Bug 9728

Summary:	REGRESSION: NativeTextField use causes crash while attempting to quote a post at Ars.
Product:	WebKit	Reporter:	Jon <jon>
Component:	Forms	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Critical
Priority:	P1
Version:	420+
Hardware:	Mac
OS:	OS X 10.4
URL:	http://episteme.arstechnica.com/eve/forums/a/tpc/f/8300945231/m/365005439731/p/17

Jon

Reported 2006-07-04 01:23:56 PDT

What the summary says. Here's the trace: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x000000a4 Thread 0 Crashed: 0 com.apple.WebCore 0x011e5b20 WebCore::RenderTextField::text() + 32 (RefPtr.h:56) 1 com.apple.WebCore 0x011158a8 WebCore::Document::setFocusNode(WTF::PassRefPtr<WebCore::Node>) + 1304 (Document.cpp:2119) 2 com.apple.WebCore 0x010d76c8 WebCore::HTMLTextAreaElement::focus() + 232 (HTMLTextAreaElement.cpp:213) 3 com.apple.WebCore 0x01347774 WebCore::JSHTMLTextAreaElementProtoFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 244 (JSHTMLTextAreaElement.cpp:224) 4 com.apple.JavaScriptCore 0x0048ffc4 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 116 (object.cpp:99) 5 com.apple.JavaScriptCore 0x00481b68 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 616 (nodes.cpp:758) 6 com.apple.JavaScriptCore 0x004863b8 KJS::ExprStatementNode::execute(KJS::ExecState*) + 104 (nodes.cpp:1662) 7 com.apple.JavaScriptCore 0x00489a5c KJS::SourceElementsNode::execute(KJS::ExecState*) + 252 (nodes.cpp:2442) 8 com.apple.JavaScriptCore 0x004862e8 KJS::BlockNode::execute(KJS::ExecState*) + 152 (nodes.cpp:1638) 9 com.apple.JavaScriptCore 0x00486648 KJS::IfNode::execute(KJS::ExecState*) + 408 (nodes.cpp:1680) 10 com.apple.JavaScriptCore 0x00486694 KJS::IfNode::execute(KJS::ExecState*) + 484 (nodes.cpp:1687) 11 com.apple.JavaScriptCore 0x00486694 KJS::IfNode::execute(KJS::ExecState*) + 484 (nodes.cpp:1687) 12 com.apple.JavaScriptCore 0x00486694 KJS::IfNode::execute(KJS::ExecState*) + 484 (nodes.cpp:1687) 13 com.apple.JavaScriptCore 0x00489b48 KJS::SourceElementsNode::execute(KJS::ExecState*) + 488 (completion.h:53) 14 com.apple.JavaScriptCore 0x004862e8 KJS::BlockNode::execute(KJS::ExecState*) + 152 (nodes.cpp:1638) 15 com.apple.JavaScriptCore 0x00472268 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 56 (completion.h:53) 16 com.apple.JavaScriptCore 0x00471b00 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 448 (ExecState.h:75) 17 com.apple.JavaScriptCore 0x0048ffc4 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 116 (object.cpp:99) 18 com.apple.JavaScriptCore 0x00482308 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 568 (nodes.cpp:665) 19 com.apple.JavaScriptCore 0x004863b8 KJS::ExprStatementNode::execute(KJS::ExecState*) + 104 (nodes.cpp:1662) 20 com.apple.JavaScriptCore 0x00489b48 KJS::SourceElementsNode::execute(KJS::ExecState*) + 488 (completion.h:53) 21 com.apple.JavaScriptCore 0x004862e8 KJS::BlockNode::execute(KJS::ExecState*) + 152 (nodes.cpp:1638) 22 com.apple.JavaScriptCore 0x00476438 KJS::Interpreter::evaluate(KJS::UString const&, int, KJS::UChar const*, int, KJS::JSValue*) + 904 (RefPtr.h:45) 23 com.apple.WebCore 0x012cae90 WebCore::KJSProxy::evaluate(WebCore::String const&, int, WebCore::String const&, WebCore::Node*) + 288 (RefPtr.h:41) 24 com.apple.WebCore 0x010e2794 WebCore::Frame::executeScript(WebCore::String const&, int, WebCore::Node*, DeprecatedString const&) + 84 (RefPtr.h:41) 25 com.apple.WebCore 0x01036a30 WebCore::HTMLTokenizer::scriptExecution(DeprecatedString const&, WebCore::HTMLTokenizer::State, DeprecatedString, int) + 320 (RefPtr.h:41) 26 com.apple.WebCore 0x0103751c WebCore::HTMLTokenizer::scriptHandler(WebCore::HTMLTokenizer::State) + 1612 (HTMLTokenizer.cpp:434) 27 com.apple.WebCore 0x01037848 WebCore::HTMLTokenizer::parseSpecial(WebCore::SegmentedString&, WebCore::HTMLTokenizer::State) + 536 (HTMLTokenizer.cpp:292) 28 com.apple.WebCore 0x010397d4 WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&, WebCore::HTMLTokenizer::State) + 6676 (HTMLTokenizer.cpp:1214) 29 com.apple.WebCore 0x0103a0d4 WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&, bool) + 1172 (HTMLTokenizer.cpp:1428) 30 com.apple.WebCore 0x01036dc8 WebCore::HTMLTokenizer::notifyFinished(WebCore::CachedObject*) + 584 (DeprecatedValueList.h:87) 31 com.apple.WebCore 0x0112f548 WebCore::CachedScript::checkNotify() + 88 (CachedScript.cpp:109) 32 com.apple.WebCore 0x0112f9fc WebCore::CachedScript::data(WTF::Vector<char, (unsigned long)0>&, bool) + 236 (CachedScript.cpp:101) 33 com.apple.WebCore 0x01131bcc WebCore::Loader::receivedAllData(WebCore::TransferJob*, NSData*) + 300 (loader.cpp:139) 34 com.apple.WebCore 0x0104ae24 -[KWQResourceLoader finishJobAndHandle:] + 116 (KWQResourceLoader.mm:98) 35 com.apple.WebKit 0x003242f0 -[WebSubresourceLoader didFinishLoading] + 80 36 com.apple.WebKit 0x003260ec -[WebLoader connectionDidFinishLoading:] + 44 (WebLoader.m:575) 37 com.apple.Foundation 0x9297684c -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback] + 188 38 com.apple.Foundation 0x92974ab8 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 556 39 com.apple.Foundation 0x92974810 _sendCallbacks + 156 40 com.apple.CoreFoundation 0x907dc4cc __CFRunLoopDoSources0 + 384 41 com.apple.CoreFoundation 0x907db9fc __CFRunLoopRun + 452 42 com.apple.CoreFoundation 0x907db47c CFRunLoopRunSpecific + 268 43 com.apple.HIToolbox 0x931eb740 RunCurrentEventLoopInMode + 264 44 com.apple.HIToolbox 0x931eadd4 ReceiveNextEventCommon + 380 45 com.apple.HIToolbox 0x931eac40 BlockUntilNextEventMatchingListInMode + 96 46 com.apple.AppKit 0x936eeae4 _DPSNextEvent + 384 47 com.apple.AppKit 0x936ee7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116 48 com.apple.SafariDev 0x00006740 0x1000 + 22336 49 com.apple.AppKit 0x936eacec -[NSApplication run] + 472 50 com.apple.AppKit 0x937db87c NSApplicationMain + 452 51 com.apple.SafariDev 0x0005c77c 0x1000 + 374652 52 com.apple.SafariDev 0x0005c624 0x1000 + 374308

Attachments
Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2006-07-04 02:40:53 PDT

*** This bug has been marked as a duplicate of 9707 ***

Note You need to log in before you can comment on or make changes to this bug.