144371 2015-04-28 19:31:20 -0700 Reproducible crash removing name attribute from <img> node 2015-05-01 18:30:51 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Mac OS X 10.10 RESOLVED FIXED InRadar P2 Normal --- 1 neilj kling cmarcelo commit-queue esprehn+autocc kangil.han oldest_to_newest 1089850 0 251916 neilj 2015-04-28 19:31:20 -0700 Created attachment 251916 Minimal test case to crash Safari Steps to reproduce (or see attached minimal test case): 1. Create a document using document.implementation.createHTMLDocument('') 2. Add an image node to this document with both a name and an id attribute. 3. Attempt to remove the name attribute from the image node. Expected result: The name attribute is removed. Safari does not crash. Actual result: Safari crashes. This reproduces in the latest stable Safari (8.0.5) on both OS X and iOS. 1089894 1 ap 2015-04-28 22:29:40 -0700 Thank you, nice test case! rdar://problem/17198583 1090955 2 252190 kling 2015-05-01 16:23:35 -0700 Created attachment 252190 Patch 1091020 3 252190 commit-queue 2015-05-01 18:30:47 -0700 Comment on attachment 252190 Patch Clearing flags on attachment: 252190 Committed r183706: <http://trac.webkit.org/changeset/183706> 1091021 4 commit-queue 2015-05-01 18:30:51 -0700 All reviewed patches have been landed. Closing bug. 251916 2015-04-28 19:31:20 -0700 2015-04-28 19:31:20 -0700 Minimal test case to crash Safari Test Case.html text/html 271 neilj PCFET0NUWVBFIGh0bWw+CjxoZWFkPjx0aXRsZT5XZWJLaXQgQ3Jhc2g8L3RpdGxlPjwvaGVhZD4K PGJvZHk+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4KdmFyIGRvYyA9IGRvY3VtZW50 LmltcGxlbWVudGF0aW9uLmNyZWF0ZUhUTUxEb2N1bWVudCggJycgKTsKZG9jLmJvZHkuaW5uZXJI VE1MID0gJzxpbWcgbmFtZT0iYmFyIiBpZD0iZm9vIj4nOwpkb2MuYm9keS5maXJzdENoaWxkLnJl bW92ZUF0dHJpYnV0ZSggJ25hbWUnICk7Cjwvc2NyaXB0Pgo8L2JvZHk+Cg== 252190 2015-05-01 16:23:35 -0700 2015-05-01 18:30:47 -0700 Patch bug-144371.diff text/plain 7109 kling ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCA2NzVhYzYxLi5kY2VlMzQyIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTUtMDUt MDEgIEFuZHJlYXMgS2xpbmcgIDxha2xpbmdAYXBwbGUuY29tPgorCisgICAgICAgIFJlcHJvZHVj aWJsZSBjcmFzaCByZW1vdmluZyBuYW1lIGF0dHJpYnV0ZSBmcm9tIDxpbWc+IG5vZGUKKyAgICAg ICAgPGh0dHBzOi8vd2Via2l0Lm9yZy9iLzE0NDM3MT4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVt LzE3MTk4NTgzPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgICogZmFzdC9kb20vSFRNTEltYWdlRWxlbWVudC9yZW1vdmUtbmFtZS1pZC1hdHRyaWJ1dGUt ZnJvbS1pbWFnZS1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvZG9tL0hUTUxJ bWFnZUVsZW1lbnQvcmVtb3ZlLW5hbWUtaWQtYXR0cmlidXRlLWZyb20taW1hZ2UuaHRtbDogQWRk ZWQuCisKIDIwMTUtMDQtMzAgIEphdmllciBGZXJuYW5kZXogIDxqZmVybmFuZGV6QGlnYWxpYS5j b20+CiAKICAgICAgICAgW0NTUyBHcmlkIExheW91dF0gb3ZlcmZsb3ctcG9zaXRpb24ga2V5d29y ZCBmb3IgYWxpZ24gYW5kIGp1c3RpZnkgcHJvcGVydGllcy4KZGlmZiAtLWdpdCBhL0xheW91dFRl c3RzL2Zhc3QvZG9tL0hUTUxJbWFnZUVsZW1lbnQvcmVtb3ZlLW5hbWUtaWQtYXR0cmlidXRlLWZy b20taW1hZ2UtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9kb20vSFRNTEltYWdlRWxl bWVudC9yZW1vdmUtbmFtZS1pZC1hdHRyaWJ1dGUtZnJvbS1pbWFnZS1leHBlY3RlZC50eHQKbmV3 IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uODBmZGI2MgotLS0gL2Rldi9udWxsCisr KyBiL0xheW91dFRlc3RzL2Zhc3QvZG9tL0hUTUxJbWFnZUVsZW1lbnQvcmVtb3ZlLW5hbWUtaWQt YXR0cmlidXRlLWZyb20taW1hZ2UtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMTQgQEAKK1RoaXMg dGVzdCBjaGVja3MgdGhhdCB0aGVyZSdzIG5vIGNyYXNoIHdoZW4gcmVtb3ZpbmcgdGhlIG5hbWUg b3IgaWQgYXR0cmlidXRlIGZyb20gYSBIVE1MSW1hZ2VFbGVtZW50LgorCitPbiBzdWNjZXNzLCB5 b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVT VCBDT01QTEVURSIuCisKKworUEFTUyBkb2MuYm9keS5maXJzdENoaWxkLmdldEF0dHJpYnV0ZSgn bmFtZScpIGlzICdiYXInCitQQVNTIGRvYy5ib2R5LmZpcnN0Q2hpbGQuZ2V0QXR0cmlidXRlKCdp ZCcpIGlzICdmb28nCitSZW1vdmluZyBuYW1lIGFuZCBpZCBhdHRyaWJ1dGVzLi4uCitQQVNTIGRv Yy5ib2R5LmZpcnN0Q2hpbGQuZ2V0QXR0cmlidXRlKCduYW1lJykgaXMgbnVsbAorUEFTUyBkb2Mu Ym9keS5maXJzdENoaWxkLmdldEF0dHJpYnV0ZSgnaWQnKSBpcyBudWxsCitQQVNTIHN1Y2Nlc3Nm dWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0 VGVzdHMvZmFzdC9kb20vSFRNTEltYWdlRWxlbWVudC9yZW1vdmUtbmFtZS1pZC1hdHRyaWJ1dGUt ZnJvbS1pbWFnZS5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9kb20vSFRNTEltYWdlRWxlbWVudC9y ZW1vdmUtbmFtZS1pZC1hdHRyaWJ1dGUtZnJvbS1pbWFnZS5odG1sCm5ldyBmaWxlIG1vZGUgMTAw NjQ0CmluZGV4IDAwMDAwMDAuLjRiYmRiZDYKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0 cy9mYXN0L2RvbS9IVE1MSW1hZ2VFbGVtZW50L3JlbW92ZS1uYW1lLWlkLWF0dHJpYnV0ZS1mcm9t LWltYWdlLmh0bWwKQEAgLTAsMCArMSwyNSBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxo ZWFkPgorPG1ldGEgY2hhcnNldD0idXRmLTgiPgorPHNjcmlwdCBzcmM9Ii4uLy4uLy4uL3Jlc291 cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxzY3JpcHQ+ CisKK2Rlc2NyaXB0aW9uKCJUaGlzIHRlc3QgY2hlY2tzIHRoYXQgdGhlcmUncyBubyBjcmFzaCB3 aGVuIHJlbW92aW5nIHRoZSBuYW1lIG9yIGlkIGF0dHJpYnV0ZSBmcm9tIGEgSFRNTEltYWdlRWxl bWVudC4iKTsKKwordmFyIGRvYyA9IGRvY3VtZW50LmltcGxlbWVudGF0aW9uLmNyZWF0ZUhUTUxE b2N1bWVudCggJycgKTsKK2RvYy5ib2R5LmlubmVySFRNTCA9ICc8aW1nIG5hbWU9ImJhciIgaWQ9 ImZvbyI+JzsKK3Nob3VsZEJlKCJkb2MuYm9keS5maXJzdENoaWxkLmdldEF0dHJpYnV0ZSgnbmFt ZScpIiwgIidiYXInIik7CitzaG91bGRCZSgiZG9jLmJvZHkuZmlyc3RDaGlsZC5nZXRBdHRyaWJ1 dGUoJ2lkJykiLCAiJ2ZvbyciKTsKK2RlYnVnKCJSZW1vdmluZyBuYW1lIGFuZCBpZCBhdHRyaWJ1 dGVzLi4uIik7Citkb2MuYm9keS5maXJzdENoaWxkLnJlbW92ZUF0dHJpYnV0ZSgibmFtZSIpOwor ZG9jLmJvZHkuZmlyc3RDaGlsZC5yZW1vdmVBdHRyaWJ1dGUoImlkIik7CitzaG91bGRCZSgiZG9j LmJvZHkuZmlyc3RDaGlsZC5nZXRBdHRyaWJ1dGUoJ25hbWUnKSIsICJudWxsIik7CitzaG91bGRC ZSgiZG9jLmJvZHkuZmlyc3RDaGlsZC5nZXRBdHRyaWJ1dGUoJ2lkJykiLCAibnVsbCIpOworCis8 L3NjcmlwdD4KKzxzY3JpcHQgc3JjPSIuLi8uLi8uLi9yZXNvdXJjZXMvanMtdGVzdC1wb3N0Lmpz Ij48L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3Jl L0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCAyZTQxMTY3Li45ZGMz YWFlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dl YkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjQgQEAKKzIwMTUtMDQtMzAgIEFuZHJlYXMgS2xp bmcgIDxha2xpbmdAYXBwbGUuY29tPgorCisgICAgICAgIFJlcHJvZHVjaWJsZSBjcmFzaCByZW1v dmluZyBuYW1lIGF0dHJpYnV0ZSBmcm9tIDxpbWc+IG5vZGUKKyAgICAgICAgPGh0dHBzOi8vd2Vi a2l0Lm9yZy9iLzE0NDM3MT4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzE3MTk4NTgzPgorCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBwcm9ibGVt IGhlcmUgd2FzIHdpdGggSFRNTEltYWdlRWxlbWVudDo6Z2V0TmFtZUF0dHJpYnV0ZSgpLCB3aGlj aCByZWxpZXMKKyAgICAgICAgb24gRWxlbWVudDo6aGFzTmFtZSgpIHRvIGF2b2lkIHNsb3cgYXR0 cmlidXRlIGxvb2t1cHMgd2hlbiB0aGUgYXR0cmlidXRlCisgICAgICAgIGlzIGFscmVhZHkga25v d24gbm90IHRvIGJlIHByZXNlbnQuIFVuZm9ydHVuYXRlbHkgaGFzTmFtZSgpIHVzZXMgYW4gRWxl bWVudERhdGEKKyAgICAgICAgZmxhZyB0aGF0IHdhc24ndCBnZXR0aW5nIHVwZGF0ZWQgdW50aWwg YWZ0ZXIgdGhlIGNhbGwgdG8gcGFyc2VBdHRyaWJ1dGUoKS4KKworICAgICAgICBUaGlzIHBhdGNo IGZpeGVzIHRoZSBpc3N1ZSBieSBtb3ZpbmcgdGhlIGNvZGUgdGhhdCB1cGRhdGVzIHRoZSBoYXNO YW1lKCkgZmxhZworICAgICAgICBiZWZvcmUgdGhlIHBhcnNlQXR0cmlidXRlKCkgdmlydHVhbCBk aXNwYXRjaC4KKworICAgICAgICBUZXN0OiBmYXN0L2RvbS9IVE1MSW1hZ2VFbGVtZW50L3JlbW92 ZS1uYW1lLWlkLWF0dHJpYnV0ZS1mcm9tLWltYWdlLmh0bWwKKworICAgICAgICAqIGRvbS9FbGVt ZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkVsZW1lbnQ6OmF0dHJpYnV0ZUNoYW5nZWQpOgor CiAyMDE1LTA0LTMwICBKYXZpZXIgRmVybmFuZGV6ICA8amZlcm5hbmRlekBpZ2FsaWEuY29tPgog CiAgICAgICAgIFtDU1MgR3JpZCBMYXlvdXRdIG92ZXJmbG93LXBvc2l0aW9uIGtleXdvcmQgZm9y IGFsaWduIGFuZCBqdXN0aWZ5IHByb3BlcnRpZXMuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y ZS9kb20vRWxlbWVudC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5jcHAKaW5kZXgg ZDRkODQxNy4uM2Q4ODhiMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvZG9tL0VsZW1lbnQu Y3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2RvbS9FbGVtZW50LmNwcApAQCAtMTIxNiwzNiArMTIx Niw0MCBAQCBzdGF0aWMgYm9vbCBjaGVja05lZWRzU3R5bGVJbnZhbGlkYXRpb25Gb3JJZENoYW5n ZShjb25zdCBBdG9taWNTdHJpbmcmIG9sZElkLCBjbwogCiB2b2lkIEVsZW1lbnQ6OmF0dHJpYnV0 ZUNoYW5nZWQoY29uc3QgUXVhbGlmaWVkTmFtZSYgbmFtZSwgY29uc3QgQXRvbWljU3RyaW5nJiBv bGRWYWx1ZSwgY29uc3QgQXRvbWljU3RyaW5nJiBuZXdWYWx1ZSwgQXR0cmlidXRlTW9kaWZpY2F0 aW9uUmVhc29uKQogewotICAgIHBhcnNlQXR0cmlidXRlKG5hbWUsIG5ld1ZhbHVlKTsKLQotICAg IGRvY3VtZW50KCkuaW5jRE9NVHJlZVZlcnNpb24oKTsKLQotICAgIGlmIChvbGRWYWx1ZSA9PSBu ZXdWYWx1ZSkKLSAgICAgICAgcmV0dXJuOworICAgIGJvb2wgdmFsdWVJc1NhbWVBc0JlZm9yZSA9 IG9sZFZhbHVlID09IG5ld1ZhbHVlOwogCiAgICAgU3R5bGVSZXNvbHZlciogc3R5bGVSZXNvbHZl ciA9IGRvY3VtZW50KCkuc3R5bGVSZXNvbHZlcklmRXhpc3RzKCk7CiAgICAgYm9vbCB0ZXN0U2hv dWxkSW52YWxpZGF0ZVN0eWxlID0gaW5SZW5kZXJlZERvY3VtZW50KCkgJiYgc3R5bGVSZXNvbHZl ciAmJiBzdHlsZUNoYW5nZVR5cGUoKSA8IEZ1bGxTdHlsZUNoYW5nZTsKKwogICAgIGJvb2wgc2hv dWxkSW52YWxpZGF0ZVN0eWxlID0gZmFsc2U7CiAKLSAgICBpZiAobmFtZSA9PSBIVE1MTmFtZXM6 OmlkQXR0cikgewotICAgICAgICBpZiAoIW9sZFZhbHVlLmlzRW1wdHkoKSkKLSAgICAgICAgICAg IHRyZWVTY29wZSgpLmlkVGFyZ2V0T2JzZXJ2ZXJSZWdpc3RyeSgpLm5vdGlmeU9ic2VydmVycygq b2xkVmFsdWUuaW1wbCgpKTsKLSAgICAgICAgaWYgKCFuZXdWYWx1ZS5pc0VtcHR5KCkpCi0gICAg ICAgICAgICB0cmVlU2NvcGUoKS5pZFRhcmdldE9ic2VydmVyUmVnaXN0cnkoKS5ub3RpZnlPYnNl cnZlcnMoKm5ld1ZhbHVlLmltcGwoKSk7Ci0KLSAgICAgICAgQXRvbWljU3RyaW5nIG9sZElkID0g ZWxlbWVudERhdGEoKS0+aWRGb3JTdHlsZVJlc29sdXRpb24oKTsKLSAgICAgICAgQXRvbWljU3Ry aW5nIG5ld0lkID0gbWFrZUlkRm9yU3R5bGVSZXNvbHV0aW9uKG5ld1ZhbHVlLCBkb2N1bWVudCgp LmluUXVpcmtzTW9kZSgpKTsKLSAgICAgICAgaWYgKG5ld0lkICE9IG9sZElkKSB7Ci0gICAgICAg ICAgICBlbGVtZW50RGF0YSgpLT5zZXRJZEZvclN0eWxlUmVzb2x1dGlvbihuZXdJZCk7Ci0gICAg ICAgICAgICBzaG91bGRJbnZhbGlkYXRlU3R5bGUgPSB0ZXN0U2hvdWxkSW52YWxpZGF0ZVN0eWxl ICYmIGNoZWNrTmVlZHNTdHlsZUludmFsaWRhdGlvbkZvcklkQ2hhbmdlKG9sZElkLCBuZXdJZCwg c3R5bGVSZXNvbHZlcik7Ci0gICAgICAgIH0KLSAgICB9IGVsc2UgaWYgKG5hbWUgPT0gY2xhc3NB dHRyKQotICAgICAgICBjbGFzc0F0dHJpYnV0ZUNoYW5nZWQobmV3VmFsdWUpOwotICAgIGVsc2Ug aWYgKG5hbWUgPT0gSFRNTE5hbWVzOjpuYW1lQXR0cikKLSAgICAgICAgZWxlbWVudERhdGEoKS0+ c2V0SGFzTmFtZUF0dHJpYnV0ZSghbmV3VmFsdWUuaXNOdWxsKCkpOwotICAgIGVsc2UgaWYgKG5h bWUgPT0gSFRNTE5hbWVzOjpwc2V1ZG9BdHRyKQotICAgICAgICBzaG91bGRJbnZhbGlkYXRlU3R5 bGUgfD0gdGVzdFNob3VsZEludmFsaWRhdGVTdHlsZSAmJiBpc0luU2hhZG93VHJlZSgpOworICAg IGlmICghdmFsdWVJc1NhbWVBc0JlZm9yZSkgeworICAgICAgICBpZiAobmFtZSA9PSBIVE1MTmFt ZXM6OmlkQXR0cikgeworICAgICAgICAgICAgaWYgKCFvbGRWYWx1ZS5pc0VtcHR5KCkpCisgICAg ICAgICAgICAgICAgdHJlZVNjb3BlKCkuaWRUYXJnZXRPYnNlcnZlclJlZ2lzdHJ5KCkubm90aWZ5 T2JzZXJ2ZXJzKCpvbGRWYWx1ZS5pbXBsKCkpOworICAgICAgICAgICAgaWYgKCFuZXdWYWx1ZS5p c0VtcHR5KCkpCisgICAgICAgICAgICAgICAgdHJlZVNjb3BlKCkuaWRUYXJnZXRPYnNlcnZlclJl Z2lzdHJ5KCkubm90aWZ5T2JzZXJ2ZXJzKCpuZXdWYWx1ZS5pbXBsKCkpOworCisgICAgICAgICAg ICBBdG9taWNTdHJpbmcgb2xkSWQgPSBlbGVtZW50RGF0YSgpLT5pZEZvclN0eWxlUmVzb2x1dGlv bigpOworICAgICAgICAgICAgQXRvbWljU3RyaW5nIG5ld0lkID0gbWFrZUlkRm9yU3R5bGVSZXNv bHV0aW9uKG5ld1ZhbHVlLCBkb2N1bWVudCgpLmluUXVpcmtzTW9kZSgpKTsKKyAgICAgICAgICAg IGlmIChuZXdJZCAhPSBvbGRJZCkgeworICAgICAgICAgICAgICAgIGVsZW1lbnREYXRhKCktPnNl dElkRm9yU3R5bGVSZXNvbHV0aW9uKG5ld0lkKTsKKyAgICAgICAgICAgICAgICBzaG91bGRJbnZh bGlkYXRlU3R5bGUgPSB0ZXN0U2hvdWxkSW52YWxpZGF0ZVN0eWxlICYmIGNoZWNrTmVlZHNTdHls ZUludmFsaWRhdGlvbkZvcklkQ2hhbmdlKG9sZElkLCBuZXdJZCwgc3R5bGVSZXNvbHZlcik7Cisg ICAgICAgICAgICB9CisgICAgICAgIH0gZWxzZSBpZiAobmFtZSA9PSBjbGFzc0F0dHIpCisgICAg ICAgICAgICBjbGFzc0F0dHJpYnV0ZUNoYW5nZWQobmV3VmFsdWUpOworICAgICAgICBlbHNlIGlm IChuYW1lID09IEhUTUxOYW1lczo6bmFtZUF0dHIpCisgICAgICAgICAgICBlbGVtZW50RGF0YSgp LT5zZXRIYXNOYW1lQXR0cmlidXRlKCFuZXdWYWx1ZS5pc051bGwoKSk7CisgICAgICAgIGVsc2Ug aWYgKG5hbWUgPT0gSFRNTE5hbWVzOjpwc2V1ZG9BdHRyKQorICAgICAgICAgICAgc2hvdWxkSW52 YWxpZGF0ZVN0eWxlIHw9IHRlc3RTaG91bGRJbnZhbGlkYXRlU3R5bGUgJiYgaXNJblNoYWRvd1Ry ZWUoKTsKKyAgICB9CisKKyAgICBwYXJzZUF0dHJpYnV0ZShuYW1lLCBuZXdWYWx1ZSk7CiAKKyAg ICBkb2N1bWVudCgpLmluY0RPTVRyZWVWZXJzaW9uKCk7CisKKyAgICBpZiAodmFsdWVJc1NhbWVB c0JlZm9yZSkKKyAgICAgICAgcmV0dXJuOwogCiAgICAgaW52YWxpZGF0ZU5vZGVMaXN0QW5kQ29s bGVjdGlvbkNhY2hlc0luQW5jZXN0b3JzKCZuYW1lLCB0aGlzKTsKIAo=