Summary: | DOM modification causes stack exhaustion (BUTTON OBJECT COLGROUP) | ||
---|---|---|---|
Product: | WebKit | Reporter: | Berend-Jan Wever <skylined> |
Component: | Layout and Rendering | Assignee: | mitz |
Status: | RESOLVED FIXED | ||
Severity: | Normal | CC: | ap |
Priority: | P1 | Keywords: | InRadar |
Version: | 525.x (Safari 3.1) | ||
Hardware: | All | ||
OS: | All | ||
URL: | http://skypher.com/SkyLined/Repro/Safari/Stack%20exhaustion%20BUTTON%20OBJECT%20COLGROUP/repro.html |
Description
Berend-Jan Wever
2008-06-12 08:19:10 PDT
We don't treat denial of service attacks as security issues (unless the bugs are exploitable for remote code execution), but reproducible crashes are P1. On a local debug build, I'm hitting an assertion: ASSERTION FAILED: beforeChild->parent()->isAnonymousBlock() 0 com.apple.WebCore 0x02b4b35d WebCore::RenderBlock::addChildToFlow(WebCore::RenderObject*, WebCore::RenderObject*) + 297 (RenderBlock.cpp:162) See also: bug 19220. Fixed in <http://trac.webkit.org/changeset/34692>. |