<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>75317</bug_id>
          
          <creation_ts>2011-12-28 11:30:57 -0800</creation_ts>
          <short_desc>&lt;math&gt;&lt;option&gt;&lt;option&gt;&lt;/html&gt;&lt;option&gt;&lt;/option&gt; used to crash the parser</short_desc>
          <delta_ts>2012-01-24 21:30:16 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>66101</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="WebKit Review Bot">webkit.review.bot</reporter>
          <assigned_to name="Adam Barth">abarth</assigned_to>
          <cc>abarth</cc>
    
    <cc>aestes</cc>
    
    <cc>eric</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>527717</commentid>
    <comment_count>0</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2011-12-28 11:30:57 -0800</bug_when>
    <thetext>&lt;math&gt;&lt;option&gt;&lt;option&gt;&lt;/html&gt;&lt;option&gt;&lt;/option&gt; used to crash the parser
Requested by abarth on #webkit.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>527721</commentid>
    <comment_count>1</comment_count>
      <attachid>120688</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2011-12-28 11:37:33 -0800</bug_when>
    <thetext>Created attachment 120688
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>527722</commentid>
    <comment_count>2</comment_count>
      <attachid>120688</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2011-12-28 11:39:00 -0800</bug_when>
    <thetext>Comment on attachment 120688
Patch

We could have added this to webkit.dat instead.  But this is fine.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>527736</commentid>
    <comment_count>3</comment_count>
      <attachid>120688</attachid>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2011-12-28 12:37:04 -0800</bug_when>
    <thetext>Comment on attachment 120688
Patch

Clearing flags on attachment: 120688

Committed r103776: &lt;http://trac.webkit.org/changeset/103776&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>120688</attachid>
            <date>2011-12-28 11:37:33 -0800</date>
            <delta_ts>2011-12-28 12:37:04 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-75317-20111228113732.patch</filename>
            <type>text/plain</type>
            <size>1702</size>
            <attacher name="Adam Barth">abarth</attacher>
            
              <data encoding="base64">SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D
aGFuZ2VMb2cJKHJldmlzaW9uIDEwMzc3MikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y
a2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDExLTEyLTI4ICBBZGFtIEJhcnRoICA8YWJh
cnRoQHdlYmtpdC5vcmc+CisKKyAgICAgICAgPG1hdGg+PG9wdGlvbj48b3B0aW9uPjwvaHRtbD48
b3B0aW9uPjwvb3B0aW9uPiB1c2VkIHRvIGNyYXNoIHRoZSBwYXJzZXIKKyAgICAgICAgaHR0cHM6
Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc1MzE3CisKKyAgICAgICAgUmV2aWV3
ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkIGEgdGVzdCBzbyB0aGF0IHRoaXMg
Y2FzZSBjb250aW51ZXMgdG8gbm90IGNyYXNoLgorCisgICAgICAgICogZmFzdC9wYXJzZXIvbWF0
aC1vcHRpb25zLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9wYXJz
ZXIvbWF0aC1vcHRpb25zLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDExLTEyLTI4ICBSb2JlcnQg
SG9nYW4gIDxyb2JlcnRAd2Via2l0Lm9yZz4KIAogICAgICAgICBJbmxpbmUgZmxvdyBub3QgbGVh
cm5pbmcgaGVpZ2h0IG9mIGFsbCB0ZXh0IGRlc2NlbmRhbnRzCkluZGV4OiBMYXlvdXRUZXN0cy9m
YXN0L3BhcnNlci9tYXRoLW9wdGlvbnMtY3Jhc2gtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t
IExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL21hdGgtb3B0aW9ucy1jcmFzaC1leHBlY3RlZC50eHQJ
KHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L3BhcnNlci9tYXRoLW9wdGlvbnMtY3Jh
c2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDE1IEBACit8IDxodG1sPgor
fCAgIDxoZWFkPgorfCAgICAgPHNjcmlwdD4KK3wgICAgICAgc3JjPSIuLi8uLi9yZXNvdXJjZXMv
ZHVtcC1hcy1tYXJrdXAuanMiCit8ICAgICAiCisiCit8ICAgPGJvZHk+Cit8ICAgICAiVGhpcyB0
ZXN0IHBhc3NlcyBpZiBpdCBkb2Vzbid0IGNyYXNoLgorIgorfCAgICAgPG1hdGggbWF0aD4KK3wg
ICAgICAgPG1hdGggb3B0aW9uPgorfCAgICAgICAgIDxtYXRoIG9wdGlvbj4KK3wgICAgICAgICAg
IDxtYXRoIG9wdGlvbj4KK3wgICAgICAgICAgICIKKyIKSW5kZXg6IExheW91dFRlc3RzL2Zhc3Qv
cGFyc2VyL21hdGgtb3B0aW9ucy1jcmFzaC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3Rz
L2Zhc3QvcGFyc2VyL21hdGgtb3B0aW9ucy1jcmFzaC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5
b3V0VGVzdHMvZmFzdC9wYXJzZXIvbWF0aC1vcHRpb25zLWNyYXNoLmh0bWwJKHJldmlzaW9uIDAp
CkBAIC0wLDAgKzEsMyBAQAorPHNjcmlwdCBzcmM9Ii4uLy4uL3Jlc291cmNlcy9kdW1wLWFzLW1h
cmt1cC5qcyI+PC9zY3JpcHQ+CitUaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXNuJ3QgY3Jhc2gu
Cis8bWF0aD48b3B0aW9uPjxvcHRpb24+PC9odG1sPjxvcHRpb24+PC9vcHRpb24+Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>