44172 2010-08-18 06:47:31 -0700 [chromium] WebKit::WebFormElement::getFormControlElements ReadAV@NULL 2011-07-28 01:03:13 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED WORKSFORME P1 Normal --- 43055 1 skylined webkit-unassigned eric tony tonyg oldest_to_newest 266080 0 64700 skylined 2010-08-18 06:47:31 -0700 Created attachment 64700 Repro The following repro causes a NULL pointer in Chromium latest: <body onload=" document.write('<svg><form><strike><form>'); document.close(); "> id: WebKit::WebFormElement::getFormControlElements ReadAV@NULL (c289b174a22e30d5c270e0327fe517e9) description: Attempt to read from NULL pointer (+0x60) in WebKit::WebFormElement::getFormControlElements stack: WebKit::WebFormElement::getFormControlElements FormManager::ExtractForms AutoFillHelper::FrameContentsAvailable RenderView::didFinishDocumentLoad WebKit::FrameLoaderClientImpl::dispatchDidFinishDocumentLoad WebCore::FrameLoader::finishedParsing WebCore::Document::finishedParsing WebCore::DocumentWriter::endIfNotLoadingMainResource WebCore::Document::close WebCore::HTMLDocumentInternal::closeCallback v8::internal::HandleApiCallHelper<...> v8::internal::Builtin_HandleApiCall v8::internal::Invoke v8::internal::Execution::Call ... 266130 1 eric 2010-08-18 08:43:16 -0700 Probably related to bug 43055 as well, not sure. 266179 2 eric 2010-08-18 09:54:35 -0700 This looks chromium-only. 443398 3 skylined 2011-07-28 01:03:13 -0700 This seems to have been fixed by now. 64700 2010-08-18 06:47:31 -0700 2010-08-18 06:47:31 -0700 Repro repro.html text/html 84 skylined PGJvZHkgb25sb2FkPSIKICBkb2N1bWVudC53cml0ZSgnPHN2Zz48Zm9ybT48c3RyaWtlPjxmb3Jt PicpOwogIGRvY3VtZW50LmNsb3NlKCk7CiI+