3855 2005-07-04 17:18:22 -0700 Table with Form Field and Hidden DIV crashes Safari 2007-02-06 03:45:08 -0800 1 1 1 Unclassified WebKit Forms 420+ Mac OS X 10.4 RESOLVED FIXED http://www.pmachine.com/forums/viewthread/24217/P0/ P1 Critical --- 1 bschwegler carsten kabendroth oldest_to_newest 13924 0 bschwegler 2005-07-04 17:18:22 -0700 The following code is from a test page that always will cause Safari to crash. More discussion on this can be found here: http://www.pmachine.com/forums/viewthread/24217/P0/ <html> <head> <title>test</title> </head> <body> <form> <textarea cols='30' rows='10'></textarea> <div style="display:none;"> <table> <tr> <td>test</td> </tr> </table> </div> <div><input type='text' name='bla' value='' size="33" /></div> </form> </body> </html> 13942 1 mrowe 2005-07-04 21:40:24 -0700 The report is missing a key step to reproduce: the crash only occurs after you begin typing in the bottom text entry field. This occurs with both WebKit 412 and ToT CVS. Crash log from ToT included below: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c Thread 0 Crashed: 0 com.apple.WebCore 0x011dfed4 khtml::RenderTableCell::table() const + 0 (icplusplus.c:28) 1 <<00000000>> 0xbfffe324 0 + -1073749212 2 com.apple.WebCore 0x010204b8 KWQKHTMLPart::searchForLabelsBeforeElement(NSArray*, DOM::ElementImpl*) + 204 (icplusplus.c:28) 3 com.apple.Safari 0x0009956c 0x1000 + 623980 4 com.apple.Safari 0x00098edc 0x1000 + 622300 5 com.apple.Safari 0x000958f8 0x1000 + 608504 6 com.apple.Safari 0x00095b50 0x1000 + 609104 7 com.apple.Safari 0x0004402c 0x1000 + 274476 8 com.apple.Foundation 0x92886d18 __NSFireDelayedPerform + 304 9 com.apple.CoreFoundation 0x9075deb0 __CFRunLoopDoTimer + 184 10 com.apple.CoreFoundation 0x9074a828 __CFRunLoopRun + 1680 11 com.apple.CoreFoundation 0x90749ddc CFRunLoopRunSpecific + 268 12 com.apple.HIToolbox 0x93122ca0 RunCurrentEventLoopInMode + 264 13 com.apple.HIToolbox 0x93122334 ReceiveNextEventCommon + 380 14 com.apple.HIToolbox 0x931221a0 BlockUntilNextEventMatchingListInMode + 96 15 com.apple.AppKit 0x9362b1a4 _DPSNextEvent + 384 16 com.apple.AppKit 0x9362ae68 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116 17 com.apple.Safari 0x00007058 0x1000 + 24664 18 com.apple.AppKit 0x936273cc -[NSApplication run] + 472 19 com.apple.AppKit 0x93717c1c NSApplicationMain + 452 20 com.apple.Safari 0x00002700 0x1000 + 5888 21 com.apple.Safari 0x00057190 0x1000 + 352656 13943 2 mrowe 2005-07-04 21:42:18 -0700 A easiliy accessible case for this bug is at http://pmachine.com/misc/safari_crash.html It consists of the HTML included in the initial bug report. 13945 3 2799 joost 2005-07-04 23:02:22 -0700 Created attachment 2799 minimal testcase Removing either the table or the display:none prevents the crash. 13946 4 2800 joost 2005-07-04 23:06:20 -0700 Created attachment 2800 minimal testcase This time the testcase tells hows to recreate the problem. 14159 5 2858 carsten 2005-07-07 21:34:54 -0700 Created attachment 2858 Proposed fix This patch checks for the existence of the cell renderer. 14289 6 2858 hyatt 2005-07-09 14:01:36 -0700 Comment on attachment 2858 Proposed fix The fix looks good, but this patch isn't going to merge any more after the changes from 3405. Can you make the fix again and attach a new patch? Thanks. 14295 7 2888 carsten 2005-07-09 15:50:06 -0700 Created attachment 2888 Merging patch Here you go. 14367 8 2888 joost 2005-07-11 06:09:04 -0700 Comment on attachment 2888 Merging patch Changed name of patch, since it could seem now as if you just attached the patch again... 14471 9 2888 hyatt 2005-07-12 14:35:08 -0700 Comment on attachment 2888 Merging patch r=me 14660 10 vicki 2005-07-14 11:53:16 -0700 I'll commit this 14866 11 carsten 2005-07-18 19:38:27 -0700 Closing since this has been committed. 18763 12 sullivan 2005-09-05 12:07:42 -0700 This is also in Radar as <rdar://problem/4146880> 2799 2005-07-04 23:02:22 -0700 2005-07-04 23:06:20 -0700 minimal testcase testcase-crash.html text/html 217 joost PGh0bWw+CjxoZWFkPgo8dGl0bGU+dGVzdDwvdGl0bGU+CjwvaGVhZD4KCjxib2R5PgoKPGZvcm0+ Cgo8ZGl2IHN0eWxlPSJkaXNwbGF5Om5vbmU7Ij4KPHRhYmxlPgogICAgIDx0cj4KICAgICAgICA8 dGQ+dGVzdDwvdGQ+CiAgICAgIDwvdHI+CiAgIDwvdGFibGU+CjwvZGl2PgoKPGlucHV0IHR5cGU9 J3RleHQnIHZhbHVlPScnIC8+Cgo8L2Zvcm0+CgoKPC9ib2R5Pgo8L2h0bWw+Cg== 2800 2005-07-04 23:06:20 -0700 2005-07-04 23:06:20 -0700 minimal testcase testcase-crash.html text/html 268 joost PGh0bWw+CjxoZWFkPgo8dGl0bGU+dGVzdDwvdGl0bGU+CjwvaGVhZD4KCjxib2R5PgpUeXBpbmcg aW4gdGhlIGlucHV0IGZpZWxkIGJlbG93IHdpbGwgY2F1c2UgYSBjcmFzaDoKPGZvcm0+Cgo8ZGl2 IHN0eWxlPSJkaXNwbGF5Om5vbmU7Ij4KPHRhYmxlPgogICAgIDx0cj4KICAgICAgICA8dGQ+dGVz dDwvdGQ+CiAgICAgIDwvdHI+CiAgIDwvdGFibGU+CjwvZGl2PgoKPGlucHV0IHR5cGU9J3RleHQn IHZhbHVlPScnIC8+Cgo8L2Zvcm0+CgoKPC9ib2R5Pgo8L2h0bWw+Cg== 2858 2005-07-07 21:34:54 -0700 2005-07-09 15:50:06 -0700 Proposed fix 3855.patch text/plain 2543 carsten SW5kZXg6IEtXUUtIVE1MUGFydC5tbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09ClJDUyBmaWxlOiAvY3ZzL3Jvb3QvV2Vi Q29yZS9rd3EvS1dRS0hUTUxQYXJ0Lm1tLHYKcmV0cmlldmluZyByZXZpc2lvbiAxLjY0NApkaWZm IC1wIC11IC1yMS42NDQgS1dRS0hUTUxQYXJ0Lm1tCi0tLSBLV1FLSFRNTFBhcnQubW0JMjAwNS8w Ny8wNyAwODowMzoyMgkxLjY0NAorKysgS1dRS0hUTUxQYXJ0Lm1tCTIwMDUvMDcvMDggMDQ6MzM6 MDMKQEAgLTQ4MCwyMyArNDgwLDI2IEBAIFFSZWdFeHAgKnJlZ0V4cEZvckxhYmVscyhOU0FycmF5 ICpsYWJlbHMKIE5TU3RyaW5nICpLV1FLSFRNTFBhcnQ6OnNlYXJjaEZvckxhYmVsc0Fib3ZlQ2Vs bChRUmVnRXhwICpyZWdFeHAsIEhUTUxUYWJsZUNlbGxFbGVtZW50SW1wbCAqY2VsbCkKIHsKICAg ICBSZW5kZXJUYWJsZUNlbGwgKmNlbGxSZW5kZXJlciA9IHN0YXRpY19jYXN0PFJlbmRlclRhYmxl Q2VsbCAqPihjZWxsLT5yZW5kZXJlcigpKTsKLSAgICBSZW5kZXJUYWJsZUNlbGwgKmNlbGxBYm92 ZVJlbmRlcmVyID0gY2VsbFJlbmRlcmVyLT50YWJsZSgpLT5jZWxsQWJvdmUoY2VsbFJlbmRlcmVy KTsKIAotICAgIGlmIChjZWxsQWJvdmVSZW5kZXJlcikgewotICAgICAgICBIVE1MVGFibGVDZWxs RWxlbWVudEltcGwgKmFib3ZlQ2VsbCA9Ci0gICAgICAgICAgICBzdGF0aWNfY2FzdDxIVE1MVGFi bGVDZWxsRWxlbWVudEltcGwgKj4oY2VsbEFib3ZlUmVuZGVyZXItPmVsZW1lbnQoKSk7CisgICAg aWYgKGNlbGxSZW5kZXJlcikgeworICAgICAgICBSZW5kZXJUYWJsZUNlbGwgKmNlbGxBYm92ZVJl bmRlcmVyID0gY2VsbFJlbmRlcmVyLT50YWJsZSgpLT5jZWxsQWJvdmUoY2VsbFJlbmRlcmVyKTsK IAotICAgICAgICBpZiAoYWJvdmVDZWxsKSB7Ci0gICAgICAgICAgICAvLyBzZWFyY2ggd2l0aGlu IHRoZSBhYm92ZSBjZWxsIHdlIGZvdW5kIGZvciBhIG1hdGNoCi0gICAgICAgICAgICBmb3IgKE5v ZGVJbXBsICpuID0gYWJvdmVDZWxsLT5maXJzdENoaWxkKCk7IG47IG4gPSBuLT50cmF2ZXJzZU5l eHROb2RlKGFib3ZlQ2VsbCkpIHsKLSAgICAgICAgICAgICAgICBpZiAoaWRGcm9tTm9kZShuKSA9 PSBJRF9URVhUCi0gICAgICAgICAgICAgICAgICAgICYmIG4tPnJlbmRlcmVyKCkgJiYgbi0+cmVu ZGVyZXIoKS0+c3R5bGUoKS0+dmlzaWJpbGl0eSgpID09IFZJU0lCTEUpCi0gICAgICAgICAgICAg ICAgewotICAgICAgICAgICAgICAgICAgICAvLyBGb3IgZWFjaCB0ZXh0IGNodW5rLCBydW4gdGhl IHJlZ2V4cAotICAgICAgICAgICAgICAgICAgICBRU3RyaW5nIG5vZGVTdHJpbmcgPSBuLT5ub2Rl VmFsdWUoKS5zdHJpbmcoKTsKLSAgICAgICAgICAgICAgICAgICAgaW50IHBvcyA9IHJlZ0V4cC0+ c2VhcmNoUmV2KG5vZGVTdHJpbmcpOwotICAgICAgICAgICAgICAgICAgICBpZiAocG9zID49IDAp IHsKLSAgICAgICAgICAgICAgICAgICAgICAgIHJldHVybiBub2RlU3RyaW5nLm1pZChwb3MsIHJl Z0V4cC0+bWF0Y2hlZExlbmd0aCgpKS5nZXROU1N0cmluZygpOworICAgICAgICBpZiAoY2VsbEFi b3ZlUmVuZGVyZXIpIHsKKyAgICAgICAgICAgIEhUTUxUYWJsZUNlbGxFbGVtZW50SW1wbCAqYWJv dmVDZWxsID0KKyAgICAgICAgICAgICAgICBzdGF0aWNfY2FzdDxIVE1MVGFibGVDZWxsRWxlbWVu dEltcGwgKj4oY2VsbEFib3ZlUmVuZGVyZXItPmVsZW1lbnQoKSk7CisKKyAgICAgICAgICAgIGlm IChhYm92ZUNlbGwpIHsKKyAgICAgICAgICAgICAgICAvLyBzZWFyY2ggd2l0aGluIHRoZSBhYm92 ZSBjZWxsIHdlIGZvdW5kIGZvciBhIG1hdGNoCisgICAgICAgICAgICAgICAgZm9yIChOb2RlSW1w bCAqbiA9IGFib3ZlQ2VsbC0+Zmlyc3RDaGlsZCgpOyBuOyBuID0gbi0+dHJhdmVyc2VOZXh0Tm9k ZShhYm92ZUNlbGwpKSB7CisgICAgICAgICAgICAgICAgICAgIGlmIChpZEZyb21Ob2RlKG4pID09 IElEX1RFWFQKKyAgICAgICAgICAgICAgICAgICAgICAgICYmIG4tPnJlbmRlcmVyKCkgJiYgbi0+ cmVuZGVyZXIoKS0+c3R5bGUoKS0+dmlzaWJpbGl0eSgpID09IFZJU0lCTEUpCisgICAgICAgICAg ICAgICAgICAgIHsKKyAgICAgICAgICAgICAgICAgICAgICAgIC8vIEZvciBlYWNoIHRleHQgY2h1 bmssIHJ1biB0aGUgcmVnZXhwCisgICAgICAgICAgICAgICAgICAgICAgICBRU3RyaW5nIG5vZGVT dHJpbmcgPSBuLT5ub2RlVmFsdWUoKS5zdHJpbmcoKTsKKyAgICAgICAgICAgICAgICAgICAgICAg IGludCBwb3MgPSByZWdFeHAtPnNlYXJjaFJldihub2RlU3RyaW5nKTsKKyAgICAgICAgICAgICAg ICAgICAgICAgIGlmIChwb3MgPj0gMCkgeworICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJl dHVybiBub2RlU3RyaW5nLm1pZChwb3MsIHJlZ0V4cC0+bWF0Y2hlZExlbmd0aCgpKS5nZXROU1N0 cmluZygpOworICAgICAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgICAgICB9 CiAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgfQo= 2888 2005-07-09 15:50:06 -0700 2005-07-12 14:35:08 -0700 Merging patch 3855.patch text/plain 2479 carsten SW5kZXg6IEtXUUtIVE1MUGFydC5tbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09ClJDUyBmaWxlOiAvY3ZzL3Jvb3QvV2Vi Q29yZS9rd3EvS1dRS0hUTUxQYXJ0Lm1tLHYKcmV0cmlldmluZyByZXZpc2lvbiAxLjY0NgpkaWZm IC1wIC11IC1yMS42NDYgS1dRS0hUTUxQYXJ0Lm1tCi0tLSBLV1FLSFRNTFBhcnQubW0JMjAwNS8w Ny8wOSAyMDoxOToyNQkxLjY0NgorKysgS1dRS0hUTUxQYXJ0Lm1tCTIwMDUvMDcvMDkgMjI6NDY6 MDYKQEAgLTQ4MiwyMiArNDgyLDI1IEBAIFFSZWdFeHAgKnJlZ0V4cEZvckxhYmVscyhOU0FycmF5 ICpsYWJlbHMKIE5TU3RyaW5nICpLV1FLSFRNTFBhcnQ6OnNlYXJjaEZvckxhYmVsc0Fib3ZlQ2Vs bChRUmVnRXhwICpyZWdFeHAsIEhUTUxUYWJsZUNlbGxFbGVtZW50SW1wbCAqY2VsbCkKIHsKICAg ICBSZW5kZXJUYWJsZUNlbGwgKmNlbGxSZW5kZXJlciA9IHN0YXRpY19jYXN0PFJlbmRlclRhYmxl Q2VsbCAqPihjZWxsLT5yZW5kZXJlcigpKTsKLSAgICBSZW5kZXJUYWJsZUNlbGwgKmNlbGxBYm92 ZVJlbmRlcmVyID0gY2VsbFJlbmRlcmVyLT50YWJsZSgpLT5jZWxsQWJvdmUoY2VsbFJlbmRlcmVy KTsKIAotICAgIGlmIChjZWxsQWJvdmVSZW5kZXJlcikgewotICAgICAgICBIVE1MVGFibGVDZWxs RWxlbWVudEltcGwgKmFib3ZlQ2VsbCA9Ci0gICAgICAgICAgICBzdGF0aWNfY2FzdDxIVE1MVGFi bGVDZWxsRWxlbWVudEltcGwgKj4oY2VsbEFib3ZlUmVuZGVyZXItPmVsZW1lbnQoKSk7CisgICAg aWYgKGNlbGxSZW5kZXJlcikgeworICAgICAgICBSZW5kZXJUYWJsZUNlbGwgKmNlbGxBYm92ZVJl bmRlcmVyID0gY2VsbFJlbmRlcmVyLT50YWJsZSgpLT5jZWxsQWJvdmUoY2VsbFJlbmRlcmVyKTsK IAotICAgICAgICBpZiAoYWJvdmVDZWxsKSB7Ci0gICAgICAgICAgICAvLyBzZWFyY2ggd2l0aGlu IHRoZSBhYm92ZSBjZWxsIHdlIGZvdW5kIGZvciBhIG1hdGNoCi0gICAgICAgICAgICBmb3IgKE5v ZGVJbXBsICpuID0gYWJvdmVDZWxsLT5maXJzdENoaWxkKCk7IG47IG4gPSBuLT50cmF2ZXJzZU5l eHROb2RlKGFib3ZlQ2VsbCkpIHsKLSAgICAgICAgICAgICAgICBpZiAobi0+aXNUZXh0Tm9kZSgp ICYmIG4tPnJlbmRlcmVyKCkgJiYgbi0+cmVuZGVyZXIoKS0+c3R5bGUoKS0+dmlzaWJpbGl0eSgp ID09IFZJU0lCTEUpCi0gICAgICAgICAgICAgICAgewotICAgICAgICAgICAgICAgICAgICAvLyBG b3IgZWFjaCB0ZXh0IGNodW5rLCBydW4gdGhlIHJlZ2V4cAotICAgICAgICAgICAgICAgICAgICBR U3RyaW5nIG5vZGVTdHJpbmcgPSBuLT5ub2RlVmFsdWUoKS5zdHJpbmcoKTsKLSAgICAgICAgICAg ICAgICAgICAgaW50IHBvcyA9IHJlZ0V4cC0+c2VhcmNoUmV2KG5vZGVTdHJpbmcpOwotICAgICAg ICAgICAgICAgICAgICBpZiAocG9zID49IDApIHsKLSAgICAgICAgICAgICAgICAgICAgICAgIHJl dHVybiBub2RlU3RyaW5nLm1pZChwb3MsIHJlZ0V4cC0+bWF0Y2hlZExlbmd0aCgpKS5nZXROU1N0 cmluZygpOworICAgICAgICBpZiAoY2VsbEFib3ZlUmVuZGVyZXIpIHsKKyAgICAgICAgICAgIEhU TUxUYWJsZUNlbGxFbGVtZW50SW1wbCAqYWJvdmVDZWxsID0KKyAgICAgICAgICAgICAgICBzdGF0 aWNfY2FzdDxIVE1MVGFibGVDZWxsRWxlbWVudEltcGwgKj4oY2VsbEFib3ZlUmVuZGVyZXItPmVs ZW1lbnQoKSk7CisKKyAgICAgICAgICAgIGlmIChhYm92ZUNlbGwpIHsKKyAgICAgICAgICAgICAg ICAvLyBzZWFyY2ggd2l0aGluIHRoZSBhYm92ZSBjZWxsIHdlIGZvdW5kIGZvciBhIG1hdGNoCisg ICAgICAgICAgICAgICAgZm9yIChOb2RlSW1wbCAqbiA9IGFib3ZlQ2VsbC0+Zmlyc3RDaGlsZCgp OyBuOyBuID0gbi0+dHJhdmVyc2VOZXh0Tm9kZShhYm92ZUNlbGwpKSB7CisgICAgICAgICAgICAg ICAgICAgIGlmIChuLT5pc1RleHROb2RlKCkgJiYgbi0+cmVuZGVyZXIoKSAmJiBuLT5yZW5kZXJl cigpLT5zdHlsZSgpLT52aXNpYmlsaXR5KCkgPT0gVklTSUJMRSkKKyAgICAgICAgICAgICAgICAg ICAgeworICAgICAgICAgICAgICAgICAgICAgICAgLy8gRm9yIGVhY2ggdGV4dCBjaHVuaywgcnVu IHRoZSByZWdleHAKKyAgICAgICAgICAgICAgICAgICAgICAgIFFTdHJpbmcgbm9kZVN0cmluZyA9 IG4tPm5vZGVWYWx1ZSgpLnN0cmluZygpOworICAgICAgICAgICAgICAgICAgICAgICAgaW50IHBv cyA9IHJlZ0V4cC0+c2VhcmNoUmV2KG5vZGVTdHJpbmcpOworICAgICAgICAgICAgICAgICAgICAg ICAgaWYgKHBvcyA+PSAwKSB7CisgICAgICAgICAgICAgICAgICAgICAgICAgICAgcmV0dXJuIG5v ZGVTdHJpbmcubWlkKHBvcywgcmVnRXhwLT5tYXRjaGVkTGVuZ3RoKCkpLmdldE5TU3RyaW5nKCk7 CisgICAgICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICAgICAgIH0KICAgICAg ICAgICAgICAgICB9CiAgICAgICAgICAgICB9Cg==