Bug 106203 - [Shadow DOM]: crash in WebCore::ElementShadow::setValidityUndetermined
Summary: [Shadow DOM]: crash in WebCore::ElementShadow::setValidityUndetermined
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Takashi Sakamoto
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-06 18:31 PST by Takashi Sakamoto
Modified: 2013-01-06 22:11 PST (History)
3 users (show)

See Also:


Attachments
Patch (3.54 KB, patch)
2013-01-06 20:09 PST, Takashi Sakamoto
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Takashi Sakamoto 2013-01-06 18:31:21 PST
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=151773592

Fuzzer: Webcomponents_fuzzer

Crash Type: UNKNOWN
Crash Address: 0x000000000028
Crash State:
  - crash stack -
  WebCore::ElementShadow::setValidityUndetermined
  WebCore::InsertionPoint::insertedInto
  WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?range=172434:172624

Minimized Testcase (14.93 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96qsWtbBREqcvnVZLzeb1hqnpJdPv11ntaNeWQvD55iVBhetKZnBKcu-vVDLfWrjeDJJ6ECsJdX722HqN6PTtrSXfe5ku2petIQc_u47mLS6YEg6q7QXY2eJ8E8OL5LciBp1HKK2fXwrQqQ_o4rOPwApEFzxRnjj83ER5Sux8IO0DYIa3I
Comment 1 Takashi Sakamoto 2013-01-06 20:09:06 PST
Created attachment 181469 [details]
Patch
Comment 2 WebKit Review Bot 2013-01-06 22:11:47 PST
Comment on attachment 181469 [details]
Patch

Clearing flags on attachment: 181469

Committed r138923: <http://trac.webkit.org/changeset/138923>
Comment 3 WebKit Review Bot 2013-01-06 22:11:50 PST
All reviewed patches have been landed.  Closing bug.