19515 2008-06-12 04:16:15 -0700 DOM modification causes stack exhaustion (Caused by colGroup?) 2008-06-20 16:46:04 -0700 1 1 1 Unclassified WebKit New Bugs 525.x (Safari 3.1) PC Windows Vista RESOLVED DUPLICATE 19519 http://skypher.com/SkyLined/Repro/Safari/Stack%20exhaustion%20colGroup/repro.html InRadar, PlatformOnly P1 Normal --- 1 skylined webkit-unassigned aroben mitz oldest_to_newest 83100 0 skylined 2008-06-12 04:16:15 -0700 I found that the following javascript causes a stack exhaustion: <BODY onload="go()"><SCRIPT> var i=0; function go() { oColGroup=document.createElement('colGroup'); document.body.appendChild(oColGroup); oComment=document.createElement('b'); document.body.insertAdjacentElement('afterBegin', oComment); } </SCRIPT></BODY> Something tells me the colGroup is the culprit, but I have no way of backing that up. Tested with Safari 3.1.1. Marked as security, I'm not sure if you treat DoS as a security issue, so erring on the safe side. 83197 1 skylined 2008-06-13 06:29:07 -0700 Changing priority and security flag 83260 2 mrowe 2008-06-13 14:52:34 -0700 <rdar://problem/6007110> 83322 3 aroben 2008-06-14 08:51:20 -0700 Why is this bug marked PlatformOnly? 84015 4 kmccullough 2008-06-20 16:12:42 -0700 *** This bug has been marked as a duplicate of 19519 ***