92024 2012-07-23 13:40:56 -0700 Crash when setting empty class name on a new element 2012-07-23 13:57:42 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 schenney schenney inferno kling rniwa oldest_to_newest 675958 0 schenney 2012-07-23 13:40:56 -0700 This test crashes: <!DOCTYPE html> <script> document.createElementNS("http://www.w3.org/2000/svg", "svg").className.baseVal = ""; </script> because in WebCore/dom/StyledElement.cpp:176 we call attributeData()->clearClass(); when the class name is empty without checking if attributeData exists. Attribute data will not exist on SVG nodes (at least) immediately upon creation. This is Chromium http://code.google.com/p/chromium/issues/detail?id=138552 675972 1 153855 schenney 2012-07-23 13:48:43 -0700 Created attachment 153855 Patch 675979 2 schenney 2012-07-23 13:57:42 -0700 Committed r123377: <http://trac.webkit.org/changeset/123377> 153855 2012-07-23 13:48:43 -0700 2012-07-23 13:50:24 -0700 Patch bug-92024-20120723164835.patch text/plain 3308 schenney SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDEyMzM3NSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDEyLTA3LTIzICBTdGVwaGVu IENoZW5uZXkgIDxzY2hlbm5leUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQ3Jhc2ggd2hlbiBz ZXR0aW5nIGVtcHR5IGNsYXNzIG5hbWUgb24gYSBuZXcgZWxlbWVudAorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9OTIwMjQKKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgYSBjaGVjayBmb3IgbnVsbCBhdHRy aWJ1dGVEYXRhKCkgd2hlbiBzZXR0aW5nIHRoZSBjbGFzc05hbWUgdG8gYW4KKyAgICAgICAgZW1w dHkgc3RyaW5nIG9uIGEgbmV3bHkgY3JlYXRlZCBlbGVtZW50LiBOZXcgU1ZHIGVsZW1lbnRzIGhh dmUgbnVsbAorICAgICAgICBhdHRyaWJ1dGVEYXRhKCkgb24gYmFzZVZhbCB1cG9uIGNyZWF0aW9u LgorCisgICAgICAgIFRlc3Q6IHN2Zy9jdXN0b20vZW1wdHktY2xhc3NOYW1lLWJhc2VWYWwtY3Jh c2guaHRtbAorCisgICAgICAgICogZG9tL1N0eWxlZEVsZW1lbnQuY3BwOgorICAgICAgICAoV2Vi Q29yZTo6U3R5bGVkRWxlbWVudDo6Y2xhc3NBdHRyaWJ1dGVDaGFuZ2VkKTogQWRkIGNoZWNrIGZv ciBudWxsIGF0dHJpYnV0ZURhdGEoKQorCiAyMDEyLTA3LTIzICBTaGF3biBTaW5naCAgPHNoYXdu c2luZ2hAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFtjaHJvbWl1bV0gUmVmYWN0b3IgQ0NMYXll clRyZWVIb3N0Q29tbW9uOiBjbGVhbiB1cCBjbGlwUmVjdCBhbmQgZHJhd2FibGVDb250ZW50UmVj dCBkZXNpZ24KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2RvbS9TdHlsZWRFbGVtZW50LmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9kb20vU3R5bGVkRWxlbWVudC5jcHAJKHJldmlzaW9u IDEyMzM2NikKKysrIFNvdXJjZS9XZWJDb3JlL2RvbS9TdHlsZWRFbGVtZW50LmNwcAkod29ya2lu ZyBjb3B5KQpAQCAtMTcyLDcgKzE3Miw3IEBAIHZvaWQgU3R5bGVkRWxlbWVudDo6Y2xhc3NBdHRy aWJ1dGVDaGFuZ2UKICAgICAgICAgZW5zdXJlQXR0cmlidXRlRGF0YSgpLT5zZXRDbGFzcyhuZXdD bGFzc1N0cmluZywgc2hvdWxkRm9sZENhc2UpOwogICAgICAgICBpZiAoRE9NVG9rZW5MaXN0KiBj bGFzc0xpc3QgPSBvcHRpb25hbENsYXNzTGlzdCgpKQogICAgICAgICAgICAgc3RhdGljX2Nhc3Q8 Q2xhc3NMaXN0Kj4oY2xhc3NMaXN0KS0+cmVzZXQobmV3Q2xhc3NTdHJpbmcpOwotICAgIH0gZWxz ZQorICAgIH0gZWxzZSBpZiAoYXR0cmlidXRlRGF0YSgpKQogICAgICAgICBhdHRyaWJ1dGVEYXRh KCktPmNsZWFyQ2xhc3MoKTsKICAgICBzZXROZWVkc1N0eWxlUmVjYWxjKCk7CiB9CkluZGV4OiBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAxMjMzNzUpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29w eSkKQEAgLTEsMyArMSwxNiBAQAorMjAxMi0wNy0yMyAgU3RlcGhlbiBDaGVubmV5ICA8c2NoZW5u ZXlAY2hyb21pdW0ub3JnPgorCisgICAgICAgIENyYXNoIHdoZW4gc2V0dGluZyBlbXB0eSBjbGFz cyBuYW1lIG9uIGEgbmV3IGVsZW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTkyMDI0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgQWRkIGEgY2hlY2sgZm9yIG51bGwgYXR0cmlidXRlRGF0YSgpIHdoZW4g c2V0dGluZyB0aGUgY2xhc3NOYW1lIHRvIGFuCisgICAgICAgIGVtcHR5IHN0cmluZyBvbiBhIG5l d2x5IGNyZWF0ZWQgZWxlbWVudC4KKworICAgICAgICAqIHN2Zy9jdXN0b20vZW1wdHktY2xhc3NO YW1lLWJhc2VWYWwtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBzdmcvY3Vz dG9tL2VtcHR5LWNsYXNzTmFtZS1iYXNlVmFsLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDEyLTA3 LTIzICBDYWlvIE1hcmNlbG8gZGUgT2xpdmVpcmEgRmlsaG8gIDxjYWlvLm9saXZlaXJhQG9wZW5i b3NzYS5vcmc+CiAKICAgICAgICAgW1F0XSB0YWJsZXMvbW96aWxsYV9leHBlY3RlZF9mYWlsdXJl cyByZWJhc2VsaW5lIGFmdGVyIG5ldyB0ZXN0IGZvbnRzCkluZGV4OiBMYXlvdXRUZXN0cy9zdmcv Y3VzdG9tL2VtcHR5LWNsYXNzTmFtZS1iYXNlVmFsLWNyYXNoLWV4cGVjdGVkLnR4dAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBMYXlvdXRUZXN0cy9zdmcvY3VzdG9tL2VtcHR5LWNsYXNzTmFtZS1iYXNlVmFsLWNy YXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL3N2Zy9jdXN0b20v ZW1wdHktY2xhc3NOYW1lLWJhc2VWYWwtY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpA QCAtMCwwICsxIEBACitQQVNTIGlmIG5vIGNyYXNoLgpJbmRleDogTGF5b3V0VGVzdHMvc3ZnL2N1 c3RvbS9lbXB0eS1jbGFzc05hbWUtYmFzZVZhbC1jcmFzaC5odG1sCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExh eW91dFRlc3RzL3N2Zy9jdXN0b20vZW1wdHktY2xhc3NOYW1lLWJhc2VWYWwtY3Jhc2guaHRtbAko cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL3N2Zy9jdXN0b20vZW1wdHktY2xhc3NOYW1lLWJh c2VWYWwtY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSw5IEBACis8IURPQ1RZUEUg aHRtbD4KKzxzY3JpcHQ+CisgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAg bGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICBkb2N1bWVudC5jcmVhdGVFbGVt ZW50TlMoImh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiwgInN2ZyIpLmNsYXNzTmFtZS5iYXNl VmFsID0gIiI7Cis8L3NjcmlwdD4KKzxib2R5PgorICBQQVNTIGlmIG5vIGNyYXNoLgorPC9ib2R5 Pgo=