19519 2008-06-12 08:19:10 -0700 DOM modification causes stack exhaustion (BUTTON OBJECT COLGROUP) 2008-06-20 16:12:42 -0700 1 1 1 Unclassified WebKit Layout and Rendering 525.x (Safari 3.1) All All RESOLVED FIXED http://skypher.com/SkyLined/Repro/Safari/Stack%20exhaustion%20BUTTON%20OBJECT%20COLGROUP/repro.html InRadar P1 Normal --- 1 skylined mitz ap oldest_to_newest 83110 0 skylined 2008-06-12 08:19:10 -0700 I found that the following javascript causes a stack exhaustion: <BODY onload="go()"><SCRIPT> function go() { oButton=document.createElement('button'); document.body.appendChild(oButton); oButton.outerHTML=''; oButton.innerHTML='<object>x<colGroup></colGroup></object>'; document.body.insertAdjacentElement('beforeBegin', oButton); } </SCRIPT></BODY> Tested with Safari 3.1.1. Marked as security, I'm not sure if you treat DoS as a security issue, so erring on the safe side. Stack exhaustion appears to be in WebKit!JSValueMakeNull. This may be the same bug as 19514 and/or 19515 83146 1 ap 2008-06-12 21:17:57 -0700 We don't treat denial of service attacks as security issues (unless the bugs are exploitable for remote code execution), but reproducible crashes are P1. On a local debug build, I'm hitting an assertion: ASSERTION FAILED: beforeChild->parent()->isAnonymousBlock() 0 com.apple.WebCore 0x02b4b35d WebCore::RenderBlock::addChildToFlow(WebCore::RenderObject*, WebCore::RenderObject*) + 297 (RenderBlock.cpp:162) See also: bug 19220. 83277 2 mrowe 2008-06-13 15:54:08 -0700 <rdar://problem/6007345> 83985 3 mitz 2008-06-20 12:16:15 -0700 Fixed in <http://trac.webkit.org/changeset/34692>. 84016 4 kmccullough 2008-06-20 16:12:42 -0700 *** Bug 19515 has been marked as a duplicate of this bug. ***