Bug 26402 – Accessing attributes of an object created with "document.implementation.createDocumentType" causes NULL pointers

• Component: DOM
• Status: RESOLVED FIXED

[Berend-Jan Wever]

Accessing properties/calling methods of an object created with "document.implementation.createDocumentType" causes NULL pointer exceptions.

Repro:
<SCRIPT>
  o = document.implementation.createDocumentType('x');
  for (i in o) {
    try { o[i]; } catch (e) {}
    try { o[i](); } catch (e) {}
  }
</SCRIPT>

[Berend-Jan Wever]

Added lin to repro

[Berend-Jan Wever]

Chromium bug: http://code.google.com/p/chromium/issues/detail?id=14091

[Alexey Proskuryakov]

I'm sure there are more issues with DOM code not expecting that Node::document() can return NULL, because it's so rare.

[Olivier]

If I understand well http://www.w3.org/TR/2000/REC-DOM-Level-2-Core-20001113/core.html there is only two cases where Node::document() would be null:
 * with a document
 * with a not yet attached documentType


If the former, nothing you can access in javascript do crash.

If the latter, the following will crash:
 * Node::childNodes (because of document()->addNodeListCache())
 * Node::addEventListener (because of !document->attached())
 * Node::removeEventListener
And nothing else.

Hope that helps...

[Eric Seidel (no email)]

I feel like I've seen a dupe of this... possibly even worked on a dupe of this.

[Alexey Proskuryakov]

<rdar://problem/7137337>

[Alexey Proskuryakov]

Created attachment 39021 [details]
proposed fix

(In reply to comment #4)
> Hope that helps...

Thanks, it definitely helped!

[Eric Seidel (no email)]

Comment on attachment 39021 [details]
proposed fix

Seems this could caus trouble:
59 Name: svn:eol-style
610   + native

[Eric Seidel (no email)]

Comment on attachment 39021 [details]
proposed fix

Otherwise this looks fine.  V8 changes will likely be needed eventually, but someone else can figure those out.

[Alexey Proskuryakov]

Committed <http://trac.webkit.org/changeset/48055>.

(In reply to comment #8)
> Seems this could caus trouble:
> 59 Name: svn:eol-style
> 610   + native

Will it? Almost all of my patches in the recent years had this.

[Eric Seidel (no email)]

Is run-webkit-tests/DumpRenderTree smart enough to handle expected results with non-unix line endings?

[Alexey Proskuryakov]

No idea, I don't have any setup that would use non-Unix line endings. I think the right question is - did this (*-expected.txt file line ending style) ever cause problems before?

[Dimitri Glazkov (Google)]

V8 bindings fix coming up.

[Dimitri Glazkov (Google)]

Created attachment 39704 [details]
Fix detached doctype crashes, v1.

 WebCore/ChangeLog                    |   14 ++++++++++++++
 WebCore/bindings/v8/V8DOMWrapper.cpp |    6 +++++-
 2 files changed, 19 insertions(+), 1 deletions(-)

[Eric Seidel (no email)]

Comment on attachment 39704 [details]
Fix detached doctype crashes, v1.

LGTM.  We probably should have used a separate bug for this. :)

[Dimitri Glazkov (Google)]

Landed as http://trac.webkit.org/changeset/48480.

[Dimitri Glazkov (Google)]

Landed as http://trac.webkit.org/changeset/48480.

[Lucas Forschler]

Mass moving XML DOM bugs to the "DOM" Component.