Bug 15455
| Summary: | XML parser modifies the document when using foo.innerHtml = "some string" | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Lars Knoll <lars.knoll> |
| Component: | XML | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | ap |
| Priority: | P2 | ||
| Version: | 523.x (Safari 3) | ||
| Hardware: | Other | ||
| OS: | OS X 10.4 | ||
Lars Knoll
The XMLTokenizer.cpp has a constructor that takes a document fragment and parses XML into this fragment (which is used at least for handling innerHtml, maybe other places as well).
While parsing this fragment, the parser calls lots of methods on the document, amongst others finishedParsing(), which can lead to memory corruption when innerHtml is used form within the onload handler.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Alexey Proskuryakov
*** This bug has been marked as a duplicate of 15456 ***