Bug 13416 - Repro crash after referencing the user stylesheet from JavaScript
Summary: Repro crash after referencing the user stylesheet from JavaScript
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 523.x (Safari 3)
Hardware: Mac OS X 10.4
: P1 Major
Assignee: Nobody
URL:
Keywords: HasReduction
Depends on:
Blocks:
 
Reported: 2007-04-20 03:17 PDT by mitz
Modified: 2007-04-21 01:31 PDT (History)
0 users

See Also:

Attachments
User stylesheet for reproducing (24 bytes, text/css)
2007-04-20 03:18 PDT, mitz 		no flags Details
HTML for reproducing (will crash when the user stylesheet is set) (364 bytes, text/html)
2007-04-20 03:19 PDT, mitz 		no flags Details
Change m_userSheet into a RefPtr (2.31 KB, patch)
2007-04-20 03:20 PDT, mitz 		darin: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2007-04-20 03:17:56 PDT 
Referencing the user stylesheet from JavaScript can lead to a browser crash. To reproduce the crash:
1) Download the attached stylesheet.
2) In Safari Preferences > Advanced > Style Sheet, choose the stylesheet you downloaded in step 1).
3) Open the attached reduction.

Patch forthcoming.
Comment 1 mitz 2007-04-20 03:18:45 PDT 
Created attachment 14104 [details]
User stylesheet for reproducing
Comment 2 mitz 2007-04-20 03:19:23 PDT 
Created attachment 14105 [details]
HTML for reproducing (will crash when the user stylesheet is set)
Comment 3 mitz 2007-04-20 03:20:10 PDT 
Created attachment 14106 [details]
Change m_userSheet into a RefPtr
Comment 4 Darin Adler 2007-04-20 08:05:18 PDT 
Comment on attachment 14106 [details]
Change m_userSheet into a RefPtr

r=me
Comment 5 Mark Rowe (bdash) 2007-04-21 01:31:44 PDT 
Landed in r20992.