Summary: | ASSERTION FAILURE: qantas.com.au changing selected item in <select> via JS | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Mark Rowe (bdash) <mrowe> | ||||||||
Component: | DOM | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Major | CC: | ap | ||||||||
Priority: | P1 | Keywords: | HasReduction | ||||||||
Version: | 523.x (Safari 3) | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.4 | ||||||||||
URL: | http://www.qantas.com.au/regions/dyn/home/qualifier-region-au | ||||||||||
Attachments: |
|
Description
Mark Rowe (bdash)
2007-03-01 22:30:23 PST
Created attachment 13448 [details]
Crash log
I cannot reproduce this with r19943 on a PowerPC Mac. I cannot reproduce this in r19940, r18726, r17722, r16233, or Safari 2.0.4 (419.3). I'm using a 10.4.8 on a PPC architecture. I cannot reproduce this either. This may be because the select lists have changed contents due to dates, or it may have been timing related. I was seeing this initially with r19940 and retesting there doesn't reproduce the problem. I'll leave this open and retest this in a few days to see if i can find other conditions to trigger this. As the crash log notes this is an assertion failure rather than a crash, so there is no way this will be triggered in a nightly build. I can reproduce this easily again today while I was unable during the weekend. Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0xbbadbeef 0x010aa2c4 in WebCore::HTMLSelectElement::setSelectedIndex (this=0x1b957c60, optionIndex=0, deselect=true, fireOnChange=false) at /Users/mrowe/Documents/Work/Apple/OpenSource/WebCore/html/HTMLSelectElement.cpp:188 188 ASSERT(m_lastOnChangeIndex == -1 || m_lastOnChangeIndex == optionIndex); (gdb) print m_lastOnChangeIndex $1 = 2 (gdb) print optionIndex $2 = 0 Further investigation shows that this is happening when the selectedIndex on the <select> element is set inside an onchange event handler of the element. Created attachment 13475 [details]
Reduction
Truncating the select element's options and changing selectedIndex from within the onchange event handler will trigger the assertion failure.
Created attachment 13485 [details]
Patch
|