgKyA5MTIyMzIKMSAgIGNvbS5hcHBsZS5XZWJDb3JlICAg ICAgICAJMHgwMTI0ODMyMiBXZWJDb3JlOjpFbGVtZW50OjpzZXRBdHRyaWJ1dGUoV2ViQ29yZTo6 UXVhbGlmaWVkTmFtZSBjb25zdCYsIFdlYkNvcmU6OlN0cmluZ0ltcGwqLCBpbnQmKSArIDY2IChF bGVtZW50LmNwcDozODQpCjIgICBjb20uYXBwbGUuV2ViQ29yZSAgICAgICAgCTB4MDEyNDg2MDEg V2ViQ29yZTo6RWxlbWVudDo6c2V0QXR0cmlidXRlKFdlYkNvcmU6OlF1YWxpZmllZE5hbWUgY29u c3QmLCBXZWJDb3JlOjpTdHJpbmcgY29uc3QmKSArIDU1IChFbGVtZW50LmNwcDo5MCkKMyAgIGNv bS5hcHBsZS5XZWJDb3JlICAgICAgICAJMHgwMTJhZmFhYiBXZWJDb3JlOjpIVE1MSW1hZ2VFbGVt ZW50OjpzZXRIZWlnaHQoaW50KSArIDYzIChIVE1MSW1hZ2VFbGVtZW50LmNwcDoyOTIpCjQgICBj b20uYXBwbGUuV2ViQ29yZSAgICAgICAgCTB4MDEyNWY3MjAgS0pTOjpJbWFnZUNvbnN0cnVjdG9y SW1wOjpjb25zdHJ1Y3QoS0pTOjpFeGVjU3RhdGUqLCBLSlM6Okxpc3QgY29uc3QmKSArIDI2NiAo a2pzX2h0bWwuY3BwOjE3MzIpCjUgICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgCTB4MDA0ZTlj NDYgS0pTOjpOZXdFeHByTm9kZTo6ZXZhbHVhdGUoS0pTOjpFeGVjU3RhdGUqKSArIDU3NCAobm9k ZXMuY3BwOjYxMSkKNiAgIGNvbS5hcHBsZS5KYXZhU2NyaXB0Q29yZSAJMHgwMDRlMjU5OSBLSlM6 OkFzc2lnbkV4cHJOb2RlOjpldmFsdWF0ZShLSlM6OkV4ZWNTdGF0ZSopICsgNDEgKG5vZGVzLmNw cDoxNTI4KQo3ICAgY29tLmFwcGxlLkphdmFTY3JpcHRDb3JlIAkweDAwNGU2NWI4IEtKUzo6VmFy RGVjbE5vZGU6OmV2YWx1YXRlKEtKUzo6RXhlY1N0YXRlKikgKyA5MCAobm9kZXMuY3BwOjE1NDUp CjggICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgCTB4MDA0ZTY0ZDYgS0pTOjpWYXJEZWNsTGlz dE5vZGU6OmV2YWx1YXRlKEtKUzo6RXhlY1N0YXRlKikgKyA1MiAobm9kZXMuY3BwOjE1OTMpCjkg ICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgCTB4MDA0ZTYzYWUgS0pTOjpWYXJTdGF0ZW1lbnRO b2RlOjpleGVjdXRlKEtKUzo6RXhlY1N0YXRlKikgKyAxNDggKG5vZGVzLmNwcDoxNjE3KQoxMCAg Y29tLmFwcGxlLkphdmFTY3JpcHRDb3JlIAkweDAwNGUzZTFjIEtKUzo6U291cmNlRWxlbWVudHNO b2RlOjpleGVjdXRlKEtKUzo6RXhlY1N0YXRlKikgKyAyNTYgKG5vZGVzLmNwcDoyNDQ5KQoxMSAg Y29tLmFwcGxlLkphdmFTY3JpcHRDb3JlIAkweDAwNGUyNzU0IEtKUzo6QmxvY2tOb2RlOjpleGVj dXRlKEtKUzo6RXhlY1N0YXRlKikgKyAxNDAgKG5vZGVzLmNwcDoxNjQ4KQoxMiAgY29tLmFwcGxl LkphdmFTY3JpcHRDb3JlIAkweDAwNGU2MTE4IEtKUzo6SWZOb2RlOjpleGVjdXRlKEtKUzo6RXhl Y1N0YXRlKikgKyA0MjAgKG5vZGVzLmNwcDoxNjkxKQoxMyAgY29tLmFwcGxlLkphdmFTY3JpcHRD b3JlIAkweDAwNGUzZjUyIEtKUzo6U291cmNlRWxlbWVudHNOb2RlOjpleGVjdXRlKEtKUzo6RXhl Y1N0YXRlKikgKyA1NjYgKG5vZGVzLmNwcDoyNDU1KQoxNCAgY29tLmFwcGxlLkphdmFTY3JpcHRD b3JlIAkweDAwNGUyNzU0IEtKUzo6QmxvY2tOb2RlOjpleGVjdXRlKEtKUzo6RXhlY1N0YXRlKikg KyAxNDAgKG5vZGVzLmNwcDoxNjQ4KQoxNSAgY29tLmFwcGxlLkphdmFTY3JpcHRDb3JlIAkweDAw NGQ0NjI2IEtKUzo6RGVjbGFyZWRGdW5jdGlvbkltcDo6ZXhlY3V0ZShLSlM6OkV4ZWNTdGF0ZSop ICsgNTAgKGZ1bmN0aW9uLmNwcDozNjIpCjE2ICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgCTB4 MDA0ZDY5MDkgS0pTOjpGdW5jdGlvbkltcDo6Y2FsbEFzRnVuY3Rpb24oS0pTOjpFeGVjU3RhdGUq LCBLSlM6OkpTT2JqZWN0KiwgS0pTOjpMaXN0IGNvbnN0JikgKyA1NzMgKGZ1bmN0aW9uLmNwcDox MTEpCjE3ICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgCTB4MDA0ZjMxODAgS0pTOjpKU09iamVj dDo6Y2FsbChLSlM6OkV4ZWNTdGF0ZSosIEtKUzo6SlNPYmplY3QqLCBLSlM6Okxpc3QgY29uc3Qm KSArIDIxMCAob2JqZWN0LmNwcDo5NykKMTggIGNvbS5hcHBsZS5KYXZhU2NyaXB0Q29yZSAJMHgw MDRlOTc4OCBLSlM6OkZ1bmN0aW9uQ2FsbFJlc29sdmVOb2RlOjpldmFsdWF0ZShLSlM6OkV4ZWNT dGF0ZSopICsgNzE2IChub2Rlcy5jcHA6Njc5KQoxOSAgY29tLmFwcGxlLkphdmFTY3JpcHRDb3Jl IAkweDAwNGU2MjI0IEtKUzo6RXhwclN0YXRlbWVudE5vZGU6OmV4ZWN1dGUoS0pTOjpFeGVjU3Rh dGUqKSArIDE0OCAobm9kZXMuY3BwOjE2NzIpCjIwICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUg CTB4MDA0ZTNmNTIgS0pTOjpTb3VyY2VFbGVtZW50c05vZGU6OmV4ZWN1dGUoS0pTOjpFeGVjU3Rh dGUqKSArIDU2NiAobm9kZXMuY3BwOjI0NTUpCjIxICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUg CTB4MDA0ZTI3NTQgS0pTOjpCbG9ja05vZGU6OmV4ZWN1dGUoS0pTOjpFeGVjU3RhdGUqKSArIDE0 MCAobm9kZXMuY3BwOjE2NDgpCjIyICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgCTB4MDA0ZDQ2 MjYgS0pTOjpEZWNsYXJlZEZ1bmN0aW9uSW1wOjpleGVjdXRlKEtKUzo6RXhlY1N0YXRlKikgKyA1 MCAoZnVuY3Rpb24uY3BwOjM2MikKMjMgIGNvbS5hcHBsZS5KYXZhU2NyaXB0Q29yZSAJMHgwMDRk NjkwOSBLSlM6OkZ1bmN0aW9uSW1wOjpjYWxsQXNGdW5jdGlvbihLSlM6OkV4ZWNTdGF0ZSosIEtK Uzo6SlNPYmplY3QqLCBLSlM6Okxpc3QgY29uc3QmKSArIDU3MyAoZnVuY3Rpb24uY3BwOjExMSkK MjQgIGNvbS5hcHBsZS5KYXZhU2NyaXB0Q29yZSAJMHgwMDRmMzE4MCBLSlM6OkpTT2JqZWN0Ojpj YWxsKEtKUzo6RXhlY1N0YXRlKiwgS0pTOjpKU09iamVjdCosIEtKUzo6TGlzdCBjb25zdCYpICsg MjEwIChvYmplY3QuY3BwOjk3KQoyNSAgY29tLmFwcGxlLkphdmFTY3JpcHRDb3JlIAkweDAwNGU5 Nzg4IEtKUzo6RnVuY3Rpb25DYWxsUmVzb2x2ZU5vZGU6OmV2YWx1YXRlKEtKUzo6RXhlY1N0YXRl KikgKyA3MTYgKG5vZGVzLmNwcDo2NzkpCjI2ICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgCTB4 MDA0ZTYyMjQgS0pTOjpFeHByU3RhdGVtZW50Tm9kZTo6ZXhlY3V0ZShLSlM6OkV4ZWNTdGF0ZSop ICsgMTQ4IChub2Rlcy5jcHA6MTY3MikKMjcgIGNvbS5hcHBsZS5KYXZhU2NyaXB0Q29yZSAJMHgw MDRlM2Y1MiBLSlM6OlNvdXJjZUVsZW1lbnRzTm9kZTo6ZXhlY3V0ZShLSlM6OkV4ZWNTdGF0ZSop ICsgNTY2IChub2Rlcy5jcHA6MjQ1NSkKMjggIGNvbS5hcHBsZS5KYXZhU2NyaXB0Q29yZSAJMHgw MDRlMjc1NCBLSlM6OkJsb2NrTm9kZTo6ZXhlY3V0ZShLSlM6OkV4ZWNTdGF0ZSopICsgMTQwIChu b2Rlcy5jcHA6MTY0OCkKMjkgIGNvbS5hcHBsZS5KYXZhU2NyaXB0Q29yZSAJMHgwMDRkYmQ3OSBL SlM6OkludGVycHJldGVyOjpldmFsdWF0ZShLSlM6OlVTdHJpbmcgY29uc3QmLCBpbnQsIEtKUzo6 VUNoYXIgY29uc3QqLCBpbnQsIEtKUzo6SlNWYWx1ZSopICsgOTc3IChpbnRlcnByZXRlci5jcHA6 NDc4KQozMCAgY29tLmFwcGxlLldlYkNvcmUgICAgICAgIAkweDAxMjY4ZDYxIFdlYkNvcmU6OktK U1Byb3h5OjpldmFsdWF0ZShXZWJDb3JlOjpTdHJpbmcgY29uc3QmLCBpbnQsIFdlYkNvcmU6OlN0 cmluZyBjb25zdCYsIFdlYkNvcmU6Ok5vZGUqKSArIDMxOSAoa2pzX3Byb3h5LmNwcDo2NSkKMzEg IGNvbS5hcHBsZS5XZWJDb3JlICAgICAgICAJMHgwMTNiZGU5NyBXZWJDb3JlOjpGcmFtZUxvYWRl cjo6ZXhlY3V0ZVNjcmlwdChXZWJDb3JlOjpTdHJpbmcgY29uc3QmLCBpbnQsIFdlYkNvcmU6Ok5v ZGUqLCBXZWJDb3JlOjpTdHJpbmcgY29uc3QmKSArIDk5IChGcmFtZUxvYWRlci5jcHA6Njg0KQoz MiAgY29tLmFwcGxlLldlYkNvcmUgICAgICAgIAkweDAxMDFkOTc2IFdlYkNvcmU6OkhUTUxUb2tl bml6ZXI6OnNjcmlwdEV4ZWN1dGlvbihXZWJDb3JlOjpEZXByZWNhdGVkU3RyaW5nIGNvbnN0Jiwg V2ViQ29yZTo6SFRNTFRva2VuaXplcjo6U3RhdGUsIFdlYkNvcmU6OkRlcHJlY2F0ZWRTdHJpbmcs IGludCkgKyAzMTYgKEhUTUxUb2tlbml6ZXIuY3BwOjUwMSkKMzMgIGNvbS5hcHBsZS5XZWJDb3Jl ICAgICAgICAJMHgwMTAyMDExZCBXZWJDb3JlOjpIVE1MVG9rZW5pemVyOjpzY3JpcHRIYW5kbGVy KFdlYkNvcmU6OkhUTUxUb2tlbml6ZXI6OlN0YXRlKSArIDE0NDkgKEhUTUxUb2tlbml6ZXIuY3Bw OjQ1MSkKMzQgIGNvbS5hcHBsZS5XZWJDb3JlICAgICAgICAJMHgwMTAyMDYyZCBXZWJDb3JlOjpI VE1MVG9rZW5pemVyOjpwYXJzZVNwZWNpYWwoV2ViQ29yZTo6U2VnbWVudGVkU3RyaW5nJiwgV2Vi Q29yZTo6SFRNTFRva2VuaXplcjo6U3RhdGUpICsgOTQxIChIVE1MVG9rZW5pemVyLmNwcDozMDkp CjM1ICBjb20uYXBwbGUuV2ViQ29yZSAgICAgICAgCTB4MDEwMjFmYzkgV2ViQ29yZTo6SFRNTFRv a2VuaXplcjo6cGFyc2VUYWcoV2ViQ29yZTo6U2VnbWVudGVkU3RyaW5nJiwgV2ViQ29yZTo6SFRN TFRva2VuaXplcjo6U3RhdGUpICsgNTI1MyAoSFRNTFRva2VuaXplci5jcHA6MTE3NCkKMzYgIGNv bS5hcHBsZS5XZWJDb3JlICAgICAgICAJMHgwMTAyMjc4ZCBXZWJDb3JlOjpIVE1MVG9rZW5pemVy Ojp3cml0ZShXZWJDb3JlOjpTZWdtZW50ZWRTdHJpbmcgY29uc3QmLCBib29sKSArIDExNzMgKEhU TUxUb2tlbml6ZXIuY3BwOjEzODgpCjM3ICBjb20uYXBwbGUuV2ViQ29yZSAgICAgICAgCTB4MDEw MWYwMjkgV2ViQ29yZTo6SFRNTFRva2VuaXplcjo6bm90aWZ5RmluaXNoZWQoV2ViQ29yZTo6Q2Fj aGVkUmVzb3VyY2UqKSArIDgwNyAoSFRNTFRva2VuaXplci5jcHA6MTY4MSkKMzggIGNvbS5hcHBs ZS5XZWJDb3JlICAgICAgICAJMHgwMTEwNjRjZSBXZWJDb3JlOjpDYWNoZWRTY3JpcHQ6OmNoZWNr Tm90aWZ5KCkgKyA2OCAoQ2FjaGVkU2NyaXB0LmNwcDo5MSkKMzkgIGNvbS5hcHBsZS5XZWJDb3Jl ICAgICAgICAJMHgwMTEwNjVjMCBXZWJDb3JlOjpDYWNoZWRTY3JpcHQ6OmRhdGEoV1RGOjpWZWN0 b3I8Y2hhciwgKHVuc2lnbmVkIGxvbmcpMD4mLCBib29sKSArIDE2OCAoQ2FjaGVkU2NyaXB0LmNw cDo4MykKNDAgIGNvbS5hcHBsZS5XZWJDb3JlICAgICAgICAJMHgwMTEwODMwZSBXZWJDb3JlOjpM b2FkZXI6OmRpZEZpbmlzaExvYWRpbmcoV2ViQ29yZTo6U3VicmVzb3VyY2VMb2FkZXIqKSArIDI4 OCAobG9hZGVyLmNwcDoxMDgpCjQxICBjb20uYXBwbGUuV2ViQ29yZSAgICAgICAgCTB4MDEzYzQ2 YzggV2ViQ29yZTo6U3VicmVzb3VyY2VMb2FkZXI6OmRpZEZpbmlzaExvYWRpbmcoKSArIDE2OCAo U3VicmVzb3VyY2VMb2FkZXIuY3BwOjE2NikKNDIgIGNvbS5hcHBsZS5XZWJDb3JlICAgICAgICAJ MHgwMTNjMzBjNiBXZWJDb3JlOjpSZXNvdXJjZUxvYWRlcjo6ZGlkRmluaXNoTG9hZGluZyhXZWJD b3JlOjpSZXNvdXJjZUhhbmRsZSopICsgMjQKNDMgIGNvbS5hcHBsZS5XZWJDb3JlICAgICAgICAJ MHgwMTNhMzExNyAtW1dlYkNvcmVSZXNvdXJjZUhhbmRsZUFzRGVsZWdhdGUgY29ubmVjdGlvbkRp ZEZpbmlzaExvYWRpbmc6XSArIDc5IChSZXNvdXJjZUhhbmRsZU1hYy5tbTozNjgpCjQ0ICBjb20u YXBwbGUuRm91bmRhdGlvbiAgICAgCTB4OTI2NWVlMDAgLVtOU1VSTENvbm5lY3Rpb24oTlNVUkxD b25uZWN0aW9uSW50ZXJuYWwpIF9zZW5kRGlkRmluaXNoTG9hZGluZ0NhbGxiYWNrXSArIDE3Ngo0 NSAgY29tLmFwcGxlLkZvdW5kYXRpb24gICAgIAkweDkyNjVjZWE1IC1bTlNVUkxDb25uZWN0aW9u KE5TVVJMQ29ubmVjdGlvbkludGVybmFsKSBfc2VuZENhbGxiYWNrc10gKyA3NDgKNDYgIGNvbS5h cHBsZS5Gb3VuZGF0aW9uICAgICAJMHg5MjY1Y2I0MSBfc2VuZENhbGxiYWNrcyArIDIwMQo0NyAg Y29tLmFwcGxlLkNvcmVGb3VuZGF0aW9uIAkweDkwODJhZmQyIENGUnVuTG9vcFJ1blNwZWNpZmlj ICsgMTIxMwo0OCAgY29tLmFwcGxlLkNvcmVGb3VuZGF0aW9uIAkweDkwODJhYjBlIENGUnVuTG9v cFJ1bkluTW9kZSArIDYxCjQ5ICBjb20uYXBwbGUuSElUb29sYm94ICAgICAgCTB4OTJkZGFiZWYg UnVuQ3VycmVudEV2ZW50TG9vcEluTW9kZSArIDI4NQo1MCAgY29tLmFwcGxlLkhJVG9vbGJveCAg ICAgIAkweDkyZGRhMmZkIFJlY2VpdmVOZXh0RXZlbnRDb21tb24gKyAzODUKNTEgIGNvbS5hcHBs ZS5ISVRvb2xib3ggICAgICAJMHg5MmRkYTE1NCBCbG9ja1VudGlsTmV4dEV2ZW50TWF0Y2hpbmdM aXN0SW5Nb2RlICsgODEKNTIgIGNvbS5hcHBsZS5BcHBLaXQgICAgICAgICAJMHg5MzI3ZjQ2NSBf RFBTTmV4dEV2ZW50ICsgNTcyCjUzICBjb20uYXBwbGUuQXBwS2l0ICAgICAgICAgCTB4OTMyN2Yw NTYgLVtOU0FwcGxpY2F0aW9uIG5leHRFdmVudE1hdGNoaW5nTWFzazp1bnRpbERhdGU6aW5Nb2Rl OmRlcXVldWU6XSArIDEzNwo1NCAgY29tLmFwcGxlLlNhZmFyaSAgICAgICAgIAkweDAwMDA2Y2Vh IDB4MTAwMCArIDIzNzg2CjU1ICBjb20uYXBwbGUuQXBwS2l0ICAgICAgICAgCTB4OTMyNzhkZGIg LVtOU0FwcGxpY2F0aW9uIHJ1bl0gKyA1MTIKNTYgIGNvbS5hcHBsZS5BcHBLaXQgICAgICAgICAJ MHg5MzI2Y2QyZiBOU0FwcGxpY2F0aW9uTWFpbiArIDU3Mwo1NyAgY29tLmFwcGxlLlNhZmFyaSAg ICAgICAgIAkweDAwMDVmNTRhIDB4MTAwMCArIDM4NjM3OAo1OCAgY29tLmFwcGxlLlNhZmFyaSAg ICAgICAgIAkweDAwMDVmNDcxIDB4MTAwMCArIDM4NjE2MQo= 12585 2007-01-21 11:18:24 -0800 2007-01-21 11:19:22 -0800 Reduction (will crash) crasher.html text/html 281 mitz PGhlYWQ+CiAgICA8c2NyaXB0PgogICAgICAgIGZ1bmN0aW9uIGxpc3RlbihldmVudCkKICAgICAg ICB7CiAgICAgICAgfQogICAgICAgIAogICAgICAgIGZ1bmN0aW9uIHRlc3QoKQogICAgICAgIHsK ICAgICAgICAgICAgZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NU3VidHJlZU1vZGlmaWVk IiwgbGlzdGVuLCB0cnVlKTsKICAgICAgICAgICAgbmV3IEltYWdlKDEsIDEpOwogICAgICAgIH0K ICAgIDwvc2NyaXB0Pgo8L2hlYWQ+Cjxib2R5IG9ubG9hZD0idGVzdCgpIj4KPC9ib2R5Pgo= 12586 2007-01-21 11:32:51 -0800 2007-01-21 13:53:05 -0800 Protect the image element from deletion during mutation event dispatch 12353_r1.patch text/plain 4047 mitz SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDE5MDExKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMDctMDEtMjEgIE1pdHogUGV0dGVsICA8bWl0 ekB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIC0gdGVzdCBmb3IgaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MTIzNTMKKyAgICAgICAgICBSRUdSRVNTSU9OOiBDcmFzaCBvbiBsb2FkIChtdXRhdGlvbiBldmVu dCBkaXNwYXRjaCB1bmRlciB0aGUgaW1hZ2UgZWxlbWVudCBjb25zdHJ1Y3RvciBkZWxldGVzIHRo ZSBlbGVtZW50KQorCisgICAgICAgICogZmFzdC9kb20vSFRNTEltYWdlRWxlbWVudC9jb25zdHJ1 Y3Rvci1tdXRhdGlvbi1ldmVudC1kaXNwYXRjaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAg ICAqIGZhc3QvZG9tL0hUTUxJbWFnZUVsZW1lbnQvY29uc3RydWN0b3ItbXV0YXRpb24tZXZlbnQt ZGlzcGF0Y2guaHRtbDogQWRkZWQuCisKIDIwMDctMDEtMjEgIE1pdHogUGV0dGVsICA8bWl0ekB3 ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluLgpJbmRleDogTGF5b3V0VGVz dHMvZmFzdC9kb20vSFRNTEltYWdlRWxlbWVudC9jb25zdHJ1Y3Rvci1tdXRhdGlvbi1ldmVudC1k aXNwYXRjaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9kb20v SFRNTEltYWdlRWxlbWVudC9jb25zdHJ1Y3Rvci1tdXRhdGlvbi1ldmVudC1kaXNwYXRjaC1leHBl Y3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2RvbS9IVE1MSW1hZ2VF bGVtZW50L2NvbnN0cnVjdG9yLW11dGF0aW9uLWV2ZW50LWRpc3BhdGNoLWV4cGVjdGVkLnR4dAko cmV2aXNpb24gMCkKQEAgLTAsMCArMSw1IEBACitUZXN0IGZvciBodHRwOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0xMjM1MyBSRUdSRVNTSU9OOiBDcmFzaCBvbiBsb2FkIChtdXRh dGlvbiBldmVudCBkaXNwYXRjaCB1bmRlciB0aGUgaW1hZ2UgZWxlbWVudCBjb25zdHJ1Y3RvciBk ZWxldGVzIHRoZSBlbGVtZW50KS4KKworTm8gY3Jhc2ggbWVhbnMgdGVzdCBQQVNTLgorCisKSW5k ZXg6IExheW91dFRlc3RzL2Zhc3QvZG9tL0hUTUxJbWFnZUVsZW1lbnQvY29uc3RydWN0b3ItbXV0 YXRpb24tZXZlbnQtZGlzcGF0Y2guaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0 L2RvbS9IVE1MSW1hZ2VFbGVtZW50L2NvbnN0cnVjdG9yLW11dGF0aW9uLWV2ZW50LWRpc3BhdGNo Lmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2RvbS9IVE1MSW1hZ2VFbGVt ZW50L2NvbnN0cnVjdG9yLW11dGF0aW9uLWV2ZW50LWRpc3BhdGNoLmh0bWwJKHJldmlzaW9uIDAp CkBAIC0wLDAgKzEsMjUgQEAKKzxoZWFkPgorICAgIDxzY3JpcHQ+CisgICAgICAgIGZ1bmN0aW9u IGxpc3RlbihldmVudCkKKyAgICAgICAgeworICAgICAgICB9CisgICAgICAgIAorICAgICAgICBm dW5jdGlvbiB0ZXN0KCkKKyAgICAgICAgeworICAgICAgICAgICAgaWYgKHdpbmRvdy5sYXlvdXRU ZXN0Q29udHJvbGxlcikKKyAgICAgICAgICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1w QXNUZXh0KCk7CisKKyAgICAgICAgICAgIGRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTVN1 YnRyZWVNb2RpZmllZCIsIGxpc3RlbiwgdHJ1ZSk7CisgICAgICAgICAgICBuZXcgSW1hZ2UoMSwg MSk7CisgICAgICAgIH0KKyAgICA8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5IG9ubG9hZD0idGVz dCgpIj4KKyAgICA8cD4KKyAgICAgICAgVGVzdCBmb3IgPGk+PGEgaHJlZj0iaHR0cDovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTIzNTMiPmh0dHA6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTEyMzUzPC9hPgorICAgICAgICBSRUdSRVNTSU9OOiBDcmFzaCBvbiBs b2FkIChtdXRhdGlvbiBldmVudCBkaXNwYXRjaCB1bmRlciB0aGUgaW1hZ2UgZWxlbWVudCBjb25z dHJ1Y3RvciBkZWxldGVzIHRoZSBlbGVtZW50KTwvaT4uICAgIAorICAgIDwvcD4KKyAgICA8cD4K KyAgICAgICAgTm8gY3Jhc2ggbWVhbnMgdGVzdCBQQVNTLgorICAgIDwvcD4KKzwvYm9keT4KSW5k ZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9nCShy ZXZpc2lvbiAxOTAwNykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0x LDMgKzEsMTYgQEAKKzIwMDctMDEtMjEgIE1pdHogUGV0dGVsICA8bWl0ekB3ZWJraXQub3JnPgor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4IGh0 dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyMzUzCisgICAgICAgICAgUkVH UkVTU0lPTjogQ3Jhc2ggb24gbG9hZCAobXV0YXRpb24gZXZlbnQgZGlzcGF0Y2ggdW5kZXIgdGhl IGltYWdlIGVsZW1lbnQgY29uc3RydWN0b3IgZGVsZXRlcyB0aGUgZWxlbWVudCkKKworICAgICAg ICBUZXN0OiBmYXN0L2RvbS9IVE1MSW1hZ2VFbGVtZW50L2NvbnN0cnVjdG9yLW11dGF0aW9uLWV2 ZW50LWRpc3BhdGNoLmh0bWwKKworICAgICAgICAqIGJpbmRpbmdzL2pzL2tqc19odG1sLmNwcDoK KyAgICAgICAgKEtKUzo6SW1hZ2VDb25zdHJ1Y3RvckltcDo6Y29uc3RydWN0KTogUHJvdGVjdCB0 aGUgaW1hZ2UgZWxlbWVudCBiZWZvcmUgc2V0dGluZworICAgICAgICBpdHMgYXR0cmlidXRlcy4K KwogMjAwNy0wMS0yMSAgRGF2aWQgS2lsemVyICA8ZGRraWx6ZXJAd2Via2l0Lm9yZz4KIAogICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKG5vLXN2ZyBidWlsZCBmaXgpLgpJbmRleDogV2ViQ29y ZS9iaW5kaW5ncy9qcy9ranNfaHRtbC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9iaW5kaW5n cy9qcy9ranNfaHRtbC5jcHAJKHJldmlzaW9uIDE5MDA2KQorKysgV2ViQ29yZS9iaW5kaW5ncy9q cy9ranNfaHRtbC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE3MjIsMTQgKzE3MjIsMTUgQEAgSlNP YmplY3QqIEltYWdlQ29uc3RydWN0b3JJbXA6OmNvbnN0cnVjdAogICAgICAgICBoZWlnaHQgPSBo LT50b0ludDMyKGV4ZWMpOwogICAgIH0KICAgICAgICAgCi0gICAgSFRNTEltYWdlRWxlbWVudCog cmVzdWx0ID0gbmV3IEhUTUxJbWFnZUVsZW1lbnQobV9kb2MuZ2V0KCkpOworICAgIEhUTUxJbWFn ZUVsZW1lbnQqIGltYWdlID0gbmV3IEhUTUxJbWFnZUVsZW1lbnQobV9kb2MuZ2V0KCkpOworICAg IEpTT2JqZWN0KiByZXN1bHQgPSBzdGF0aWNfY2FzdDxKU09iamVjdCo+KHRvSlMoZXhlYywgaW1h Z2UpKTsKICAgICAKICAgICBpZiAod2lkdGhTZXQpCi0gICAgICAgIHJlc3VsdC0+c2V0V2lkdGgo d2lkdGgpOworICAgICAgICBpbWFnZS0+c2V0V2lkdGgod2lkdGgpOwogICAgIGlmIChoZWlnaHRT ZXQpCi0gICAgICAgIHJlc3VsdC0+c2V0SGVpZ2h0KGhlaWdodCk7CisgICAgICAgIGltYWdlLT5z ZXRIZWlnaHQoaGVpZ2h0KTsKICAgICAKLSAgICByZXR1cm4gc3RhdGljX2Nhc3Q8SlNPYmplY3Qq Pih0b0pTKGV4ZWMsIHJlc3VsdCkpOworICAgIHJldHVybiByZXN1bHQ7CiB9CiAKIC8vLy8vLy8v Ly8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8K 12587 2007-01-21 12:18:50 -0800 2007-01-21 12:18:50 -0800 Another reduction (will crash) bug-12353-test.html text/html 236 ddkilzer PFNDUklQVCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgp2YXIgeHBhdGhfcXVlcnkgPSAiLy9kaXZb QGNsYXNzPSdkYXknXS9kaXZbQGNsYXNzPSdib2R5J10vZGl2W0BjbGFzcz0nc2VjdGlvbiddIjsK dmFyIG5vZGVzID0gZG9jdW1lbnQuZXZhbHVhdGUoeHBhdGhfcXVlcnksIGRvY3VtZW50LCBudWxs LCBYUGF0aFJlc3VsdC5BTllfVFlQRSwgbnVsbCk7IAp2YXIgaTI9bmV3IEltYWdlKDEsMSk7Cjwv U0NSSVBUPgo=