13416 2007-04-20 03:17:56 -0700 Repro crash after referencing the user stylesheet from JavaScript 2007-04-21 01:31:44 -0700 1 1 1 Unclassified WebKit CSS 523.x (Safari 3) Mac OS X 10.4 RESOLVED FIXED HasReduction P1 Major --- 1 mitz webkit-unassigned oldest_to_newest 13843 0 mitz 2007-04-20 03:17:56 -0700 Referencing the user stylesheet from JavaScript can lead to a browser crash. To reproduce the crash: 1) Download the attached stylesheet. 2) In Safari Preferences > Advanced > Style Sheet, choose the stylesheet you downloaded in step 1). 3) Open the attached reduction. Patch forthcoming. 13844 1 14104 mitz 2007-04-20 03:18:45 -0700 Created attachment 14104 User stylesheet for reproducing 13845 2 14105 mitz 2007-04-20 03:19:23 -0700 Created attachment 14105 HTML for reproducing (will crash when the user stylesheet is set) 13846 3 14106 mitz 2007-04-20 03:20:10 -0700 Created attachment 14106 Change m_userSheet into a RefPtr 13773 4 14106 darin 2007-04-20 08:05:18 -0700 Comment on attachment 14106 Change m_userSheet into a RefPtr r=me 13642 5 mrowe 2007-04-21 01:31:44 -0700 Landed in r20992. 14104 2007-04-20 03:18:45 -0700 2007-04-20 03:18:45 -0700 User stylesheet for reproducing Bug 13416 stylesheet.css text/css 24 mitz ZGl2IHsgZGlzcGxheTogYmxvY2s7IH0K 14105 2007-04-20 03:19:23 -0700 2007-04-20 03:19:23 -0700 HTML for reproducing (will crash when the user stylesheet is set) Bug 13416 reduction.html text/html 364 mitz PGh0bWw+CjxoZWFkPgogICAgPHRpdGxlPjwvdGl0bGU+CiAgICA8c2NyaXB0PgogICAgICAgIGZ1 bmN0aW9uIHRlc3QoKQogICAgICAgIHsKICAgICAgICAgICAgdmFyIG1hdGNoZWRTdHlsZVJ1bGVz ID0gZ2V0TWF0Y2hlZENTU1J1bGVzKGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJ0IiksICIiLCBm YWxzZSk7CiAgICAgICAgICAgIHZhciBwYXJlbnQgPSBtYXRjaGVkU3R5bGVSdWxlc1sxXS5wYXJl bnRTdHlsZVNoZWV0OwogICAgICAgICAgICB3aW5kb3cuY2xvc2UoKTsKICAgICAgICB9CiAgICA8 L3NjcmlwdD4KPC9oZWFkPgo8Ym9keSBvbmxvYWQ9InRlc3QoKSI+CiAgICA8ZGl2IGlkPSJ0Ij48 L2Rpdj4KPC9ib2R5Pgo8L2h0bWw+Cg== 14106 2007-04-20 03:20:10 -0700 2007-04-20 08:05:18 -0700 Change m_userSheet into a RefPtr 13416_r1.patch text/plain 2365 mitz SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMDk3MSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTcgQEAKKzIwMDctMDQtMjAgIE1pdHogUGV0dGVsICA8bWl0ekB3ZWJraXQub3Jn PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4 IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzNDE2CisgICAgICAgICAg UmVwcm8gY3Jhc2ggYWZ0ZXIgcmVmZXJlbmNpbmcgdGhlIHVzZXIgc3R5bGVzaGVldCBmcm9tIEph dmFTY3JpcHQKKworICAgICAgICBObyB0ZXN0IGluY2x1ZGVkIGJlY2F1c2UgRHVtcFJlbmRlclRy ZWUgZG9lcyBub3Qgc3VwcG9ydCBzZXR0aW5nIHRoZSB1c2VyIHN0eWxlc2hlZXQuCisKKyAgICAg ICAgKiBjc3MvY3Nzc3R5bGVzZWxlY3Rvci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpDU1NTdHls ZVNlbGVjdG9yOjpDU1NTdHlsZVNlbGVjdG9yKToKKyAgICAgICAgKFdlYkNvcmU6OkNTU1N0eWxl U2VsZWN0b3I6On5DU1NTdHlsZVNlbGVjdG9yKToKKyAgICAgICAgKiBjc3MvY3Nzc3R5bGVzZWxl Y3Rvci5oOiBNYWRlIG1fdXNlclNoZWV0IGEgUmVmUHRyLgorCiAyMDA3LTA0LTE5ICBBbHAgVG9r ZXIgIDxhbHBAYXRva2VyLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBNYXJrLgpJbmRleDog V2ViQ29yZS9jc3MvY3Nzc3R5bGVzZWxlY3Rvci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9j c3MvY3Nzc3R5bGVzZWxlY3Rvci5jcHAJKHJldmlzaW9uIDIwOTY3KQorKysgV2ViQ29yZS9jc3Mv Y3Nzc3R5bGVzZWxlY3Rvci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTIzMCw3ICsyMzAsNiBAQCBD U1NTdHlsZVNlbGVjdG9yOjpDU1NTdHlsZVNlbGVjdG9yKERvY3VtCiAgICAgICAgIGxvYWREZWZh dWx0U3R5bGUoKTsKIAogICAgIG1fdXNlclN0eWxlID0gMDsKLSAgICBtX3VzZXJTaGVldCA9IDA7 CiAKICAgICAvLyBjb25zdHJ1Y3QgZG9jdW1lbnQgcm9vdCBlbGVtZW50IGRlZmF1bHQgc3R5bGUu IHRoaXMgaXMgbmVlZGVkCiAgICAgLy8gdG8gZXZhbHVhdGUgbWVkaWEgcXVlcmllcyB0aGF0IGNv bnRhaW4gcmVsYXRpdmUgY29uc3RyYWludHMsIGxpa2UgInNjcmVlbiBhbmQgKG1heC13aWR0aDog MTBlbSkiCkBAIC0yNTksNyArMjU4LDcgQEAgQ1NTU3R5bGVTZWxlY3Rvcjo6Q1NTU3R5bGVTZWxl Y3RvcihEb2N1bQogICAgICAgICBtX3VzZXJTaGVldC0+cGFyc2VTdHJpbmcodXNlclN0eWxlU2hl ZXQsIHN0cmljdFBhcnNpbmcpOwogCiAgICAgICAgIG1fdXNlclN0eWxlID0gbmV3IENTU1J1bGVT ZXQoKTsKLSAgICAgICAgbV91c2VyU3R5bGUtPmFkZFJ1bGVzRnJvbVNoZWV0KG1fdXNlclNoZWV0 LCBtX21lZGl1bSk7CisgICAgICAgIG1fdXNlclN0eWxlLT5hZGRSdWxlc0Zyb21TaGVldChtX3Vz ZXJTaGVldC5nZXQoKSwgbV9tZWRpdW0pOwogICAgIH0KIAogICAgIC8vIGFkZCBzdHlsZXNoZWV0 cyBmcm9tIGRvY3VtZW50CkBAIC0zMzQsNyArMzMzLDYgQEAgQ1NTU3R5bGVTZWxlY3Rvcjo6fkNT U1N0eWxlU2VsZWN0b3IoKQogCiAgICAgZGVsZXRlIG1fYXV0aG9yU3R5bGU7CiAgICAgZGVsZXRl IG1fdXNlclN0eWxlOwotICAgIGRlbGV0ZSBtX3VzZXJTaGVldDsKIH0KIAogc3RhdGljIENTU1N0 eWxlU2hlZXQqIHBhcnNlVUFTaGVldChjb25zdCBjaGFyKiBjaGFyYWN0ZXJzLCB1bnNpZ25lZCBz aXplKQpJbmRleDogV2ViQ29yZS9jc3MvY3Nzc3R5bGVzZWxlY3Rvci5oCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFdlYkNvcmUvY3NzL2Nzc3N0eWxlc2VsZWN0b3IuaAkocmV2aXNpb24gMjA5NjcpCisrKyBXZWJD b3JlL2Nzcy9jc3NzdHlsZXNlbGVjdG9yLmgJKHdvcmtpbmcgY29weSkKQEAgLTE3MSw3ICsxNzEs NyBAQCBjbGFzcyBTdHlsZWRFbGVtZW50OwogCiAgICAgICAgIENTU1J1bGVTZXQqIG1fYXV0aG9y U3R5bGU7CiAgICAgICAgIENTU1J1bGVTZXQqIG1fdXNlclN0eWxlOwotICAgICAgICBDU1NTdHls ZVNoZWV0KiBtX3VzZXJTaGVldDsKKyAgICAgICAgUmVmUHRyPENTU1N0eWxlU2hlZXQ+IG1fdXNl clNoZWV0OwogICAgICAgICAKICAgICAgICAgYm9vbCBtX2hhc1VBQXBwZWFyYW5jZTsKICAgICAg ICAgQm9yZGVyRGF0YSBtX2JvcmRlckRhdGE7Cg==