17655 2008-03-03 14:58:59 -0800 Reproducible crash calling querySelector on viewless Document 2008-05-20 12:18:01 -0700 1 1 1 Unclassified WebKit WebCore JavaScript 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED InRadar P1 Normal --- 1 mrowe webkit-unassigned alex catfish.man jresig mitz oldest_to_newest 72617 0 mrowe 2008-03-03 14:58:59 -0800 After fixing the main crash reported on bug 17313, the original test case still crashes. This is because a document is created via DOMParser.parseFromString and is then queried with querySelectorAll. As the document is not attached to any view it has no style selector, which leads to a null dereference. Top of backtrace is as follows: Exception Type: EXC_BAD_ACCESS (SIGBUS) Exception Codes: KERN_PROTECTION_FAILURE at 0x00000000000000e8 Crashed Thread: 0 Thread 0 Crashed: 0 com.apple.WebCore 0x00e3745a WebCore::CSSStyleSelector::initElementAndPseudoState(WebCore::Element*) + 26 (CSSStyleSelector.cpp:535) 1 com.apple.WebCore 0x011192be WebCore::Node::querySelector(WebCore::String const&, int&) + 542 (Node.cpp:1225) 2 com.apple.WebCore 0x01036aee WebCore::jsDocumentPrototypeFunctionQuerySelector(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 142 (PassRefPtr.h:49) 3 com.apple.JavaScriptCore 0x00487228 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 696 (object.cpp:99) 72619 1 19504 mrowe 2008-03-03 15:04:22 -0800 Created attachment 19504 Reduction (will crash Release builds of TOT) 72621 2 mrowe 2008-03-03 15:06:59 -0800 <rdar://problem/5778077> 81014 3 mitz 2008-05-20 12:18:01 -0700 Fixed in <http://trac.webkit.org/changeset/33939>. 19504 2008-03-03 15:04:22 -0800 2008-03-03 15:04:22 -0800 Reduction (will crash Release builds of TOT) bug-17655-reduction.html text/html 191 mrowe PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgogICAgdmFyIG5ld0RvY3VtZW50ID0gKG5l dyBET01QYXJzZXIoKSkucGFyc2VGcm9tU3RyaW5nKCc8b3V0Pjxpbj50ZXh0PC9pbj48L291dD4n LCAndGV4dC94bWwnKTsKICAgIHZhciBub2RlID0gbmV3RG9jdW1lbnQucXVlcnlTZWxlY3Rvcign b3V0IGluJyk7Cjwvc2NyaXB0Pgo=