Summary: | REGRESSION: Reproducible crash in WebCore::RenderTextField::textWithHardLineBreaks() | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | David Kilzer (:ddkilzer) <ddkilzer> | ||||||||
Component: | Forms | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | adele, darin | ||||||||
Priority: | P1 | Keywords: | EasyFix, Regression | ||||||||
Version: | 420+ | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.4 | ||||||||||
Attachments: |
|
Description
David Kilzer (:ddkilzer)
2006-06-21 21:56:07 PDT
After reducing a page that crashed, it seems that defining a textarea with a name and a wrap attribute of either "physical" or "hard" will cause Safari to crash when the form is submitted. See attached test case. Created attachment 8962 [details]
Test case
Test case that crashes Safari. You must click the "Submit" button before it crashes, though.
The code says this: m_div->firstChild()->renderer()->inlineBox(0, DOWNSTREAM) I think that renderer might be 0. Definitely the problem == no text, no renderer, nil-deref when trying to make a call on the renderer. Just add a nil check. Created attachment 9022 [details]
Patch v1
Patch and test case.
Comment on attachment 9022 [details]
Patch v1
r=me -- even better if we can figure out some day how to do the test without a timeout
Created attachment 9023 [details]
Patch v2
Changed test timeout from 200ms to 0ms. Also fixed LayoutTests/fast/forms/textarea-hard-linewrap.html the same way.
Comment on attachment 9023 [details]
Patch v2
r=me
Committed revision 15040. |