Bug 45713
| Summary: | Regression: crash in nightlies and Chrome 7.0.517 on object.removeAttribute("type") | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Aryeh Gregor <ayg> |
| Component: | DOM | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED WORKSFORME | ||
| Severity: | Normal | CC: | tabatkins |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | PC | ||
| OS: | All | ||
| URL: | http://aryeh.name/tests/reflection.html | ||
Aryeh Gregor
http://aryeh.name/tests/reflection.html
Visit the page, and after a few seconds you get a sad tab in Chrome/crash in Safari. This didn't happen before my last Chrome update (to 7.0.517), and happens for Chrome on both Windows and Linux. It also happens in the r66933 and r67357 nightly builds for Windows, at least. I don't think I can test in earlier nightly builds because of bug 44968. It doesn't happen in Safari 5.
I might change the tests before you see this, so you can get a frozen version of the test page from git if the version at the URL right now isn't showing the problem:
http://aryeh.name/gitweb.cgi?p=tests;a=blob;f=reflection.html;hb=d18713d86
If I can provide any additional info, please advise.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Aryeh Gregor
Minimal test case:
data:text/html,<!doctype html>
<script>
var el = document.createElement("object");
el.type = "";
el.removeAttribute("type");
</script>
This causes a sad tab for me in Chrome dev, and a crash in the latest WebKit nightly (r67637).
Tab Atkins
No longer appears to cause a sad tab or crash for me. Aryeh, wanna double-check and invalidate this if necessary?
Aryeh Gregor
Nope, can't reproduce anymore.