Bug 113016 - HTMLStackItem should include <template> as a special tag
: HTMLStackItem should include <template> as a special tag
Status: RESOLVED FIXED
: WebKit
HTML DOM
: 528+ (Nightly build)
: Unspecified Unspecified
: P1 Normal
Assigned To:
:
:
:
:
  Show dependency treegraph
 
Reported: 2013-03-22 01:00 PST by
Modified: 2013-03-26 10:26 PST (History)


Attachments
repro.html (46 bytes, text/html)
2013-03-22 01:02 PST, Takashi Sakamoto
no flags Details
Patch (2.54 KB, patch)
2013-03-22 09:46 PST, Rafael Weinstein
no flags Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2013-03-22 01:00:39 PST
Timestamp    2013-03-14 03:00:22
Fuzzer     Dstockwell-css-fuzzer
Job Type    Linux_asan_drt
Crash type    UNKNOWN
Crash address    0x000000000000
Crash state    - crash stack -
WebCore::HTMLStackItem::HTMLStackItem
WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately
WebCore::HTMLTreeBuilder::processTemplateEndTag
Redzone     32 bytes

https://cluster-fuzz.appspot.com/testcase?key=171557060
------- Comment #1 From 2013-03-22 01:02:08 PST -------
Created an attachment (id=194463) [details]
repro.html
------- Comment #2 From 2013-03-22 01:04:47 PST -------
I guess, the crash reason would be that HTMLTreeBuilder::processAnyOtherEndTagForInBody checks items out of <template>.
------- Comment #3 From 2013-03-22 01:09:59 PST -------
When token type is end and toke name is dummy (c.f. repro.html),

processAnyOtherEndTagForInBody(dummy), mode(7)
HTMLStackItem(span)
HTMLStackItem(template)
HTMLStackItem(dummy) <---- this dummy will be removed, but this is not a child of <template>.
------- Comment #4 From 2013-03-22 09:45:25 PST -------
This is an oversight in the implementation of template element. Note the spec instructs that <template> should be considered a "special" tag:

https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html#parsing
------- Comment #5 From 2013-03-22 09:46:46 PST -------
Created an attachment (id=194575) [details]
Patch
------- Comment #6 From 2013-03-24 15:49:16 PST -------
ping.
------- Comment #7 From 2013-03-26 10:21:11 PST -------
(From update of attachment 194575 [details])
Thanks.
------- Comment #8 From 2013-03-26 10:26:33 PST -------
(From update of attachment 194575 [details])
Clearing flags on attachment: 194575

Committed r146904: <http://trac.webkit.org/changeset/146904>
------- Comment #9 From 2013-03-26 10:26:36 PST -------
All reviewed patches have been landed.  Closing bug.