Bug 113016 - HTMLStackItem should include <template> as a special tag
: HTMLStackItem should include <template> as a special tag
Status: RESOLVED FIXED
Product: WebKit
Classification: Unclassified
Component: HTML DOM
: 528+ (Nightly build)
: Unspecified Unspecified
: P1 Normal
Assigned To: Rafael Weinstein
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-03-22 01:00 PDT by Takashi Sakamoto
Modified: 2013-03-26 10:26 PDT (History)
8 users (show)

See Also:


Attachments
repro.html (46 bytes, text/html)
2013-03-22 01:02 PDT, Takashi Sakamoto
no flags Details
Patch (2.54 KB, patch)
2013-03-22 09:46 PDT, Rafael Weinstein
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Takashi Sakamoto 2013-03-22 01:00:39 PDT
Timestamp	2013-03-14 03:00:22
Fuzzer	 Dstockwell-css-fuzzer
Job Type	Linux_asan_drt
Crash type	UNKNOWN
Crash address	0x000000000000
Crash state	- crash stack -
WebCore::HTMLStackItem::HTMLStackItem
WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately
WebCore::HTMLTreeBuilder::processTemplateEndTag
Redzone	 32 bytes

https://cluster-fuzz.appspot.com/testcase?key=171557060
Comment 1 Takashi Sakamoto 2013-03-22 01:02:08 PDT
Created attachment 194463 [details]
repro.html
Comment 2 Takashi Sakamoto 2013-03-22 01:04:47 PDT
I guess, the crash reason would be that HTMLTreeBuilder::processAnyOtherEndTagForInBody checks items out of <template>.
Comment 3 Takashi Sakamoto 2013-03-22 01:09:59 PDT
When token type is end and toke name is dummy (c.f. repro.html),

processAnyOtherEndTagForInBody(dummy), mode(7)
HTMLStackItem(span)
HTMLStackItem(template)
HTMLStackItem(dummy) <---- this dummy will be removed, but this is not a child of <template>.
Comment 4 Rafael Weinstein 2013-03-22 09:45:25 PDT
This is an oversight in the implementation of template element. Note the spec instructs that <template> should be considered a "special" tag:

https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html#parsing
Comment 5 Rafael Weinstein 2013-03-22 09:46:46 PDT
Created attachment 194575 [details]
Patch
Comment 6 Rafael Weinstein 2013-03-24 15:49:16 PDT
ping.
Comment 7 Eric Seidel 2013-03-26 10:21:11 PDT
Comment on attachment 194575 [details]
Patch

Thanks.
Comment 8 WebKit Review Bot 2013-03-26 10:26:33 PDT
Comment on attachment 194575 [details]
Patch

Clearing flags on attachment: 194575

Committed r146904: <http://trac.webkit.org/changeset/146904>
Comment 9 WebKit Review Bot 2013-03-26 10:26:36 PDT
All reviewed patches have been landed.  Closing bug.