Bug 19745 - Crash caused by DOM modification
: Crash caused by DOM modification
Status: RESOLVED FIXED
: WebKit
New Bugs
: 525.x (Safari 3.1)
: PC Windows Vista
: P1 Normal
Assigned To:
: http://skypher.com/SkyLined/Repro/Saf...
: HasReduction
:
:
  Show dependency treegraph
 
Reported: 2008-06-24 08:12 PST by
Modified: 2009-07-22 12:10 PST (History)


Attachments


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2008-06-24 08:12:36 PST
The following HTML causes an Access Violation in Safari 3.1.1:

<BODY onload="go()"><SCRIPT>
    function go() {
        document.body.outerHTML='';
        document.createElement('map').innerHTML='<frameSet></frameSet><em><div><link></div></em><head></head><html>';
    }
</SCRIPT></BODY>
------- Comment #1 From 2009-07-22 12:10:53 PST -------
This does not reproduce in ToT WebKit.  Marking as RESOLVED/FIXED.