7137 2006-02-07 13:48:38 -0800 Crash if <table> is removed from DOM while being parsed if it contains bogus content 2006-04-25 01:47:52 -0700 1 1 1 Unclassified WebKit Tables 420+ PC Linux RESOLVED FIXED http://www.hixie.ch/tests/adhoc/html/parsing/error-handling/034.html P1 Normal --- 1 ian eric oldest_to_newest 31762 0 ian 2006-02-07 13:48:38 -0800 STEPS TO REPRODUCE 1. <table> 2. Remove the table from the DOM. 3. <div> (bogus element in this context, parser tries to move it outside the table) ACTUAL RESULTS Crash. EXPECTED RESULTS Content should be placed where the table used to be in the DOM. I'm not yet sure exactly what this means if other content is moved around in the DOM. I think if the <table> is no longer inside its original parent, then it should just append the bogus content to the parent. 40383 1 ap 2006-04-24 21:31:26 -0700 Reproducible crash -> P1. Thread 0 Crashed: 0 com.apple.WebCore 0x01b4c778 WebCore::TreeShared<WebCore::Node>::parent() const + 20 (Shared.h:57) 1 com.apple.WebCore 0x01b4c7b0 WebCore::Node::parentNode() const + 36 (Node.h:89) 2 com.apple.WebCore 0x017a9a20 WebCore::HTMLParser::handleError(WebCore::Node*, bool, WebCore::AtomicString const&, int) + 6404 (HTMLParser.cpp:490) 3 com.apple.WebCore 0x017aa760 WebCore::HTMLParser::insertNode(WebCore::Node*, bool) + 912 (HTMLParser.cpp:281) 4 com.apple.WebCore 0x017ac178 WebCore::HTMLParser::parseToken(WebCore::Token*) + 1388 (HTMLParser.cpp:208) 5 com.apple.WebCore 0x017b006c WebCore::HTMLTokenizer::processToken() + 564 (HTMLTokenizer.cpp:1628) 6 com.apple.WebCore 0x017b37c0 WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&, WebCore::HTMLTokenizer::State) + 7376 (HTMLTokenizer.cpp:1206) 7 com.apple.WebCore 0x017b43ec WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&, bool) + 1744 (HTMLTokenizer.cpp:1432) 8 com.apple.WebCore 0x018a1728 WebCore::Frame::write(char const*, int) + 952 (Frame.cpp:654) 40393 2 eric 2006-04-25 01:44:09 -0700 Thanks for the bug. I chose not to make it match your test case for now (since both FireFox and IE fail your test), but I did fix the crash. 40394 3 7953 eric 2006-04-25 01:44:39 -0700 Created attachment 7953 Fixes crash 40395 4 7953 mjs 2006-04-25 01:46:06 -0700 Comment on attachment 7953 Fixes crash r=me 7953 2006-04-25 01:44:39 -0700 2006-04-25 01:46:06 -0700 Fixes crash crash.patch text/plain 3551 eric SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDE0MDQ3KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMDYtMDQtMjUgIEVyaWMgU2VpZGVsICA8ZXNl aWRlbEBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgbWpzLgorCisgICAgICAgIEZp eCByZXByb2R1Y2libGUgY3Jhc2hlciBpbiBIVE1MIHBhcnNpbmcgY29kZS4KKyAgICAgICAgaHR0 cDovL2J1Z3ppbGxhLm9wZW5kYXJ3aW4ub3JnL3Nob3dfYnVnLmNnaT9pZD03MTM3CisKKyAgICAg ICAgKiBmYXN0L3BhcnNlci9yZW1vdmUtY3VycmVudC1ub2RlLXBhcmVudC1leHBlY3RlZC50eHQ6 IEFkZGVkLgorICAgICAgICAqIGZhc3QvcGFyc2VyL3JlbW92ZS1jdXJyZW50LW5vZGUtcGFyZW50 Lmh0bWw6IEFkZGVkLgorCiAyMDA2LTA0LTI0ICBFcmljIFNlaWRlbCAgPGVzZWlkZWxAYXBwbGUu Y29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IGdnYXJlbi4KSW5kZXg6IExheW91dFRlc3RzL2Zh c3QvcGFyc2VyL3JlbW92ZS1jdXJyZW50LW5vZGUtcGFyZW50Lmh0bWwKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g TGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmVtb3ZlLWN1cnJlbnQtbm9kZS1wYXJlbnQuaHRtbAko cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL3JlbW92ZS1jdXJyZW50LW5v ZGUtcGFyZW50Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTIgQEAKKzx0YWJsZT4KKzxz Y3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgIGxheW91dFRlc3RD b250cm9sbGVyLmR1bXBBc1RleHQoKTsKK3ZhciB4ID0gZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRh Z05hbWUoJ3RhYmxlJylbMF07Cit4LnBhcmVudE5vZGUucmVtb3ZlQ2hpbGQoeCk7Cis8L3Njcmlw dD4KKzxzcGFuPkF0IHRoZSB0aW1lIG9mIHdyaXRpbmcsIG91ciBjdXJyZW50IGJlaGF2aW9yIGln bm9yZXMgY29udGVudCBpbiBzdWJ0cmVlcyByZW1vdmVkIGR1cmluZyBwYXJzaW5nLgorICAgSG93 ZXZlciwgSFRNTDUgc3VnZ2VzdHMgaXQgc2hvdWxkIG5vdCBiZSBpZ25vcmVkLgorICAgU2VlOiBo dHRwOi8vd3d3LmhpeGllLmNoL3Rlc3RzL2FkaG9jL2h0bWwvcGFyc2luZy9lcnJvci1oYW5kbGlu Zy8wMzQuaHRtbAorICAgYW5kOiBodHRwOi8vYnVnemlsbGEub3BlbmRhcndpbi5vcmcvc2hvd19i dWcuY2dpP2lkPTcxMzc8L3NwYW4+Cis8L3RhYmxlPjxzcGFuPlNVQ0NFU1MgKG5vIGNyYXNoISk8 L3NwYW4+CkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L3BhcnNlci9yZW1vdmUtY3VycmVudC1ub2Rl LXBhcmVudC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9wYXJz ZXIvcmVtb3ZlLWN1cnJlbnQtbm9kZS1wYXJlbnQtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQor KysgTGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmVtb3ZlLWN1cnJlbnQtbm9kZS1wYXJlbnQtZXhw ZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxIEBACitTVUNDRVNTIChubyBjcmFzaCEp CkluZGV4OiBXZWJDb3JlL2h0bWwvSFRNTFBhcnNlci5jcHAKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29y ZS9odG1sL0hUTUxQYXJzZXIuY3BwCShyZXZpc2lvbiAxNDA0MikKKysrIFdlYkNvcmUvaHRtbC9I VE1MUGFyc2VyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNDg3LDcgKzQ4NywxMSBAQCBib29sIEhU TUxQYXJzZXI6OmhhbmRsZUVycm9yKE5vZGUqIG4sIGJvCiAgICAgICAgICAgICAgICAgaWYgKHBv c3NpYmx5TW92ZVN0cmF5Q29udGVudCkgewogICAgICAgICAgICAgICAgICAgICBOb2RlICpub2Rl ID0gY3VycmVudDsKICAgICAgICAgICAgICAgICAgICAgTm9kZSAqcGFyZW50ID0gbm9kZS0+cGFy ZW50Tm9kZSgpOworICAgICAgICAgICAgICAgICAgICBpZiAoIXBhcmVudCkKKyAgICAgICAgICAg ICAgICAgICAgICAgIHJldHVybiBmYWxzZTsKICAgICAgICAgICAgICAgICAgICAgTm9kZSAqZ3Jh bmRwYXJlbnQgPSBwYXJlbnQtPnBhcmVudE5vZGUoKTsKKyAgICAgICAgICAgICAgICAgICAgaWYg KCFncmFuZHBhcmVudCkKKyAgICAgICAgICAgICAgICAgICAgICAgIHJldHVybiBmYWxzZTsKIAog ICAgICAgICAgICAgICAgICAgICBpZiAobi0+aXNUZXh0Tm9kZSgpIHx8CiAgICAgICAgICAgICAg ICAgICAgICAgICAoaC0+aGFzTG9jYWxOYW1lKHRyVGFnKSAmJgpAQCAtNDk4LDYgKzUwMiw4IEBA IGJvb2wgSFRNTFBhcnNlcjo6aGFuZGxlRXJyb3IoTm9kZSogbiwgYm8KICAgICAgICAgICAgICAg ICAgICAgICAgIG5vZGUgPSAobm9kZS0+aGFzVGFnTmFtZSh0YWJsZVRhZykpID8gbm9kZSA6CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICgobm9kZS0+aGFzVGFnTmFtZSh0clRhZykp ID8gZ3JhbmRwYXJlbnQgOiBwYXJlbnQpOwogICAgICAgICAgICAgICAgICAgICAgICAgTm9kZSAq cGFyZW50ID0gbm9kZS0+cGFyZW50Tm9kZSgpOworICAgICAgICAgICAgICAgICAgICAgICAgaWYg KCFwYXJlbnQpCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAg ICAgICAgICAgICAgICAgICAgICAgcGFyZW50LT5pbnNlcnRCZWZvcmUobiwgbm9kZSwgZWMpOwog ICAgICAgICAgICAgICAgICAgICAgICAgaWYgKCFlYykgewogICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGlmIChuLT5pc0hUTUxFbGVtZW50KCkgJiYgdGFnUHJpb3JpdHkgPiAwICYmIApJbmRl eDogV2ViQ29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9DaGFuZ2VMb2cJKHJl dmlzaW9uIDE0MDQ3KQorKysgV2ViQ29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEs MyArMSwxMyBAQAorMjAwNi0wNC0yNSAgRXJpYyBTZWlkZWwgIDxlc2VpZGVsQGFwcGxlLmNvbT4K KworICAgICAgICBSZXZpZXdlZCBieSBtanMuCisKKyAgICAgICAgRml4IHJlcHJvZHVjaWJsZSBj cmFzaCBpbiBodG1sIHBhcnNlciBjb2RlLgorICAgICAgICBodHRwOi8vYnVnemlsbGEub3BlbmRh cndpbi5vcmcvc2hvd19idWcuY2dpP2lkPTcxMzcKKworICAgICAgICAqIGh0bWwvSFRNTFBhcnNl ci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpIVE1MUGFyc2VyOjpoYW5kbGVFcnJvcik6CisKIDIw MDYtMDQtMjUgIE1hY2llaiBTdGFjaG93aWFrICA8bWpzQGFwcGxlLmNvbT4KIAogICAgICAgICBS ZXZpZXdlZCBieSBFcmljLgo=