Bug 12582 - REGRESSION: Unclosed <title> makes the window display garbage or empty title
Summary: REGRESSION: Unclosed <title> makes the window display garbage or empty title
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Alexey Proskuryakov
URL:
Keywords: InRadar, Regression
Depends on:
Blocks:
 
Reported: 2007-02-04 07:46 PST by Alexey Proskuryakov
Modified: 2007-02-07 12:27 PST (History)
1 user (show)

See Also:


Attachments
test case (64 bytes, text/html)
2007-02-04 07:46 PST, Alexey Proskuryakov
no flags Details
proposed fix (1.23 KB, patch)
2007-02-07 11:50 PST, Alexey Proskuryakov
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2007-02-04 07:46:26 PST
Steps to reproduce: reload the attached document several times. The window title will be blank, or will display garbage intermittently.

The is a regression from shipping WebKit, where the file name is used as window title.
Comment 1 Alexey Proskuryakov 2007-02-04 07:46:57 PST
Created attachment 12916 [details]
test case
Comment 2 Maciej Stachowiak 2007-02-04 11:51:10 PST
<rdar://problem/4975135>
Comment 3 David Kilzer (:ddkilzer) 2007-02-04 12:24:02 PST
Similar/related to Bug 3905.

Comment 4 Maciej Stachowiak 2007-02-07 00:35:29 PST
Does this affect real-world sites?
Comment 5 Alexey Proskuryakov 2007-02-07 01:22:18 PST
> Does this affect real-world sites?

I am not aware of any such sites. Discovered by accident when making a test case for another bug.
Comment 6 Alexey Proskuryakov 2007-02-07 11:50:25 PST
Created attachment 13012 [details]
proposed fix
Comment 7 Darin Adler 2007-02-07 11:56:22 PST
Comment on attachment 13012 [details]
proposed fix

How does this patch help?

It looks to me like if i == length then the for loop won't do anything, the while loop won't do anything, and the following if statement will return "" anyway. So this patch would have no effect.
Comment 8 Alexey Proskuryakov 2007-02-07 12:03:29 PST
Comment on attachment 13012 [details]
proposed fix

In this case, the if statement doesn't return "": (!builderIndex && stringBuilder[builderIndex] == ' ') is false when stringBuilder[0] equals '\n', for example.
Comment 9 Darin Adler 2007-02-07 12:19:10 PST
Comment on attachment 13012 [details]
proposed fix

OK.

I'm convinced this is correct. Let me note in passing that I'm unhappy with the structure and readability of the function.

It took me a really long time studying the code to understand why it's OK to look at stringBuilder[builderIndex] when builderIndex is 0, even though that's "off the end of the array".
Comment 10 Alexey Proskuryakov 2007-02-07 12:27:02 PST
Committed revision 19473.