Bug 24008 – Crash on list hover. CSS issue.

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: New Bugs

[Daniel Samuels]

When the user hovers over the top element and then moves the cursor down onto the element which appears, WebKit will crash.

I have simplified the following code to the bare minimum required for the crash to occur.

<style type="text/css" media="screen">
.nav li {
	display: inline;
}
.nav .primary_nav li ul {
	width: 160px;
	display: none;
}
.nav .primary_nav li:hover ul {
	display: block;
}
</style>
<div class="nav">	
	<ul class="primary_nav">
		<li class="drop">
			<!-- The crash has something to do with the width of this element. -->
			<!-- When the mouse moves off of the right edge of this element, it crashes. -->
			<a href="#">1234567890</a>
			<ul>
				<!-- The length of this element makes a difference too. -->
				<!-- The mouse must move from one element straight into the other. -->
				<li><a href="#">987654321</a></li>
			</ul>
		</li>
	</ul>
</div>

[Mark Rowe (bdash)]

Can you please attach the test case as a file to the bug report, and also attach a crash log?  <http://webkit.org/quality/crashlogs.html> has details.

[Daniel Samuels]

Created attachment 27766 [details]
Test file

[Daniel Samuels]

Created attachment 27767 [details]
Crash report

[Daniel Samuels]

Requested files added.

[Mark Rowe (bdash)]

<rdar://problem/6600978>

[Josh L]

Possibly related - the following CSS will leave visual artifacts in Webkit (both Safari and Chrome):

li:hover {
	margin: -1px 0px -1px 0px;
	border: 1px solid #86a3bf;
	border-width: 1px 0px 1px 0px;
	background: transparent url(blank.gif) no-repeat scroll 0px 0px;
}

[Shane Stephens]

Is this fixed?  I can't repro on Snow Leopard, either in release or head.

[Alexey Proskuryakov]

I also can't reproduce in Safari 5.0.3. We've had a number of fixes for similar issues, so this seems to have been taken care of indirectly.