19517 2008-06-12 04:24:58 -0700 DOM modification of textArea causes Access Violation (NULL pointer?) 2009-05-21 05:35:18 -0700 1 1 1 Unclassified WebKit DOM 525.x (Safari 3.1) All All RESOLVED FIXED http://skypher.com/SkyLined/Repro/Safari/019a3239%20NULL/repro.html InRadar P1 Normal --- 1 skylined ap oldest_to_newest 83103 0 skylined 2008-06-12 04:24:58 -0700 I found that the following javascript causes an Access Violation. This appears to be a NULL pointer: <BODY onload="go()"><SCRIPT> function go() { document.body.parentElement.removeChild(document.body); o = document.createElement("textArea"); o.innerHTML='<b><menu><link></b><head></head>x'; } </SCRIPT></BODY> Tested with Safari 3.1.1. Marked as security, I'm not sure if you treat DoS as a security issue, so erring on the safe side. 83199 1 skylined 2008-06-13 06:29:21 -0700 Changing priority and security flag 83262 2 mrowe 2008-06-13 14:52:41 -0700 <rdar://problem/6007112> 122078 3 arvind.mookhaiyapillai 2009-05-19 23:13:13 -0700 Hi, I am trying to analyse this bug.But when I open the safari window in debug mode I am not able to reproduce this scenario.Is there a solution to reproduce this scenario in debug mode as well ? 122113 4 ap 2009-05-20 03:25:37 -0700 I cannot reproduce this with nightlies either (but I can reproduce with Safari 3.2.3). 122114 5 30503 ap 2009-05-20 03:32:14 -0700 Created attachment 30503 proposed patch So, let's just add a test. 122330 6 ap 2009-05-21 05:35:18 -0700 Test committed r43966. 30503 2009-05-20 03:32:14 -0700 2009-05-20 07:47:40 -0700 proposed patch HEADCrashTest.txt text/plain 2319 ap SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDQzODk4KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMDktMDUtMjAgIEFsZXhleSBQcm9za3VyeWFr b3YgIDxhcEB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTUx NworICAgICAgICA8cmRhcjovL3Byb2JsZW0vNjAwNzExMj4gRE9NIG1vZGlmaWNhdGlvbiBvZiB0 ZXh0QXJlYSBjYXVzZXMgQWNjZXNzIFZpb2xhdGlvbiAoTlVMTCBwb2ludGVyPykKKworICAgICAg ICBUaGlzIG5vIGxvbmdlciBoYXBwZW5zIHdpdGggVG9ULCBqdXN0IGFkZGluZyBhIHRlc3QuCisK KyAgICAgICAgKiBmYXN0L3BhcnNlci9oZWFkLXBhcnNpbmctMTk1MTctZXhwZWN0ZWQudHh0OiBB ZGRlZC4KKyAgICAgICAgKiBmYXN0L3BhcnNlci9oZWFkLXBhcnNpbmctMTk1MTcuaHRtbDogQWRk ZWQuCisKIDIwMDktMDUtMjAgIEVyaWMgU2VpZGVsICA8ZXJpY0B3ZWJraXQub3JnPgogCiAgICAg ICAgIEJ1aWxkIGZpeCBvbmx5LCBubyByZXZpZXcuCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L3Bh cnNlci9oZWFkLXBhcnNpbmctMTk1MTctZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91 dFRlc3RzL2Zhc3QvcGFyc2VyL2hlYWQtcGFyc2luZy0xOTUxNy1leHBlY3RlZC50eHQJKHJldmlz aW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L3BhcnNlci9oZWFkLXBhcnNpbmctMTk1MTctZXhw ZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMgQEAKK1Rlc3QgZm9yIGJ1ZyAxOTUx NzogRE9NIG1vZGlmaWNhdGlvbiBvZiB0ZXh0QXJlYSBjYXVzZXMgQWNjZXNzIFZpb2xhdGlvbgor CitQQVNTIGlmIG5vIGNyYXNoCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0 L3BhcnNlci9oZWFkLXBhcnNpbmctMTk1MTctZXhwZWN0ZWQudHh0Cl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTmFtZTog c3ZuOm1pbWUtdHlwZQogICArIHRleHQvcGxhaW4KTmFtZTogc3ZuOmVvbC1zdHlsZQogICArIG5h dGl2ZQoKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL2hlYWQtcGFyc2luZy0xOTUxNy5o dG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL2hlYWQtcGFyc2luZy0x OTUxNy5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvaGVhZC1w YXJzaW5nLTE5NTE3Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTEgQEAKKzxCT0RZIG9u bG9hZD0iZ28oKSI+PFNDUklQVD4KKyAgICBmdW5jdGlvbiBnbygpIHsKKyAgICAgICAgaWYgKHdp bmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICAgICAgICAgIGxheW91dFRlc3RDb250cm9s bGVyLmR1bXBBc1RleHQoKTsKKyAgICAgICAgZG9jdW1lbnQuYm9keS5wYXJlbnRFbGVtZW50LnJl bW92ZUNoaWxkKGRvY3VtZW50LmJvZHkpOworICAgICAgICBvID0gZG9jdW1lbnQuY3JlYXRlRWxl bWVudCgidGV4dEFyZWEiKTsKKyAgICAgICAgby5pbm5lckhUTUw9JzxiPjxtZW51PjxsaW5rPjwv Yj48aGVhZD48L2hlYWQ+eCc7CisgICAgICAgIGRvY3VtZW50LndyaXRlKCI8cD5UZXN0IGZvciA8 YSBocmVmPSdodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk1MTcnPmJ1 ZyAxOTUxNzwvYT46IERPTSBtb2RpZmljYXRpb24gb2YgdGV4dEFyZWEgY2F1c2VzIEFjY2VzcyBW aW9sYXRpb248L3A+Iik7CisgICAgICAgIGRvY3VtZW50LndyaXRlKCI8cD5QQVNTIGlmIG5vIGNy YXNoPC9wPiIpOworICAgIH0KKzwvU0NSSVBUPjwvQk9EWT4KClByb3BlcnR5IGNoYW5nZXMgb246 IExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL2hlYWQtcGFyc2luZy0xOTUxNy5odG1sCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KTmFtZTogc3ZuOm1pbWUtdHlwZQogICArIHRleHQvaHRtbAoK