21044 2008-09-23 16:22:46 -0700 JSEventTarget* classes assume each listener is a JSEventListener 2009-07-05 15:00:07 -0700 1 1 1 Unclassified WebKit WebCore JavaScript 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED InRadar, NeedsReduction P1 Normal --- 1 zimmermann webkit-unassigned ap eric sam oldest_to_newest 92423 0 zimmermann 2008-09-23 16:22:46 -0700 As the summary, says JSEventTargetNode::getListener function blindly casts an EventListener object to a JSEventListener. This will fail if ie. it's actually an ObjCEventListener. The getListener/setListener functions of the JSEventTarget* classes are only used when calling someElement.onclick = '...' or someElement.onclick.handleEvent(..). The official DOM methods are not affected. 92424 1 eric 2008-09-23 16:26:56 -0700 This would lead to a crash, so it should be a P1. Any application which registers Obj-C listeners as well as allows pages to run JavaScript would be vulnerable to such a crash. 92427 2 mrowe 2008-09-23 16:32:42 -0700 <rdar://problem/6241522> 105291 3 desamo 2009-01-11 19:02:56 -0800 A test case would be helpful. 129884 4 sam 2009-07-05 15:00:07 -0700 This is no longer a problem. We now check that it is a JSEventListener before use.