Bug 94628 – DOM manipulation crashes the browser

• Component: Media
• Status: RESOLVED FIXED

[Victor Carbune]

Creating a DOM track element by script and changing the mode crashes results in a browser crash.

[Victor Carbune]

Created attachment 159750 [details]
Fix and test

[Victor Carbune]

Not sure if this is the best fix, but the spec doesn't have anything to say about combinations of DOM mutation and JS changes;

Either way, we shouldn't crash, I'm open to suggestions.

[Abhishek Arya]

isnt this a null pointer crash, if it yes, it is not a security bug

[Radar WebKit Bug Importer]

<rdar://problem/12147515>

[Victor Carbune]

(In reply to comment #3)
> isnt this a null pointer crash, if it yes, it is not a security bug
Indeed, it's just a null pointer crash; thought it might be more, initially.

[WebKit Review Bot]

Comment on attachment 159750 [details]
Fix and test

Rejecting attachment 159750 [details] from commit-queue.

[e-mail] does not have committer permissions according to http://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/committers.py.

- If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags.

- If you have committer rights please correct the error in Tools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed).  The commit-queue restarts itself every 2 hours.  After restart the commit-queue will correctly respect your committer rights.

[WebKit Review Bot]

Comment on attachment 159750 [details]
Fix and test

Clearing flags on attachment: 159750

Committed r126331: <http://trac.webkit.org/changeset/126331>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.