19516 2008-06-12 04:21:55 -0700 DOM modification causes Access Violation (NULL pointer?) 2008-08-29 01:29:36 -0700 1 1 1 Unclassified WebKit New Bugs 525.x (Safari 3.1) PC Windows Vista RESOLVED FIXED http://skypher.com/SkyLined/Repro/Safari/6f164b90%20NULL%203C/repro.html InRadar P1 Normal --- 1 skylined webkit-unassigned oldest_to_newest 83101 0 skylined 2008-06-12 04:21:55 -0700 I found that the following javascript causes an Access Violation. This appears to be a NULL pointer: <BODY onload="go()"><SCRIPT> function go() { var oEmbed=document.createElement('embed'); document.body.appendChild(oEmbed); var oEmbed2 = oEmbed.cloneNode(); oEmbed2.appendChild(document.body.parentElement); var oA = document.createElement('a'); document.title = ''; oA.innerHTML = '<x><html></html>'; } </SCRIPT></BODY> Tested with Safari 3.1.1. Marked as security, I'm not sure if you treat DoS as a security issue, so erring on the safe side. 83198 1 skylined 2008-06-13 06:29:15 -0700 Changing priority and security flag 83261 2 mrowe 2008-06-13 14:52:38 -0700 <rdar://problem/6007111> 84424 3 andersca 2008-06-25 10:31:53 -0700 Thank you very much for the reduced test case! Committed revision 34795. 89644 4 skylined 2008-08-28 09:10:25 -0700 This appears fixed in nightly until you drag and drop the repro URL into Safari twice: (4a8.13c): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. WebKit!WebCore::DragController::concludeDrag+0x3a: 00000000`6ccf0cda 8b03 mov eax,dword ptr [ebx] ds:002b:00000000`00000000=???????? This exact same problem can be triggered with bug 20540 89730 5 skylined 2008-08-29 01:29:36 -0700 I opened bug 20565 to track this new issue.