<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>36017</bug_id>
          
          <creation_ts>2010-03-11 08:34:22 -0800</creation_ts>
          <short_desc>REGRESSION (r53857): Crash when tabbing to &lt;map&gt;</short_desc>
          <delta_ts>2010-03-16 17:10:43 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore Misc.</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.6</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://www.register.prometric.com/Login.asp</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar, NeedsReduction, Regression</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Matt Lilek">dev+webkit</reporter>
          <assigned_to name="chris fleizach">cfleizach</assigned_to>
          <cc>ap</cc>
    
    <cc>cfleizach</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>198643</commentid>
    <comment_count>0</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2010-03-11 08:34:22 -0800</bug_when>
    <thetext>Go to &lt;http://www.register.prometric.com/Login.asp&gt; and press tab -&gt; *BOOM*.  This happens regardless of whether Safari is set to tab to individual elements or not.  Tested in r55841 on Snow Leopard.

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000010169e1d0 WebCore::RenderObject::document() const + 16 (RenderObject.h:426)
1   com.apple.WebCore             	0x00000001012771e1 WebCore::HTMLMapElement::imageElement() const + 29 (HTMLMapElement.cpp:82)
2   com.apple.WebCore             	0x0000000101236018 WebCore::HTMLAreaElement::updateFocusAppearance(bool) + 86 (HTMLAreaElement.cpp:214)
3   com.apple.WebCore             	0x000000010115bcef WebCore::Element::focus(bool) + 323 (Element.cpp:1323)
4   com.apple.WebCore             	0x0000000101188110 WebCore::FocusController::advanceFocusInDocumentOrder(WebCore::FocusDirection, WebCore::KeyboardEvent*, bool) + 1592 (FocusController.cpp:283)
5   com.apple.WebCore             	0x000000010118840a WebCore::FocusController::advanceFocus(WebCore::FocusDirection, WebCore::KeyboardEvent*, bool) + 68 (FocusController.cpp:167)
6   com.apple.WebCore             	0x0000000101163f88 WebCore::EventHandler::defaultTabEventHandler(WebCore::KeyboardEvent*) + 204 (EventHandler.cpp:2550)
7   com.apple.WebCore             	0x000000010116ce71 WebCore::EventHandler::defaultKeyboardEventHandler(WebCore::KeyboardEvent*) + 155 (EventHandler.cpp:2176)
8   com.apple.WebCore             	0x00000001015f8448 WebCore::Node::defaultEventHandler(WebCore::Event*) + 212 (Node.cpp:2951)
9   com.apple.WebCore             	0x00000001015f918b WebCore::Node::dispatchGenericEvent(WTF::PassRefPtr&lt;WebCore::Event&gt;) + 1645 (Node.cpp:2681)
10  com.apple.WebCore             	0x00000001015f9409 WebCore::Node::dispatchEvent(WTF::PassRefPtr&lt;WebCore::Event&gt;) + 149 (Node.cpp:2567)
11  com.apple.WebCore             	0x000000010117681c WebCore::EventTarget::dispatchEvent(WTF::PassRefPtr&lt;WebCore::Event&gt;, int&amp;) + 178 (EventTarget.cpp:254)
12  com.apple.WebCore             	0x0000000101164f2a WebCore::EventHandler::keyEvent(WebCore::PlatformKeyboardEvent const&amp;) + 906 (EventHandler.cpp:2112)
13  com.apple.WebCore             	0x00000001011712a9 WebCore::EventHandler::keyEvent(NSEvent*) + 181 (EventHandlerMac.mm:150)
14  com.apple.WebKit              	0x000000010037fbd9 -[WebHTMLView keyDown:] + 430 (WebHTMLView.mm:4006)
15  com.apple.AppKit              	0x00007fff84fb93af -[NSWindow sendEvent:] + 8769
16  com.apple.Safari              	0x0000000100049117 0x100000000 + 299287
17  com.apple.AppKit              	0x00007fff84eede22 -[NSApplication sendEvent:] + 4719
18  com.apple.Safari              	0x0000000100031c10 0x100000000 + 203792
19  com.apple.AppKit              	0x00007fff84e84796 -[NSApplication run] + 474
20  com.apple.AppKit              	0x00007fff84e7d468 NSApplicationMain + 364
21  com.apple.Safari              	0x0000000100001a28 0x100000000 + 6696</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>199300</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-03-12 21:47:20 -0800</bug_when>
    <thetext>Tabbing inside an element that doesn&apos;t have a renderer.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>199301</commentid>
    <comment_count>2</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-03-12 21:47:56 -0800</bug_when>
    <thetext>&lt;rdar://problem/7750748&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>200457</commentid>
    <comment_count>3</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-03-16 15:01:45 -0700</bug_when>
    <thetext>&lt;http://trac.webkit.org/changeset/53857&gt;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>200500</commentid>
    <comment_count>4</comment_count>
      <attachid>50851</attachid>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2010-03-16 16:27:42 -0700</bug_when>
    <thetext>Created attachment 50851
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>200512</commentid>
    <comment_count>5</comment_count>
      <attachid>50851</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-03-16 16:52:14 -0700</bug_when>
    <thetext>Comment on attachment 50851
patch

&gt; +On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
&gt; +
&gt; +
&gt; +PASS document.activeElement.id is &apos;area1&apos;
&gt; +

There is no TEST COMPLETE in expected results. I don&apos;t see why.

Ideally, a test provides instructions for running it manually if eventSender is needed, but not available.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>200513</commentid>
    <comment_count>6</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2010-03-16 16:53:07 -0700</bug_when>
    <thetext>how do i add a test complete with the layout tests?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>200516</commentid>
    <comment_count>7</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-03-16 17:01:31 -0700</bug_when>
    <thetext>It&apos;s supposed to be added by this line:

+&lt;script src=&quot;../fast/js/resources/js-test-post.js&quot;&gt;&lt;/script&gt;

Something went wrong with it - probably something simple, but I don&apos;t see the problem.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>200519</commentid>
    <comment_count>8</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2010-03-16 17:06:02 -0700</bug_when>
    <thetext>looks like i&apos;m including the wrong path</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>200523</commentid>
    <comment_count>9</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2010-03-16 17:10:43 -0700</bug_when>
    <thetext>http://trac.webkit.org/changeset/56094</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>50851</attachid>
            <date>2010-03-16 16:27:42 -0700</date>
            <delta_ts>2010-03-16 17:07:47 -0700</delta_ts>
            <desc>patch</desc>
            <filename>patch.txt</filename>
            <type>text/plain</type>
            <size>3722</size>
            <attacher name="chris fleizach">cfleizach</attacher>
            
              <data encoding="base64">SW5kZXg6IExheW91dFRlc3RzL2Zhc3QvZXZlbnRzL2ltYWdlbWFwLW5vcmVuZGVyLWNyYXNoLWV4
cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2V2ZW50cy9pbWFnZW1h
cC1ub3JlbmRlci1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0
cy9mYXN0L2V2ZW50cy9pbWFnZW1hcC1ub3JlbmRlci1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlz
aW9uIDApCkBAIC0wLDAgKzEsMTAgQEAKK3N0YXJ0IGVsZW1lbnQKKworCitUaGlzIHRlc3RzIHRh
YmJpbmcgdG8gYW4gaW1hZ2UgbWFwIGxpbmsgd2hlcmUgdGhlIG1hcCBtaWdodCBub3QgaGF2ZSBh
IHJlbmRlcmVyIHdvbid0IGNyYXNoLgorCitPbiBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJp
ZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKwor
UEFTUyBkb2N1bWVudC5hY3RpdmVFbGVtZW50LmlkIGlzICdhcmVhMScKKwpJbmRleDogTGF5b3V0
VGVzdHMvZmFzdC9ldmVudHMvaW1hZ2VtYXAtbm9yZW5kZXItY3Jhc2guaHRtbAo9PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2V2ZW50cy9pbWFnZW1hcC1ub3JlbmRlci1jcmFzaC5odG1s
CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9ldmVudHMvaW1hZ2VtYXAtbm9yZW5k
ZXItY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwzNCBAQAorPCFET0NUWVBFIEhU
TUwgUFVCTElDICItLy9JRVRGLy9EVEQgSFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4KKzxsaW5r
IHJlbD0ic3R5bGVzaGVldCIgaHJlZj0iLi4vanMvcmVzb3VyY2VzL2pzLXRlc3Qtc3R5bGUuY3Nz
Ij4KKzxzY3JpcHQ+Cit2YXIgc3VjY2Vzc2Z1bGx5UGFyc2VkID0gZmFsc2U7Cis8L3NjcmlwdD4K
KzxzY3JpcHQgc3JjPSIuLi9qcy9yZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0Pgor
PGJvZHkgaWQ9ImJvZHkiPgorCis8aDEgaWQ9ImhlYWRlciIgdGFiaW5kZXg9MD5zdGFydCBlbGVt
ZW50PC9oMT4KKzxkaXY+PGltZyBzcmM9InJlc291cmNlcy9hYmUucG5nIiBhbHQ9InRlc3QiIHN0
eWxlPSJ3aWR0aDo2NzlweDsgaGVpZ2h0OjExMnB4IiB1c2VtYXA9IiNNYXAiPjwvZGl2PgorPGRp
diBzdHlsZT0iZGlzcGxheTpub25lIj48bWFwIG5hbWU9Ik1hcCIgaWQ9Ik1hcCI+PGFyZWEgc2hh
cGU9InJlY3QiIGNvb3Jkcz1jb29yZHM9IjUsNDgsMjQ3LDk3IiBocmVmPSJodHRwOi8vd3d3Lndl
YmtpdC5vcmcvIiB0YXJnZXQ9Il9ibGFuayIgaWQ9ImFyZWExIi8+PC9tYXA+PC9kaXY+CisKKzxw
IGlkPSJkZXNjcmlwdGlvbiI+PC9wPgorPGRpdiBpZD0iY29uc29sZSI+PC9kaXY+CisKKzxzY3Jp
cHQ+CisKKyAgICBkZXNjcmlwdGlvbigiVGhpcyB0ZXN0cyB0YWJiaW5nIHRvIGFuIGltYWdlIG1h
cCBsaW5rIHdoZXJlIHRoZSBtYXAgbWlnaHQgbm90IGhhdmUgYSByZW5kZXJlciB3b24ndCBjcmFz
aC4iKTsKKworICAgIC8vIHN0YXJ0IGF0IHRoZSByaWdodCBwbGFjZQorICAgIGRvY3VtZW50Lmdl
dEVsZW1lbnRCeUlkKCJoZWFkZXIiKS5mb2N1cygpOworCisgICAgLy8gdGFiIGZvcndhcmQKKyAg
ICBldmVudFNlbmRlci5rZXlEb3duKCdcdCcpOworICAgIHNob3VsZEJlKCJkb2N1bWVudC5hY3Rp
dmVFbGVtZW50LmlkIiwgIidhcmVhMSciKTsKKworICAgIHN1Y2Nlc3NmdWxseVBhcnNlZCA9IHRy
dWU7Cis8L3NjcmlwdD4KKworPHNjcmlwdCBzcmM9Ii4uL2Zhc3QvanMvcmVzb3VyY2VzL2pzLXRl
c3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CkluZGV4OiBXZWJDb3JlL2h0
bWwvSFRNTE1hcEVsZW1lbnQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvaHRtbC9IVE1MTWFw
RWxlbWVudC5jcHAJKHJldmlzaW9uIDU2MDkwKQorKysgV2ViQ29yZS9odG1sL0hUTUxNYXBFbGVt
ZW50LmNwcAkod29ya2luZyBjb3B5KQpAQCAtNzksNyArNzksNyBAQAogCiBIVE1MSW1hZ2VFbGVt
ZW50KiBIVE1MTWFwRWxlbWVudDo6aW1hZ2VFbGVtZW50KCkgY29uc3QKIHsKLSAgICBSZWZQdHI8
SFRNTENvbGxlY3Rpb24+IGNvbGwgPSByZW5kZXJlcigpLT5kb2N1bWVudCgpLT5pbWFnZXMoKTsK
KyAgICBSZWZQdHI8SFRNTENvbGxlY3Rpb24+IGNvbGwgPSBkb2N1bWVudCgpLT5pbWFnZXMoKTsK
ICAgICBmb3IgKE5vZGUqIGN1cnIgPSBjb2xsLT5maXJzdEl0ZW0oKTsgY3VycjsgY3VyciA9IGNv
bGwtPm5leHRJdGVtKCkpIHsKICAgICAgICAgaWYgKCFjdXJyLT5oYXNUYWdOYW1lKGltZ1RhZykp
CiAgICAgICAgICAgICBjb250aW51ZTsKSW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9nCShyZXZpc2lvbiA1NjA5MikKKysrIFdlYkNvcmUvQ2hh
bmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTAtMDMtMTYgIENocmlz
IEZsZWl6YWNoICA8Y2ZsZWl6YWNoQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBO
T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBSRUdSRVNTSU9OIChyNTM4NTcpOiBDcmFzaCB3aGVu
IHRhYmJpbmcgdG8gPG1hcD4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i
dWcuY2dpP2lkPTM2MDE3CisKKyAgICAgICAgVGVzdDogZmFzdC9ldmVudHMvaW1hZ2VtYXAtbm9y
ZW5kZXItY3Jhc2guaHRtbAorCisgICAgICAgICogaHRtbC9IVE1MTWFwRWxlbWVudC5jcHA6Cisg
ICAgICAgIChXZWJDb3JlOjpIVE1MTWFwRWxlbWVudDo6aW1hZ2VFbGVtZW50KToKKwogMjAxMC0w
My0xNiAgQnJlbnQgRnVsZ2hhbSAgPGJmdWxnaGFtQHdlYmtpdC5vcmc+CiAKICAgICAgICAgQnVp
bGQgZml4LiAgTm8gUmV2aWV3LgpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gNTYwOTIpCisrKyBMYXlvdXRU
ZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxMyBAQAorMjAxMC0wMy0x
NiAgQ2hyaXMgRmxlaXphY2ggIDxjZmxlaXphY2hAYXBwbGUuY29tPgorCisgICAgICAgIFJldmll
d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJFR1JFU1NJT04gKHI1Mzg1Nyk6IENy
YXNoIHdoZW4gdGFiYmluZyB0byA8bWFwPgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y
Zy9zaG93X2J1Zy5jZ2k/aWQ9MzYwMTcKKworICAgICAgICAqIGZhc3QvZXZlbnRzL2ltYWdlbWFw
LW5vcmVuZGVyLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9ldmVu
dHMvaW1hZ2VtYXAtbm9yZW5kZXItY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMTAtMDMtMTUgIE9q
YW4gVmFmYWkgIDxvamFuQGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBBbGV4
ZXkgUHJvc2t1cnlha292Lgo=
</data>
<flag name="review"
          id="34022"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>