| Summary: | Null deref accessing CustomEvent.detail | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Sam Weinig <sam> | ||||
| Component: | DOM | Assignee: | Sam Weinig <sam> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | Keywords: | EasyFix, InRadar | ||||
| Priority: | P1 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Attachments: |
|
||||||
It does, it does! Repro crash -> P1 Created attachment 99737 [details]
Patch
Committed r90405: <http://trac.webkit.org/changeset/90405> |
The ScriptValue m_detail in the CustomEvent class is initialized to null (rather than jsNull()) which can lead to a null deref if it is access before calling initCustomEvent. javascript:alert(document.createEvent("CustomEvent").detail) should do the trick.