32426 2009-12-11 05:06:09 -0800 Crash in WebCore::HTMLParser::createHead 2011-09-27 10:17:18 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) All All RESOLVED FIXED http://skypher.com/SkyLined/Repro/WebKit/Bug%2032426%20-%20WebCore..HTMLParser..createHead%20ReadAV@NULL%20(e76af51d00030543044208d8a1070244)/repro.html P1 Normal --- 1 skylined jchaffraix ap eric jchaffraix webkit.review.bot oldest_to_newest 170707 0 44677 skylined 2009-12-11 05:06:09 -0800 Created attachment 44677 Repro Id: WebCore::HTMLParser::createHead ReadAV@NULL (e76af51d00030543044208d8a1070244) Description: Attempt to read from NULL pointer in WebCore::HTMLParser::createHead Stack: WebCore::HTMLParser::createHead WebCore::HTMLParser::handleError WebCore::HTMLParser::insertNode WebCore::HTMLParser::insertNodeAfterLimitBlockDepth WebCore::HTMLParser::parseToken WebCore::HTMLTokenizer::processToken WebCore::HTMLTokenizer::parseTag WebCore::HTMLTokenizer::write WebCore::parseHTMLDocumentFragment WebCore::HTMLElement::insertAdjacentHTML WebCore::HTMLElementInternal::insertAdjacentHTMLCallback v8::internal::Builtin_HandleApiCall v8::internal::Invoke v8::internal::Execution::Call v8::Script::Run WebCore::V8Proxy::runScript WebCore::V8Proxy::evaluate WebCore::ScriptController::evaluate WebCore::ScriptController::executeScript WebCore::ScriptController::executeScript WebCore::ScriptController::executeIfJavaScriptURL WebCore::FrameLoader::changeLocation WebCore::RedirectScheduler::timerFired WebCore::Timer<...>::fired WebCore::ThreadTimers::sharedTimerFiredInternal MessageLoop::RunTask MessageLoop::DoWork base::MessagePumpDefault::Run MessageLoop::RunInternal MessageLoop::Run RendererMain ChromeMain Repro: <BODY onload=go();></BODY> <SCRIPT> function go() { document.open(); new Image().insertAdjacentHTML(0,"<x<meta>"); } </SCRIPT> 170716 1 skylined 2009-12-11 05:30:36 -0800 Online repro 170821 2 ap 2009-12-11 10:28:05 -0800 Confirmed with r51997. Fails an assertion in HTMLParser::createHead(): if (!m_document->documentElement()) { insertNode(new HTMLHtmlElement(htmlTag, m_document)); ASSERT(m_document->documentElement()); } 286836 3 skylined 2010-09-29 06:49:44 -0700 No longer reproduces - assuming fixed. 287742 4 ap 2010-09-30 12:42:29 -0700 This doesn't seem to have been fixed intentionally, let's land the test case. 473416 5 jchaffraix 2011-09-26 15:00:36 -0700 Will land the test soon as there is no need to keep this bug opened. 473475 6 108742 jchaffraix 2011-09-26 15:45:43 -0700 Created attachment 108742 Land the tweaked test case. 474033 7 108742 webkit.review.bot 2011-09-27 10:17:13 -0700 Comment on attachment 108742 Land the tweaked test case. Clearing flags on attachment: 108742 Committed r96124: <http://trac.webkit.org/changeset/96124> 474034 8 webkit.review.bot 2011-09-27 10:17:18 -0700 All reviewed patches have been landed. Closing bug. 44677 2009-12-11 05:06:09 -0800 2009-12-11 05:06:09 -0800 Repro repro.html text/html 138 skylined PEJPRFkgb25sb2FkPWdvKCk7PjwvQk9EWT4KPFNDUklQVD4KICBmdW5jdGlvbiBnbygpIHsKICAg IGRvY3VtZW50Lm9wZW4oKTsKICAgIG5ldyBJbWFnZSgpLmluc2VydEFkamFjZW50SFRNTCgwLCI8 eDxtZXRhPiIpOwogIH0KPC9TQ1JJUFQ+ 108742 2011-09-26 15:45:43 -0700 2011-09-27 10:17:13 -0700 Land the tweaked test case. bug-32426-20110926154541.patch text/plain 2161 jchaffraix U3VidmVyc2lvbiBSZXZpc2lvbjogOTYwMTAKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCA4MTkyZTlmZTljM2E0ZWU5NmY3OTdk YTg2Mzk0YzQxYmFjZThjNzBhLi44YzEyMTVmNzk3OTc5NjIwNzBjYTdmYjZlNWMzZTY2ZjA4OGRj M2UzIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTEtMDktMjYgIEp1bGllbiBDaGFmZnJhaXgg IDxqY2hhZmZyYWl4QHdlYmtpdC5vcmc+CisKKyAgICAgICAgQ3Jhc2ggaW4gV2ViQ29yZTo6SFRN TFBhcnNlcjo6Y3JlYXRlSGVhZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MzI0MjYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICBUaGUgY3Jhc2ggd2FzIGZpeGVkIHNvbWUgdGltZSBhZ28gYnV0IHRoZSB0ZXN0 IHdhcyBub3QgbGFuZGVkIHdoaWNoIGtlcHQgdGhlIGJ1ZyBvcGVuLgorCisgICAgICAgICogZmFz dC9wYXJzZXIvY3Jhc2gtSFRNTFBhcnNlci1jcmVhdGVIZWFkLmh0bWw6IEFkZGVkLgorICAgICAg ICBUd2Vha2VkIHRoZSB0ZXN0IGNhc2UgYXMgd2Ugbm93IHRocm93IGFuIGV4Y2VwdGlvbiAoRE9N IEV4Y2VwdGlvbiAxMikuCisKIDIwMTEtMDktMjYgIE1paGFpIFBhcnBhcml0YSAgPG1paGFpcEBj aHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmVtb3ZlIHRlc3QgdGhhdCBubyBsb25nZXIgY3Jhc2hl cyAoZml4ZWQgYnkgcjk1OTg1KS4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvcGFyc2Vy L2NyYXNoLUhUTUxQYXJzZXItY3JlYXRlSGVhZC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9m YXN0L3BhcnNlci9jcmFzaC1IVE1MUGFyc2VyLWNyZWF0ZUhlYWQtZXhwZWN0ZWQudHh0Cm5ldyBm aWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAuLjhmODdlZWU2YjljMDZmOTE4NzE4ZTYwMDYyNWI2YmQxNTNkMmVmODYKLS0tIC9kZXYv bnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L3BhcnNlci9jcmFzaC1IVE1MUGFyc2VyLWNyZWF0 ZUhlYWQtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMyBAQAorVGVzdCBmb3IgYnVnIDMyNDI2OiBD cmFzaCBpbiBXZWJDb3JlOjpIVE1MUGFyc2VyOjpjcmVhdGVIZWFkCisKK1RoaXMgdGVzdCBQQVNT RUQgYXMgaXQgZGlkIG5vdCBDUkFTSCBub3IgQVNTRVJURUQuCmRpZmYgLS1naXQgYS9MYXlvdXRU ZXN0cy9mYXN0L3BhcnNlci9jcmFzaC1IVE1MUGFyc2VyLWNyZWF0ZUhlYWQuaHRtbCBiL0xheW91 dFRlc3RzL2Zhc3QvcGFyc2VyL2NyYXNoLUhUTUxQYXJzZXItY3JlYXRlSGVhZC5odG1sCm5ldyBm aWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAuLmQ2Zjc0MDdiYWFlZTIxMTZiOGY5YmNlMWU2ZjZlNWZmYjdmZDE0ZTQKLS0tIC9kZXYv bnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L3BhcnNlci9jcmFzaC1IVE1MUGFyc2VyLWNyZWF0 ZUhlYWQuaHRtbApAQCAtMCwwICsxLDE1IEBACis8Ym9keSBvbmxvYWQ9Z28oKTs+PC9ib2R5Pgor PHNjcmlwdD4KKyAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgICAgICBs YXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7CisKKyAgICBmdW5jdGlvbiBnbygpIHsK KyAgICAgICAgZG9jdW1lbnQub3BlbigpOworICAgICAgICB0cnkgeworICAgICAgICAgICAgbmV3 IEltYWdlKCkuaW5zZXJ0QWRqYWNlbnRIVE1MKDAsIjx4PG1ldGE+Iik7CisgICAgICAgIH0gY2F0 Y2ggKGUpIHsKKyAgICAgICAgfQorICAgICAgICBkb2N1bWVudC53cml0ZSgnPHA+VGVzdCBmb3Ig YnVnIDxhIGhyZWY9Imh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zMjQy NiI+MzI0MjY8L2E+OiBDcmFzaCBpbiBXZWJDb3JlOjpIVE1MUGFyc2VyOjpjcmVhdGVIZWFkPC9w PicpOworICAgICAgICBkb2N1bWVudC53cml0ZSgnPHA+VGhpcyB0ZXN0IFBBU1NFRCBhcyBpdCBk aWQgbm90IENSQVNIIG5vciBBU1NFUlRFRC48L3A+Jyk7CisgICAgfQorPC9zY3JpcHQ+Cg==