17543 2008-02-25 17:21:06 -0800 FixedTableLayout::layout() corrupts the heap 2008-03-03 11:55:49 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) All OS X 10.5 RESOLVED FIXED http://bt.ktxp.com/ InRadar P1 Normal --- 1 ovafai webkit-unassigned bdakin koivisto oldest_to_newest 71946 0 ovafai 2008-02-25 17:21:06 -0800 If a table is fixed layout and and it's children are set to display:none, corrupts the heap (FixedTableLayout.cpp:288). 71947 1 19363 ovafai 2008-02-25 17:22:06 -0800 Created attachment 19363 Corrupts heap. Hits assert in debug mode. 71948 2 mjs 2008-02-25 17:24:04 -0800 Heap corruption is a potential security issue but not flagging as such since we don't have an exploit. 71958 3 mrowe 2008-02-25 18:12:51 -0800 <rdar://problem/5764927> 72587 4 hyatt 2008-03-03 11:55:49 -0800 Fixed in r30716. 19363 2008-02-25 17:22:06 -0800 2008-02-25 17:22:06 -0800 Corrupts heap. Hits assert in debug mode. test.html text/html 197 ovafai PGh0bWw+Cjxib2R5PgogIDx0YWJsZSBzdHlsZT0idGFibGUtbGF5b3V0OmZpeGVkO3dpZHRoOjEw MCUiPgogICAgPHRib2R5IGlkPSJmb28iPjwvdGJvZHk+CiAgPC90YWJsZT4KICA8c2NyaXB0Pgog ICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2ZvbycpLnN0eWxlLmRpc3BsYXk9J25vbmUnOwog IDwvc2NyaXB0Pgo8L2h0bWw+CjwvYm9keT4=