Bug 19757 - Crash when an ondragstart handler hides the element
Summary: Crash when an ondragstart handler hides the element
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Critical
Assignee: Oliver Hunt
URL: http://www.eyesee360.com/mjr/wkdragcr...
Keywords:
Depends on:
Blocks:
 
Reported: 2008-06-24 15:51 PDT by Michael Rondinelli
Modified: 2008-07-20 14:33 PDT (History)
0 users

See Also:

Attachments
Sample HTML file that will invoke the crash on a drag event. (452 bytes, text/html)
2008-06-24 15:51 PDT, Michael Rondinelli 		no flags Details
Null check the renderer (2.34 KB, patch)
2008-07-20 00:51 PDT, Oliver Hunt 		mitz: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Rondinelli 2008-06-24 15:51:05 PDT 
Using the ondragstart event handler, a crash can be invoked by simply setting this.style.display = 'none'. 

The referenced page shows a simple example. Drag the indicated box to cause WebKit to crash. This has been verified to work on shipping Safari 3.1 on Leopard and the latest nightly build (r34753).
Comment 1 Michael Rondinelli 2008-06-24 15:51:43 PDT 
Created attachment 21917 [details]
Sample HTML file that will invoke the crash on a drag event.
Comment 2 Alexey Proskuryakov 2008-06-25 02:44:02 PDT 
On a debug build, I'm seeing an assertion failure:

ASSERTION FAILED: Uncaught exception - Can't cache image
0
(/Users/ap/Safari/OpenSource/WebCore/platform/mac/BlockExceptions.mm:36 void ReportBlockedObjCException(NSException*))
Comment 3 Oliver Hunt 2008-07-20 00:51:00 PDT 
Created attachment 22385 [details]
Null check the renderer
Comment 4 mitz 2008-07-20 14:24:00 PDT 
Comment on attachment 22385 [details]
Null check the renderer

r=me
Comment 5 Oliver Hunt 2008-07-20 14:33:29 PDT 
Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	WebCore/ChangeLog
	M	WebCore/page/EventHandler.cpp
Committed r35256