Bug 144371 - Reproducible crash removing name attribute from <img> node
Summary: Reproducible crash removing name attribute from <img> node
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.10
: P2 Normal
Assignee: Andreas Kling
Keywords: InRadar
Depends on:
Reported: 2015-04-28 19:31 PDT by Neil Jenkins
Modified: 2015-05-01 18:30 PDT (History)
4 users (show)

See Also:

Minimal test case to crash Safari (271 bytes, text/html)
2015-04-28 19:31 PDT, Neil Jenkins
no flags Details
Patch (6.94 KB, patch)
2015-05-01 16:23 PDT, Andreas Kling
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Neil Jenkins 2015-04-28 19:31:20 PDT
Created attachment 251916 [details]
Minimal test case to crash Safari

Steps to reproduce (or see attached minimal test case):

1. Create a document using document.implementation.createHTMLDocument('')
2. Add an image node to this document with both a name and an id attribute.
3. Attempt to remove the name attribute from the image node.

Expected result:

The name attribute is removed. Safari does not crash.

Actual result:

Safari crashes.

This reproduces in the latest stable Safari (8.0.5) on both OS X and iOS.
Comment 1 Alexey Proskuryakov 2015-04-28 22:29:40 PDT
Thank you, nice test case!

Comment 2 Andreas Kling 2015-05-01 16:23:35 PDT
Created attachment 252190 [details]
Comment 3 WebKit Commit Bot 2015-05-01 18:30:47 PDT
Comment on attachment 252190 [details]

Clearing flags on attachment: 252190

Committed r183706: <http://trac.webkit.org/changeset/183706>
Comment 4 WebKit Commit Bot 2015-05-01 18:30:51 PDT
All reviewed patches have been landed.  Closing bug.