43139 2010-07-28 12:49:37 -0700 cross_fuzz window.styleMedia.matchMedium() NULL pointer with open document 2010-08-07 14:50:46 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED DUPLICATE 43677 P1 Normal --- 42959 1 skylined webkit-unassigned abarth ap eric lcamtuf oldest_to_newest 257302 0 62863 skylined 2010-07-28 12:49:37 -0700 Created attachment 62863 Repro case Found as part of cross_fuzz investigation Repro: <body onload="document.open();window.styleMedia.matchMedium();"> id: WebCore::CSSStyleSelector::styleForElement ReadAV@NULL (dc7b32067c1b2c657a6337dd1beb1998) description: Attempt to read from NULL pointer (+0x24) in WebCore::CSSStyleSelector::styleForElement stack: WebCore::CSSStyleSelector::styleForElement WebCore::StyleMedia::matchMedium WebCore::StyleMediaInternal::matchMediumCallback v8::internal::HandleApiCallHelper<...> v8::internal::Builtin_HandleApiCall v8::internal::Invoke v8::internal::Execution::Call ... 260470 1 skylined 2010-08-05 02:02:40 -0700 Another similar crash, which does not appear to affect latest Chromium: <body onload="document.write();window.media.matchMedium();"> 261790 2 abarth 2010-08-07 14:50:46 -0700 *** This bug has been marked as a duplicate of bug 43677 *** 62863 2010-07-28 12:49:37 -0700 2010-07-28 12:49:37 -0700 Repro case repro.html text/html 65 skylined PGJvZHkgb25sb2FkPSJkb2N1bWVudC5vcGVuKCk7d2luZG93LnN0eWxlTWVkaWEubWF0Y2hNZWRp dW0oKTsiPgo=