| Summary: | Reproducible crash removing name attribute from <img> node | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Neil Jenkins <neilj> | ||||||
| Component: | DOM | Assignee: | Andreas Kling <kling> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | cmarcelo, commit-queue, esprehn+autocc, kangil.han | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | 528+ (Nightly build) | ||||||||
| Hardware: | Mac | ||||||||
| OS: | OS X 10.10 | ||||||||
| Attachments: |
|
||||||||
Thank you, nice test case! rdar://problem/17198583 Created attachment 252190 [details]
Patch
Comment on attachment 252190 [details] Patch Clearing flags on attachment: 252190 Committed r183706: <http://trac.webkit.org/changeset/183706> All reviewed patches have been landed. Closing bug. |
Created attachment 251916 [details] Minimal test case to crash Safari Steps to reproduce (or see attached minimal test case): 1. Create a document using document.implementation.createHTMLDocument('') 2. Add an image node to this document with both a name and an id attribute. 3. Attempt to remove the name attribute from the image node. Expected result: The name attribute is removed. Safari does not crash. Actual result: Safari crashes. This reproduces in the latest stable Safari (8.0.5) on both OS X and iOS.