Bug 10886

Summary:

REGRESSION (r16387): Reproducible crash when mousing over HTML document

Product:

WebKit

Reporter:

mitz

Component:

WebCore Misc.

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Critical

CC:

kevin, sam

Priority:

Keywords:

Regression

Version:

420+

Hardware:

Mac

OS:

OS X 10.4

Attachments:

Description	Flags
patch	none
patch without the type	andersca: review+

mitz

Reported 2006-09-16 05:39:43 PDT

Safari crashes as soon as you mouse over an HTML document. The reason appears to be that the auto-generated -[DOMNode ownerDocument] calls Node::ownerDocument(), which returns 0 for the document itself. The old version in called Node::document(). You should keep (or generate) that custom behavior. Thread 0 Crashed: 0 WebCore::Document::frame() const + 28 (Document.cpp:773) 1 +[WebCoreFrameBridge bridgeForDOMDocument:] + 76 (WebCoreFrameBridge.mm:459) 2 -[DOMNode(WebDOMNodeOperations) _bridge] + 112 (WebDOMOperations.m:45) 3 -[DOMDocument(WebDOMDocumentOperations) webFrame] + 64 (WebDOMOperations.m:89) 4 -[WebHTMLView(WebDocumentInternalProtocols) elementAtPoint:allowShadowContent:] + 244 (WebHTMLView.m:5835) 5 -[WebHTMLView(WebDocumentInternalProtocols) elementAtPoint:] + 84 (WebHTMLView.m:5826) 6 -[WebHTMLView(WebPrivate) _updateMouseoverWithEvent:] + 1492 (WebHTMLView.m:1192) 7 -[WebHTMLView(WebPrivate) _updateMouseoverWithFakeEvent] + 580 (WebHTMLView.m:800) 8 __NSFireDelayedPerform + 304 9 __CFRunLoopDoTimer + 184

Attachments
patch (2.33 KB, patch) 2006-09-16 07:27 PDT, Sam Weinig	no flags	Details Formatted Diff Diff
patch without the type (2.33 KB, patch) 2006-09-16 07:33 PDT, Sam Weinig	andersca: review+	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Sam Weinig

Comment 1 2006-09-16 07:27:46 PDT

Created attachment 10588 [details] patch

Sam Weinig

Comment 2 2006-09-16 07:29:15 PDT

Comment on attachment 10588 [details] patch oops, thats not right

Sam Weinig

Comment 3 2006-09-16 07:33:26 PDT

Created attachment 10589 [details] patch without the type

mitz

Comment 4 2006-09-16 07:52:49 PDT

*** Bug 10888 has been marked as a duplicate of this bug. ***

Anders Carlsson

Comment 5 2006-09-16 08:00:53 PDT

Comment on attachment 10589 [details] patch without the type Could you file a new bug about the incorrect behavior and reference the url in the FIXME comment? Otherwise r=me

Sam Weinig

Comment 6 2006-09-16 08:05:06 PDT

Landed in r16391.

Note You need to log in before you can comment on or make changes to this bug.