Bug 23858

Summary: Crash when removing a HTMLSelectElement from the document from inside its focus event handler
Product: WebKit Reporter: Mark Rowe (bdash) <mrowe>
Component: WebCore Misc.Assignee: Mark Rowe (bdash) <mrowe>
Status: RESOLVED FIXED    
Severity: Normal CC: tikbew
Priority: P1 Keywords: HasReduction, InRadar
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
URL: http://jimeh.info/webkit-bomb
Attachments:
Description Flags
Patch
darin: review+
testcase none

Description Mark Rowe (bdash) 2009-02-09 17:31:06 PST
<select id="bomb" onfocus="this.parentNode.removeChild(this)">
		<option>Click me to crash WebKit/Safari/Chrome.</option>
	</select><br />

This crashes because HTMLSelectElement::menuListDefaultEventHandler retrieves its renderer into a local variable, calls focus() which calls into JS to call the focus event handler, and then uses the renderer.  The event handler can cause the renderer to be destroyed.

<rdar://problem/6570513>
Comment 1 Mark Rowe (bdash) 2009-02-09 17:36:12 PST
Created attachment 27506 [details]
Patch
Comment 2 Darin Adler 2009-02-09 18:02:52 PST
Comment on attachment 27506 [details]
Patch

r=me
Comment 3 Mark Rowe (bdash) 2009-02-09 19:15:01 PST
Fixed with r40804.  Sam talked me into adding a layout test too.
Comment 4 Hallvord R. M. Steen 2009-05-18 16:39:20 PDT
Created attachment 30454 [details]
testcase