Bug 109837 - Crash in iOS Safari and Chrome with overflow styles set on TD element
Summary: Crash in iOS Safari and Chrome with overflow styles set on TD element
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Other Other
: P1 Critical
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2013-02-14 08:28 PST by GaryO
Modified: 2013-02-15 01:44 PST (History)
2 users (show)

See Also:

Attachments
HTML file that demonstrates the crash (573 bytes, text/html)
2013-02-14 08:28 PST, GaryO 		no flags Details
Crash log for Safari on iOS when processing the HTML also attached to this bug. (39.47 KB, text/plain)
2013-02-15 01:44 PST, GaryO 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GaryO 2013-02-14 08:28:58 PST 
Created attachment 188361 [details]
HTML file that demonstrates the crash

The following HTML crashes both Safari and Chrome (AppleWebKit/536.26 tested) immeidately on loading.  The issue occurs when a TD element with an overflow-x CSS style applied is nested within an element that has the "-webkit-overflow-scrolling: touch;" style applied.

The issue seems to only happen for TD elements, and only when the overflow-x style is set to something other than "visible" (the default). 

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html lang="en-us">
<head>
    <title>Overflow webkit bug</title>
</head>
<body>
    <style>
        .parent { -webkit-overflow-scrolling: touch; }
        .child { overflow-x:hidden; }
    </style>
    <div class="parent">
       <table>
                <tr >
                    <td class="child">Hi there!</td>
                </tr>
        </table> 
    </div>
</body>
</html>
Comment 1 Alexey Proskuryakov 2013-02-14 12:15:44 PST 
<rdar://problem/13218066>
Comment 2 Alexey Proskuryakov 2013-02-14 12:18:13 PST 
Please file bugs that only affect iOS WebKit directly to Apple via <http://bugreport.apple.com>. iOS WebKit is not directly built from webkit.org source code, so we cannot track its bugs here.

I moved this bug to Apple's internal database. Closing as INVALID per the above policy.
Comment 3 Matt Lilek 2013-02-14 19:48:44 PST 
Exactly which version of iOS are you seeing this on and can you attach a crash log from when this happens?
Comment 4 GaryO 2013-02-15 01:41:11 PST 
(In reply to comment #3)
> Exactly which version of iOS are you seeing this on and can you attach a crash log from when this happens?

Currently only able to test personally on iOS 6.1 (iPad 2), but have been advised by a colleage that the simulator also crashes.  I will add the crash log he provided for info.  
Note that we have already reported to Apple, so not expecting any further action here.  I have also confirmed that Chrome on Android (JB on Nexus7) does not have the issue seems to be an Apple-specific issue.
Comment 5 GaryO 2013-02-15 01:44:24 PST 
Created attachment 188511 [details]
Crash log for Safari on iOS when processing the HTML also attached to this bug.