54730 2011-02-18 01:02:45 -0800 chrome.dll!WebCore::findPlaceForCounter+1 RecursionSOV (a5da9b73c78c638758c4402f7beabe57) 2011-05-06 09:09:54 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED DUPLICATE 60323 P1 Normal --- 1 skylined webkit-unassigned abarth eric oldest_to_newest 353468 0 82932 skylined 2011-02-18 01:02:45 -0800 Created attachment 82932 Repro Chromium: http://code.google.com/p/chromium/issues/detail?id=73379 findPlaceForCounter & makeCounterNode can call eachother recursively: static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, CounterNode*& parent, CounterNode*& previousSibling) <snip> RenderObject* currentRenderer = previousInPreOrder(counterOwner); previousSibling = 0; while (currentRenderer) { CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false); <snip> static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& identifier, bool alwaysCreateCounter) <snip> CounterNode* newParent = 0; CounterNode* newPreviousSibling = 0; RefPtr<CounterNode> newNode = CounterNode::create(object, isReset, value); if (findPlaceForCounter(object, identifier, isReset, newParent, newPreviousSibling)) <snip> id: chrome.dll!WebCore::findPlaceForCounter+1 RecursionSOV (a5da9b73c78c638758c4402f7beabe57) description: Recursive function calls in chrome.dll!WebCore::findPlaceForCounter and chrome.dll!WebCore::makeCounterNode: 9205 loops application: Chromium 11.0.671.0 Repro: <html> <head> <script> function go() { document.write('x<dd><strike style="counter-increment:r"></dd>x'); document.open(); } </script> </head> <body onload="go()"></body> </html> 399541 1 abarth 2011-05-06 09:09:54 -0700 *** This bug has been marked as a duplicate of bug 60323 *** 82932 2011-02-18 01:02:45 -0800 2011-02-18 01:02:45 -0800 Repro repro.html text/html 220 skylined PGh0bWw+CiAgPGhlYWQ+CiAgICA8c2NyaXB0PgogICAgICBmdW5jdGlvbiBnbygpIHsKICAgICAg ICBkb2N1bWVudC53cml0ZSgneDxkZD48c3RyaWtlIHN0eWxlPSJjb3VudGVyLWluY3JlbWVudDpy Ij48L2RkPngnKTsKICAgICAgICBkb2N1bWVudC5vcGVuKCk7CiAgICAgIH0KICAgIDwvc2NyaXB0 PgogIDwvaGVhZD4KICA8Ym9keSBvbmxvYWQ9ImdvKCkiPjwvYm9keT4KPC9odG1sPg==