Bug 34488

Summary: Crash in mangleme in WebCore::Element::getAttribute
Product: WebKit Reporter: Alexey Proskuryakov <ap>
Component: FormsAssignee: Alexey Proskuryakov <ap>
Status: RESOLVED FIXED    
Severity: Normal Keywords: InRadar
Priority: P1    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
proposed fix darin: review+

Alexey Proskuryakov
Reported 2010-02-02 09:42:34 PST
Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: 0x000000000000000d, 0x0000000000000000 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000100859c3d WebCore::Element::getAttribute(WebCore::QualifiedName const&) const + 61 1 com.apple.WebCore 0x00000001009c6f1f WebCore::HTMLFormCollection::updateNameCache() const + 799 2 com.apple.WebCore 0x00000001009c6ae2 WebCore::HTMLCollection::namedItems(WebCore::AtomicString const&, WTF::Vector<WTF::RefPtr<WebCore::Node>, 0ul>&) const + 82 3 com.apple.WebCore 0x00000001009c6966 WebCore::HTMLFormElement::getNamedElements(WebCore::AtomicString const&, WTF::Vector<WTF::RefPtr<WebCore::Node>, 0ul>&) + 54 4 com.apple.WebCore 0x00000001009c68b9 WebCore::JSHTMLFormElement::canGetItemsForName(JSC::ExecState*, WebCore::HTMLFormElement*, JSC::Identifier const&) + 89 5 com.apple.WebCore 0x00000001009c66d0 WebCore::JSHTMLFormElement::getOwnPropertySlot(JSC::ExecState*, JSC::Identifier const&, JSC::PropertySlot&) + 96 6 com.apple.JavaScriptCore 0x00000001004eeab8 cti_op_resolve_skip + 648 7 ??? 0x00003b7b31e10302 0 + 65400303846146 8 com.apple.JavaScriptCore 0x00000001004dbebf JSC::Interpreter::execute(JSC::FunctionExecutable*, JSC::ExecState*, JSC::JSFunction*, JSC::JSObject*, JSC::ArgList const&, JSC::ScopeChainNode*, JSC::JSValue*) + 495 9 ??? 0x0000000116a6ff00 0 + 4675010304 10 ??? 0x000000011fcffbb0 0 + 4828691376 11 com.apple.WebCore 0x0000000100f973e0 WebCore::JSHTMLIFrameElement::~JSHTMLIFrameElement() + 0 12 ??? 0x8d4807894800af88 0 + 10180395243870924680 This seems to be a regression from fixing bug 34076. <rdar://problem/7594601>
Attachments
proposed fix (3.77 KB, patch)
2010-02-02 09:55 PST, Alexey Proskuryakov 		darin: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2010-02-02 09:55:15 PST
Created attachment 47944 [details] proposed fix
Darin Adler
Comment 2 2010-02-02 09:57:39 PST
Comment on attachment 47944 [details] proposed fix r=me
Alexey Proskuryakov
Comment 3 2010-02-02 10:01:45 PST
Committed <http://trac.webkit.org/changeset/54242>.
Note You need to log in before you can comment on or make changes to this bug.