25553 2009-05-04 13:40:48 -0700 SVG path.getPresentationAttribute("") -> NULL ptr 2009-05-05 08:42:17 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) PC Windows Vista RESOLVED FIXED http://skypher.com/SkyLined/Repro/WebKit/Bug%2025553%20-%20SVG%20path.getPresentationAttribute(%22%22)%20NULL%20ptr/repro.html GoogleBug P1 Normal --- 1 skylined webkit-unassigned eric skylined oldest_to_newest 119871 0 skylined 2009-05-04 13:40:48 -0700 Bug found in latest Chrome 1.x release without symbols, so I have no stack dump or anything. It repro's reliably in latest Chrome 2.x ToT. Repro <SCRIPT> path = window.document.createElementNS("http://www.w3.org/2000/svg", "path"); path.getPresentationAttribute(""); </SCRIPT> 119872 1 skylined 2009-05-04 13:42:19 -0700 Added repro url. 119874 2 skylined 2009-05-04 13:48:09 -0700 Renaming to "SVG" 119970 3 30021 eric 2009-05-05 08:39:10 -0700 Created attachment 30021 Fix mappedAttributes() access without NULL check 6 files changed, 41 insertions(+), 0 deletions(-) 119971 4 30021 aroben 2009-05-05 08:40:05 -0700 Comment on attachment 30021 Fix mappedAttributes() access without NULL check r=me 119972 5 eric 2009-05-05 08:42:17 -0700 Thank you very much for the bug and excellent test case! Committing to http://svn.webkit.org/repository/webkit/trunk ... M LayoutTests/ChangeLog A LayoutTests/svg/custom/path-getPresentationAttribute-crash-expected.txt A LayoutTests/svg/custom/path-getPresentationAttribute-crash.html M WebCore/ChangeLog M WebCore/html/HTMLInputElement.cpp M WebCore/svg/SVGStyledElement.cpp Committed r43237 30021 2009-05-05 08:39:10 -0700 2009-05-05 08:40:05 -0700 Fix mappedAttributes() access without NULL check Fix-mappedAttributes-access-without-NULL-check.patch text/plain 3697 eric OWZmMDFhZTExNzdjZGVkZjg0ZWUxYWQzNjlhZTQyN2M3OTFlNWJmMwpkaWZmIC0tZ2l0IGEvTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGUzZjMxN2Eu LjM4OTdlMTUgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRU ZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAwOS0wNS0wNSAgRXJpYyBTZWlkZWwg IDxlcmljQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgRml4IG1hcHBlZEF0dHJpYnV0ZXMoKSBhY2Nlc3Mgd2l0aG91dCBOVUxMIGNo ZWNrCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yNTU1 MworCisgICAgICAgICogc3ZnL2N1c3RvbS9wYXRoLWdldFByZXNlbnRhdGlvbkF0dHJpYnV0ZS1j cmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIHN2Zy9jdXN0b20vcGF0aC1nZXRQ cmVzZW50YXRpb25BdHRyaWJ1dGUtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMDktMDUtMDQgIEVy aWMgU2VpZGVsICA8ZXJpY0B3ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE1hY2ll aiBTdGFjaG93aWFrLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9wYXRoLWdl dFByZXNlbnRhdGlvbkF0dHJpYnV0ZS1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9z dmcvY3VzdG9tL3BhdGgtZ2V0UHJlc2VudGF0aW9uQXR0cmlidXRlLWNyYXNoLWV4cGVjdGVkLnR4 dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi40YWMwNjRiCi0tLSAvZGV2L251 bGwKKysrIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9wYXRoLWdldFByZXNlbnRhdGlvbkF0dHJp YnV0ZS1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSBAQAorUEFTU0VEIC0tIFdlYktpdCBk aWQgbm90IGNyYXNoIQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9wYXRoLWdl dFByZXNlbnRhdGlvbkF0dHJpYnV0ZS1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3Rv bS9wYXRoLWdldFByZXNlbnRhdGlvbkF0dHJpYnV0ZS1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUg MTAwNjQ0CmluZGV4IDAwMDAwMDAuLjQ2ZjZlZDMKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRU ZXN0cy9zdmcvY3VzdG9tL3BhdGgtZ2V0UHJlc2VudGF0aW9uQXR0cmlidXRlLWNyYXNoLmh0bWwK QEAgLTAsMCArMSw4IEBACis8c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxl cikKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7CisKK3ZhciBwYXRoID0g ZG9jdW1lbnQuY3JlYXRlRWxlbWVudE5TKCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIsICJw YXRoIik7CitwYXRoLmdldFByZXNlbnRhdGlvbkF0dHJpYnV0ZSgiIik7Citkb2N1bWVudC53cml0 ZSgiUEFTU0VEIC0tIFdlYktpdCBkaWQgbm90IGNyYXNoISIpOworPC9zY3JpcHQ+CmRpZmYgLS1n aXQgYS9XZWJDb3JlL0NoYW5nZUxvZyBiL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IDgwYTJhMjYu Ljg3NjdkMmUgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1dlYkNvcmUvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMjEgQEAKKzIwMDktMDUtMDUgIEVyaWMgU2VpZGVsICA8ZXJpY0B3 ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIEZpeCBtYXBwZWRBdHRyaWJ1dGVzKCkgYWNjZXNzIHdpdGhvdXQgTlVMTCBjaGVjaworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjU1NTMKKworICAg ICAgICBTVkdTdHlsZWRFbGVtZW50OjpnZXRQcmVzZW50YXRpb25BdHRyaWJ1dGUgd2FzIHVzaW5n IG1hcHBlZEF0dHJpYnV0ZXMoKQorICAgICAgICB3aXRob3V0IGNoZWNraW5nIGZvciBOVUxMLgor CisgICAgICAgIEhUTUxJbnB1dEVsZW1lbnQ6OnNldElucHV0VHlwZSBhbHNvIGRvZXNuJ3QgTlVM TCBjaGVjaywgYnV0IEkgd2FzIG5vdAorICAgICAgICBhYmxlIHRvIGdldCBpdCB0byBjcmFzaCB3 aXRoIGEgdGVzdCBjYXNlIHNvIEkganVzdCBhZGRlZCBhbiBBU1NFUlQuCisKKyAgICAgICAgKiBo dG1sL0hUTUxJbnB1dEVsZW1lbnQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SFRNTElucHV0RWxl bWVudDo6c2V0SW5wdXRUeXBlKToKKyAgICAgICAgKiBzdmcvU1ZHU3R5bGVkRWxlbWVudC5jcHA6 CisgICAgICAgIChXZWJDb3JlOjpTVkdTdHlsZWRFbGVtZW50OjpnZXRQcmVzZW50YXRpb25BdHRy aWJ1dGUpOgorCiAyMDA5LTA1LTA1ICBIb2xnZXIgSGFucyBQZXRlciBGcmV5dGhlciAgPHplY2tl QHNlbGZpc2gub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFhhbiBMb3Blei4KZGlmZiAtLWdp dCBhL1dlYkNvcmUvaHRtbC9IVE1MSW5wdXRFbGVtZW50LmNwcCBiL1dlYkNvcmUvaHRtbC9IVE1M SW5wdXRFbGVtZW50LmNwcAppbmRleCA4ZDA0ZDZjLi4wODdlNGZhIDEwMDY0NAotLS0gYS9XZWJD b3JlL2h0bWwvSFRNTElucHV0RWxlbWVudC5jcHAKKysrIGIvV2ViQ29yZS9odG1sL0hUTUxJbnB1 dEVsZW1lbnQuY3BwCkBAIC0yNzUsNiArMjc1LDcgQEAgdm9pZCBIVE1MSW5wdXRFbGVtZW50Ojpz ZXRJbnB1dFR5cGUoY29uc3QgU3RyaW5nJiB0KQogCiAgICAgICAgICAgICBpZiAoZGlkUmVzcGVj dEhlaWdodEFuZFdpZHRoICE9IHdpbGxSZXNwZWN0SGVpZ2h0QW5kV2lkdGgpIHsKICAgICAgICAg ICAgICAgICBOYW1lZE1hcHBlZEF0dHJNYXAqIG1hcCA9IG1hcHBlZEF0dHJpYnV0ZXMoKTsKKyAg ICAgICAgICAgICAgICBBU1NFUlQobWFwKTsKICAgICAgICAgICAgICAgICBpZiAoQXR0cmlidXRl KiBoZWlnaHQgPSBtYXAtPmdldEF0dHJpYnV0ZUl0ZW0oaGVpZ2h0QXR0cikpCiAgICAgICAgICAg ICAgICAgICAgIGF0dHJpYnV0ZUNoYW5nZWQoaGVpZ2h0LCBmYWxzZSk7CiAgICAgICAgICAgICAg ICAgaWYgKEF0dHJpYnV0ZSogd2lkdGggPSBtYXAtPmdldEF0dHJpYnV0ZUl0ZW0od2lkdGhBdHRy KSkKZGlmZiAtLWdpdCBhL1dlYkNvcmUvc3ZnL1NWR1N0eWxlZEVsZW1lbnQuY3BwIGIvV2ViQ29y ZS9zdmcvU1ZHU3R5bGVkRWxlbWVudC5jcHAKaW5kZXggZTkzODgxOC4uOThiNjQ1OSAxMDA2NDQK LS0tIGEvV2ViQ29yZS9zdmcvU1ZHU3R5bGVkRWxlbWVudC5jcHAKKysrIGIvV2ViQ29yZS9zdmcv U1ZHU3R5bGVkRWxlbWVudC5jcHAKQEAgLTI0Miw2ICsyNDIsOSBAQCBQYXNzUmVmUHRyPFJlbmRl clN0eWxlPiBTVkdTdHlsZWRFbGVtZW50OjpyZXNvbHZlU3R5bGUoUmVuZGVyU3R5bGUqIHBhcmVu dFN0eWxlKQogCiBQYXNzUmVmUHRyPENTU1ZhbHVlPiBTVkdTdHlsZWRFbGVtZW50OjpnZXRQcmVz ZW50YXRpb25BdHRyaWJ1dGUoY29uc3QgU3RyaW5nJiBuYW1lKQogeworICAgIGlmICghbWFwcGVk QXR0cmlidXRlcygpKQorICAgICAgICByZXR1cm4gMDsKKwogICAgIEF0dHJpYnV0ZSogYXR0ciA9 IG1hcHBlZEF0dHJpYnV0ZXMoKS0+Z2V0QXR0cmlidXRlSXRlbShRdWFsaWZpZWROYW1lKG51bGxB dG9tLCBuYW1lLCBudWxsQXRvbSkpOwogICAgIGlmICghYXR0ciB8fCAhYXR0ci0+aXNNYXBwZWRB dHRyaWJ1dGUoKSB8fCAhYXR0ci0+c3R5bGUoKSkKICAgICAgICAgcmV0dXJuIDA7Cg==