Summary: | Table with Form Field and Hidden DIV crashes Safari | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Bryan <bschwegler> | ||||||||||
Component: | Forms | Assignee: | Carsten Guenther <carsten> | ||||||||||
Status: | RESOLVED FIXED | ||||||||||||
Severity: | Critical | CC: | kabendroth | ||||||||||
Priority: | P1 | ||||||||||||
Version: | 420+ | ||||||||||||
Hardware: | Mac | ||||||||||||
OS: | OS X 10.4 | ||||||||||||
URL: | http://www.pmachine.com/forums/viewthread/24217/P0/ | ||||||||||||
Attachments: |
|
Description
Bryan
2005-07-04 17:18:22 PDT
The report is missing a key step to reproduce: the crash only occurs after you begin typing in the bottom text entry field. This occurs with both WebKit 412 and ToT CVS. Crash log from ToT included below: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c Thread 0 Crashed: 0 com.apple.WebCore 0x011dfed4 khtml::RenderTableCell::table() const + 0 (icplusplus.c:28) 1 <<00000000>> 0xbfffe324 0 + -1073749212 2 com.apple.WebCore 0x010204b8 KWQKHTMLPart::searchForLabelsBeforeElement(NSArray*, DOM::ElementImpl*) + 204 (icplusplus.c:28) 3 com.apple.Safari 0x0009956c 0x1000 + 623980 4 com.apple.Safari 0x00098edc 0x1000 + 622300 5 com.apple.Safari 0x000958f8 0x1000 + 608504 6 com.apple.Safari 0x00095b50 0x1000 + 609104 7 com.apple.Safari 0x0004402c 0x1000 + 274476 8 com.apple.Foundation 0x92886d18 __NSFireDelayedPerform + 304 9 com.apple.CoreFoundation 0x9075deb0 __CFRunLoopDoTimer + 184 10 com.apple.CoreFoundation 0x9074a828 __CFRunLoopRun + 1680 11 com.apple.CoreFoundation 0x90749ddc CFRunLoopRunSpecific + 268 12 com.apple.HIToolbox 0x93122ca0 RunCurrentEventLoopInMode + 264 13 com.apple.HIToolbox 0x93122334 ReceiveNextEventCommon + 380 14 com.apple.HIToolbox 0x931221a0 BlockUntilNextEventMatchingListInMode + 96 15 com.apple.AppKit 0x9362b1a4 _DPSNextEvent + 384 16 com.apple.AppKit 0x9362ae68 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116 17 com.apple.Safari 0x00007058 0x1000 + 24664 18 com.apple.AppKit 0x936273cc -[NSApplication run] + 472 19 com.apple.AppKit 0x93717c1c NSApplicationMain + 452 20 com.apple.Safari 0x00002700 0x1000 + 5888 21 com.apple.Safari 0x00057190 0x1000 + 352656 A easiliy accessible case for this bug is at http://pmachine.com/misc/safari_crash.html It consists of the HTML included in the initial bug report. Created attachment 2799 [details]
minimal testcase
Removing either the table or the display:none prevents the crash.
Created attachment 2800 [details]
minimal testcase
This time the testcase tells hows to recreate the problem.
Created attachment 2858 [details]
Proposed fix
This patch checks for the existence of the cell renderer.
Comment on attachment 2858 [details]
Proposed fix
The fix looks good, but this patch isn't going to merge any more after the
changes from 3405. Can you make the fix again and attach a new patch? Thanks.
Created attachment 2888 [details]
Merging patch
Here you go.
Comment on attachment 2888 [details]
Merging patch
Changed name of patch, since it could seem now as if you just attached the
patch again...
Comment on attachment 2888 [details]
Merging patch
r=me
I'll commit this Closing since this has been committed. This is also in Radar as <rdar://problem/4146880> |