Summary: | CRASH in WebCore::appendChildToContainer | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Jon@Chromium <jon> | ||||
Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | eric | ||||
Priority: | P1 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.5 | ||||||
Bug Depends on: | |||||||
Bug Blocks: | 25111 | ||||||
Attachments: |
|
Description
Jon@Chromium
2009-04-08 10:36:46 PDT
Looks straightforward. I'll take a crack at it tomorrow if no one else has fixed it before then. Oh, and FYI: Mark Rowe has pointed out to me, that current best-practice is to attach the stack-trace as an attachment instead of pasting it in the bug itself. I seem to remember we used to paste them in the bug itself back in the day, but I've come to agree with him, it seems cleaner to attach it as an attachment. Actually, it has nothing to do with XML. The server is sending these as html pages. :) curl -I "http://www.wdr.de/mediathek/html/regional/ergebnisse/sendung.xml" HTTP/1.1 200 OK Date: Thu, 09 Apr 2009 08:59:54 GMT Server: Apache Set-Cookie: JSESSIONID=73A594B715709A69F9B21AA22CACFE42.mediathek1; Path=/mediathek Content-Type: text/html;charset=ISO-8859-1 Got to love the web! The bug reproduces in the remote file, but not when I pull the file down locally and add a <base> tag. :( This must be a regression. The crashing test case is: <script> document.implementation.createDocument(null, "foo:bar", null); </script> Which it's hard for me to imagine that we've always crashed on. :) The reason we crash is that createElementNS is strict about namespace URIs and prefixes matching. I remember making this change: http://trac.webkit.org/browser/trunk/WebCore/dom/Document.cpp#L753 We fail that check, thus return 0 from createElementNS, and the caller: http://trac.webkit.org/browser/trunk/WebCore/dom/DOMImplementation.cpp#L253 doesn't null-check the return value like it should. :) I suspect the caller lack of null check is the recent regression. However, I'm not yet sure what our behavior here should be, so I need to make a more comprehensive test first. :( Created attachment 29362 [details]
Fix and test case
LayoutTests/ChangeLog | 15 ++
.../createDocument-namespace-err-expected.txt | 51 +++++++
.../createDocument-namespace-err.html | 13 ++
.../resources/createDocument-namespace-err.js | 146 ++++++++++++++++++++
WebCore/ChangeLog | 14 ++
WebCore/dom/ContainerNode.cpp | 1 +
WebCore/dom/DOMImplementation.cpp | 5 +-
7 files changed, 243 insertions(+), 2 deletions(-)
Committing to http://svn.webkit.org/repository/webkit/trunk ... M LayoutTests/ChangeLog A LayoutTests/fast/dom/DOMImplementation/createDocument-namespace-err-expected.txt A LayoutTests/fast/dom/DOMImplementation/createDocument-namespace-err.html A LayoutTests/fast/dom/DOMImplementation/resources/createDocument-namespace-err.js M WebCore/ChangeLog M WebCore/dom/ContainerNode.cpp M WebCore/dom/DOMImplementation.cpp Committed r42351 That's an impressive test case! |