Bug 25096 – CRASH in WebCore::appendChildToContainer

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Jon@Chromium]

100% Reproducible at http://www.wdr.de/mediathek/html/regional/ergebnisse/sendung.xml and 
http://www.wdr.de/mediathek/html/regional/ergebnisse/datum.xml

Process:         Safari [24073]
Path:            /Users/jonc/Desktop/WebKit.app/Contents/MacOS/WebKit
Identifier:      org.webkit.nightly.WebKit
Version:         r42260 (42260)
Code Type:       X86 (Native)
Parent Process:  launchd [19977]

Date/Time:       2009-04-08 10:33:32.508 -0700
OS Version:      Mac OS X 10.5.6 (9G55)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000000c
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore             	0x00effc89 void WebCore::appendChildToContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::Node*, WebCore::ContainerNode*) + 9
1   com.apple.WebCore             	0x00efd881 WebCore::ContainerNode::addChild(WTF::PassRefPtr<WebCore::Node>) + 49
2   com.apple.WebCore             	0x00f33792 WebCore::DOMImplementation::createDocument(WebCore::String const&, WebCore::String const&, WebCore::DocumentType*, int&) + 498
3   com.apple.WebCore             	0x01153b68 WebCore::jsDOMImplementationPrototypeFunctionCreateDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, JSC::ArgList const&) + 280
4   com.apple.JavaScriptCore      	0x00557392 JSC::JITStubs::cti_op_call_NotJSFunction(void*, ...) + 594
5   ???                           	0x1b4233bc 0 + 457323452
6   com.apple.JavaScriptCore      	0x0051382b JSC::Interpreter::execute(JSC::ProgramNode*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*, JSC::JSValuePtr*) + 491
7   com.apple.JavaScriptCore      	0x004f12d6 JSC::evaluate(JSC::ExecState*, JSC::ScopeChain&, JSC::SourceCode const&, JSC::JSValuePtr) + 358
8   com.apple.WebCore             	0x014b97d4 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 260
9   com.apple.WebCore             	0x014bb8e5 WebCore::ScriptElementData::evaluateScript(WebCore::ScriptSourceCode const&) + 133
10  com.apple.WebCore             	0x014bc1c1 WebCore::ScriptElementData::notifyFinished(WebCore::CachedResource*) + 337
11  com.apple.WebCore             	0x00edf76c WebCore::CachedScript::checkNotify() + 60
12  com.apple.WebCore             	0x0156f4d8 WebCore::Loader::Host::didFinishLoading(WebCore::SubresourceLoader*) + 360
13  com.apple.WebCore             	0x014e8b2d WebCore::SubresourceLoader::didFinishLoading() + 45
14  com.apple.Foundation          	0x939b4cd7 -[NSURLConnection(NSURLConnectionReallyInternal) sendDidFinishLoading] + 87
15  com.apple.Foundation          	0x939b4c43 _NSURLConnectionDidFinishLoading + 147
16  com.apple.CFNetwork           	0x963bc1f4 URLConnectionClient::clientDidFinishLoading() + 174
17  com.apple.CFNetwork           	0x963bad31 URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 281
18  com.apple.CFNetwork           	0x963bbd70 URLConnectionClient::processEvents() + 114
19  com.apple.CFNetwork           	0x9636bb6b MultiplexerSource::perform() + 189
20  com.apple.CoreFoundation      	0x90e255f5 CFRunLoopRunSpecific + 3141
21  com.apple.CoreFoundation      	0x90e25cd8 CFRunLoopRunInMode + 88
22  com.apple.HIToolbox           	0x90f162c0 RunCurrentEventLoopInMode + 283
23  com.apple.HIToolbox           	0x90f160d9 ReceiveNextEventCommon + 374
24  com.apple.HIToolbox           	0x90f15f4d BlockUntilNextEventMatchingListInMode + 106
25  com.apple.AppKit              	0x942f7d7d _DPSNextEvent + 657
26  com.apple.AppKit              	0x942f7630 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
27  com.apple.Safari              	0x0002ceee 0x1000 + 179950
28  com.apple.AppKit              	0x942f066b -[NSApplication run] + 795
29  com.apple.AppKit              	0x942bd8a4 NSApplicationMain + 574
30  com.apple.Safari              	0x00003306 0x1000 + 8966

Thread 1:
0   libSystem.B.dylib             	0x912be3ae __semwait_signal + 10
1   libSystem.B.dylib             	0x912e8d0d pthread_cond_wait$UNIX2003 + 73
2   com.apple.WebCore             	0x010e52b4 WebCore::IconDatabase::syncThreadMainLoop() + 244
3   com.apple.WebCore             	0x010e53c5 WebCore::IconDatabase::iconDatabaseSyncThread() + 181
4   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
5   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 2:
0   libSystem.B.dylib             	0x912b71c6 mach_msg_trap + 10
1   libSystem.B.dylib             	0x912be9bc mach_msg + 72
2   com.apple.CoreFoundation      	0x90e250ae CFRunLoopRunSpecific + 1790
3   com.apple.CoreFoundation      	0x90e25cd8 CFRunLoopRunInMode + 88
4   com.apple.CFNetwork           	0x9633febe CFURLCacheWorkerThread(void*) + 396
5   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
6   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 3:
0   libSystem.B.dylib             	0x912b71c6 mach_msg_trap + 10
1   libSystem.B.dylib             	0x912be9bc mach_msg + 72
2   com.google.Gears              	0x135bfbfd google_breakpad::ExceptionHandler::WaitForMessage(void*) + 125
3   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
4   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 4:
0   libSystem.B.dylib             	0x912be3ae __semwait_signal + 10
1   libSystem.B.dylib             	0x912e8d0d pthread_cond_wait$UNIX2003 + 73
2   com.apple.JavaScriptCore      	0x0057ed5d WTF::ThreadCondition::timedWait(WTF::Mutex&, double) + 77
3   com.apple.WebCore             	0x01308295 WebCore::LocalStorageThread::localStorageThread() + 325
4   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
5   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 5:
0   libSystem.B.dylib             	0x912b71c6 mach_msg_trap + 10
1   libSystem.B.dylib             	0x912be9bc mach_msg + 72
2   com.apple.CoreFoundation      	0x90e250ae CFRunLoopRunSpecific + 1790
3   com.apple.CoreFoundation      	0x90e25cd8 CFRunLoopRunInMode + 88
4   com.apple.Safari              	0x00188f9d 0x1000 + 1605533
5   com.apple.Safari              	0x001866f3 0x1000 + 1595123
6   com.apple.Safari              	0x001867a1 0x1000 + 1595297
7   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
8   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 6:
0   libSystem.B.dylib             	0x912b71c6 mach_msg_trap + 10
1   libSystem.B.dylib             	0x912be9bc mach_msg + 72
2   com.apple.CoreFoundation      	0x90e250ae CFRunLoopRunSpecific + 1790
3   com.apple.CoreFoundation      	0x90e25cd8 CFRunLoopRunInMode + 88
4   com.apple.Foundation          	0x939b2d40 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] + 320
5   com.apple.Foundation          	0x9394f7ed -[NSThread main] + 45
6   com.apple.Foundation          	0x9394f394 __NSThread__main__ + 308
7   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
8   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 7:
0   libSystem.B.dylib             	0x913066f2 select$DARWIN_EXTSN + 10
1   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
2   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 8:
0   libSystem.B.dylib             	0x912be3ae __semwait_signal + 10
1   libSystem.B.dylib             	0x912e8d0d pthread_cond_wait$UNIX2003 + 73
2   com.apple.Safari              	0x000f1cdb 0x1000 + 986331
3   com.apple.Safari              	0x000f2321 0x1000 + 987937
4   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
5   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 9:
0   libSystem.B.dylib             	0x912be3ae __semwait_signal + 10
1   libSystem.B.dylib             	0x912e8d0d pthread_cond_wait$UNIX2003 + 73
2   libGLProgrammability.dylib    	0x923d2b32 glvmDoWork + 162
3   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
4   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 10:
0   libSystem.B.dylib             	0x912be3ae __semwait_signal + 10
1   libSystem.B.dylib             	0x912e8d0d pthread_cond_wait$UNIX2003 + 73
2   com.apple.ColorSync           	0x96b7145c pthreadSemaphoreWait(t_pthreadSemaphore*) + 42
3   com.apple.ColorSync           	0x96b83d8e CMMConvTask(void*) + 54
4   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
5   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 11:
0   libSystem.B.dylib             	0x912e7906 kevent + 10
1   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
2   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 12:
0   libSystem.B.dylib             	0x913066f2 select$DARWIN_EXTSN + 10
1   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
2   libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 13:
0   libSystem.B.dylib             	0x912b71c6 mach_msg_trap + 10
1   libSystem.B.dylib             	0x912be9bc mach_msg + 72
2   com.apple.CoreFoundation      	0x90e250ae CFRunLoopRunSpecific + 1790
3   com.apple.CoreFoundation      	0x90e25cd8 CFRunLoopRunInMode + 88
4   com.apple.Foundation          	0x93983d75 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 213
5   com.apple.Foundation          	0x9398fe94 -[NSRunLoop(NSRunLoop) run] + 84
6   com.apple.Safari              	0x00033210 0x1000 + 205328
7   com.apple.Foundation          	0x9394f7ed -[NSThread main] + 45
8   com.apple.Foundation          	0x9394f394 __NSThread__main__ + 308
9   libSystem.B.dylib             	0x912e8095 _pthread_start + 321
10  libSystem.B.dylib             	0x912e7f52 thread_start + 34

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0x00000000  ebx: 0x00f335ae  ecx: 0x1c9e4000  edx: 0x00000000
  edi: 0x00000000  esi: 0x1c9e4000  ebp: 0xbfffe168  esp: 0xbfffe168
   ss: 0x0000001f  efl: 0x00010246  eip: 0x00effc89   cs: 0x00000017
   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
  cr2: 0x0000000c

Binary Images:
    0x1000 -   0x266fe2  com.apple.Safari 4 Public Beta (5528.16) <88923208ea437fc8b5a5e5cd4f1924d5> /Applications/Safari.app/Contents/MacOS/Safari
  0x2c1000 -   0x2c2ffe +WebKitNightlyEnabler.dylib ??? (???) <d950bf1dff6c8bb72292ff040de9f3c9> /Users/jonc/Desktop/WebKit.app/Contents/Resources/WebKitNightlyEnabler.dylib
  0x2c7000 -   0x39dff7  com.apple.WebKit r42260 (530.6+) <35670c455a77a08ab53e38eb0fc79d3c> /Users/jonc/Desktop/WebKit.app/Contents/Frameworks/10.5/WebKit.framework/Versions/A/WebKit
  0x431000 -   0x440ffc  SyndicationUI ??? (???) <408d1e186315965e65a4562de17589be> /System/Library/PrivateFrameworks/SyndicationUI.framework/Versions/A/SyndicationUI
  0x450000 -   0x59efeb  com.apple.JavaScriptCore 530+ (530.6+) <f4d3139c4009ff2d8ae449ed6cec0f3b> /Users/jonc/Desktop/WebKit.app/Contents/Frameworks/10.5/JavaScriptCore.framework/Versions/A/JavaScriptCore
  0x5ef000 -   0x602fff +org.andymatuschak.Sparkle 1.5 Beta (bzr) (337) <d57260aef46cb3000f771d53364e40c8> /Users/jonc/Desktop/WebKit.app/Contents/Frameworks/10.5/Sparkle.framework/Versions/A/Sparkle
  0x664000 -   0x664ff0 +com.google.GearsEnabler ??? (1.0) <d6cc29b13e4148c15c39078c482dd4bd> /Library/InputManagers/GearsEnabler/GearsEnabler.bundle/Contents/MacOS/GearsEnabler
  0x675000 -   0x675ff8 +com.google.Gears 1.0 (0.5.16.0) <7374cfc52fb0a51f7e9e7ab0a95625ae> /Library/Internet Plug-Ins/Gears.plugin/Contents/MacOS/libgears.dylib
  0x67a000 -   0x6a5ffb  libcurl.3.dylib ??? (???) <92c23039fbe46c86a58d55d4b9d2d3e2> /usr/lib/libcurl.3.dylib
  0xe0d000 -  0x16d9fff  com.apple.WebCore 530+ (530.6+) <7b9e1bd2c45ccb715d356d9c1960bc29> /Users/jonc/Desktop/WebKit.app/Contents/Frameworks/10.5/WebCore.framework/Versions/A/WebCore
 0x1ccf000 -  0x1cd4ff3  libCGXCoreImage.A.dylib ??? (???) <375e0cdb64b043378dbf637992bbfeb0> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGXCoreImage.A.dylib
0x132c5000 - 0x13497fe7  com.apple.RawCamera.bundle 2.0.10 (2.0.10) <fea6d22f985aec2f376d937291b54ecc> /System/Library/CoreServices/RawCamera.bundle/Contents/MacOS/RawCamera
0x1351c000 - 0x13731ff7 +com.google.Gears 1.0 (0.5.16.0) <cf84fd1c2b0a9047f0d20d20fcfa24a1> /Library/Internet Plug-Ins/Gears.plugin/Contents/Resources/Gears.bundle/Contents/MacOS/libgears.dylib
0x186e3000 - 0x186e3ffe  com.apple.JavaPluginCocoa 12.2.0 (12.2.0) <b08d1285182ffcbaedd747d17fdaeefd> /Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa
0x186e9000 - 0x186efffd  com.apple.JavaVM 12.2.2 (12.2.2) <9ad39149cc7ecc91da3e93df7f61d315> /System/Library/Frameworks/JavaVM.framework/Versions/A/JavaVM
0x19080000 - 0x19203fe3  GLEngine ??? (???) <bfbd7ce69ea896a6b38d6232b01cdeda> /System/Library/Frameworks/OpenGL.framework/Resources/GLEngine.bundle/GLEngine
0x19231000 - 0x194dbfe9  com.apple.ATIRadeonX1000GLDriver 1.5.36 (5.3.6) <3f9984c88184d39af0ed1e486ab4616a> /System/Library/Extensions/ATIRadeonX1000GLDriver.bundle/Contents/MacOS/ATIRadeonX1000GLDriver
0x19569000 - 0x19585ff7  GLRendererFloat ??? (???) <dcdc2e0de7fb9a52d99e529c3688f26d> /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLRendererFloat.bundle/GLRendererFloat
0x8fe00000 - 0x8fe2db43  dyld 97.1 (???) <100d362e03410f181a34e04e94189ae5> /usr/lib/dyld
0x90003000 - 0x90003ffe  com.apple.MonitorPanelFramework 1.2.0 (1.2.0) <1f4c10fcc17187a6f106e0a0be8236b0> /System/Library/PrivateFrameworks/MonitorPanel.framework/Versions/A/MonitorPanel
0x90037000 - 0x90048ffe  com.apple.CFOpenDirectory 10.5 (10.5) <4f1fe76bbb063b97eb78057f6be30d66> /System/Library/PrivateFrameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory
0x90113000 - 0x90155fef  com.apple.NavigationServices 3.5.2 (163) <72cdc9d21f6690837870923e7b8ca358> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x90193000 - 0x9019aff7  libCGATS.A.dylib ??? (???) <386dce4b28448fb86e33e06ac466f4d8> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x9019b000 - 0x9019ffff  libmathCommon.A.dylib ??? (???) /usr/lib/system/libmathCommon.A.dylib
0x901a0000 - 0x901bbffb  libPng.dylib ??? (???) <0d6b991afc831ea06f2958e5933d33dd> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x901bc000 - 0x901edffb  com.apple.quartzfilters 1.5.0 (1.5.0) <92b4f39479fdcabae0d8f53febd22fad> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuartzFilters.framework/Versions/A/QuartzFilters
0x901ee000 - 0x901faff9  com.apple.helpdata 1.0.1 (14.2) /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/HelpData
0x901fb000 - 0x902dcff7  libxml2.2.dylib ??? (???) <306036e0070330e35045650e6d9f0d05> /usr/lib/libxml2.2.dylib
0x902dd000 - 0x9035afef  libvMisc.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x9035b000 - 0x9039afff  com.apple.CoreMediaIOServicesPrivate 15.0 (15.0) /System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/CoreMediaIOServicesPrivate
0x9039b000 - 0x903baffa  libJPEG.dylib ??? (???) <b822342bcc764c83d4557a8b67fa0c1c> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x903bb000 - 0x903dffeb  libssl.0.9.7.dylib ??? (???) <d04156c610530ca44979c899834fc24d> /usr/lib/libssl.0.9.7.dylib
0x903e0000 - 0x903f0fff  com.apple.speech.synthesis.framework 3.7.1 (3.7.1) <273d96ff861dc68be659c07ef56f599a> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x903f1000 - 0x904abfe3  com.apple.CoreServices.OSServices 226.5 (226.5) <ef9945b1304495f3e8085c935f1b81e3> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x904ac000 - 0x904dbfe3  com.apple.AE 402.3 (402.3) <4cb9ef65cf116d6dd424f0ce98c2d015> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x904dc000 - 0x906aaff3  com.apple.security 5.0.4 (34102) <55dda7486df4e8e1d61505be16f83a1c> /System/Library/Frameworks/Security.framework/Versions/A/Security
0x906ab000 - 0x90867ff3  com.apple.QuartzComposer 2.1 (106.13) <40f034e8c8fd31c9081f5283dcf22b78> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuartzComposer.framework/Versions/A/QuartzComposer
0x90868000 - 0x90877fff  libsasl2.2.dylib ??? (???) <bb7971ca2f609c070f87786a93d1041e> /usr/lib/libsasl2.2.dylib
0x90878000 - 0x90879ffc  libffi.dylib ??? (???) <eaf10b99a3fbc4920b175809407466c0> /usr/lib/libffi.dylib
0x9087a000 - 0x908acfff  com.apple.LDAPFramework 1.4.5 (110) <8e2d9ff6233cf44cb67533625840c2af> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x908ad000 - 0x90a2cfff  com.apple.AddressBook.framework 4.1.1 (699) <60ddae72a1df8ddbc5c53df92f372b76> /System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook
0x90b22000 - 0x90b5cfe7  com.apple.coreui 1.2 (62) /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI
0x90b5d000 - 0x90b5ffff  com.apple.CrashReporterSupport 10.5.5 (159) <4ca9b6643fcbafd76424a46d162363eb> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport
0x90b60000 - 0x90b60ffc  com.apple.audio.units.AudioUnit 1.5 (1.5) /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x90b61000 - 0x90b97fef  libtidy.A.dylib ??? (???) <5351215b54226cc47eb1cd4b011cc2f3> /usr/lib/libtidy.A.dylib
0x90b98000 - 0x90c48fff  edu.mit.Kerberos 6.0.12 (6.0.12) <685cc018c133668d0d3ac6a1cb63cff9> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x90c79000 - 0x90db1fe7  com.apple.imageKit 1.0.2 (1.0) <2e354566521df8b1e3a78e9aeab5e6b4> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/ImageKit.framework/Versions/A/ImageKit
0x90db2000 - 0x90ee5fff  com.apple.CoreFoundation 6.5.5 (476.17) <4a70c8dbb582118e31412c53dc1f407f> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x90ee6000 - 0x911eefff  com.apple.HIToolbox 1.5.4 (???) <3747086ba21ee419708a5cab946c8ba6> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x911ef000 - 0x91207ff7  com.apple.CoreVideo 1.6.0 (20.0) <c0d869876af51283a160cd2224a23abf> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
0x9120e000 - 0x912b5feb  com.apple.QD 3.11.54 (???) <c31150b40fcc27c195de40f0ae138666> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x912b6000 - 0x9141dff3  libSystem.B.dylib ??? (???) <d68880dfb1f8becdbdac6928db1510fb> /usr/lib/libSystem.B.dylib
0x91458000 - 0x914cafff  com.apple.PDFKit 2.1.2 (2.1.2) /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/PDFKit.framework/Versions/A/PDFKit
0x914cb000 - 0x91611ff7  com.apple.ImageIO.framework 2.0.4 (2.0.4) <b407f06ff9b6893899e2e399cb65c953> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x91612000 - 0x91622ffc  com.apple.LangAnalysis 1.6.4 (1.6.4) <bc7eb703ddc37bf85adf93e35efd3947> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x9188c000 - 0x918e5ff7  libGLU.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x918e6000 - 0x91903ff7  com.apple.QuickLookFramework 1.3.1 (170.9) /System/Library/Frameworks/QuickLook.framework/Versions/A/QuickLook
0x91904000 - 0x9196affb  com.apple.ISSupport 1.7 (38.2) /System/Library/PrivateFrameworks/ISSupport.framework/Versions/A/ISSupport
0x9196b000 - 0x9196bffa  com.apple.CoreServices 32 (32) <373d6a888f9204641f313bc6070ae065> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x921f7000 - 0x92205ffd  libz.1.dylib ??? (???) <a98b3b221a72b54faf73ded3dd7000e5> /usr/lib/libz.1.dylib
0x92387000 - 0x9238bfff  com.apple.OpenDirectory 10.5 (10.5) <46ccc9f47cedee69d1c65838c8e4f642> /System/Library/PrivateFrameworks/OpenDirectory.framework/Versions/A/OpenDirectory
0x9238c000 - 0x923aafff  libresolv.9.dylib ??? (???) <9ed809256ce8913cddc3269c2e364654> /usr/lib/libresolv.9.dylib
0x923ab000 - 0x9287cf3e  libGLProgrammability.dylib ??? (???) <5d283543ac844e7c6fa3440ac56cd265> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib
0x9287d000 - 0x92880fff  com.apple.help 1.1 (36) <1a25a8fbb49a830efb31d5c0a52939cd> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x928d0000 - 0x9291afe1  com.apple.securityinterface 3.0.1 (35183) <f855cb06d2541ce544d9bcdf998b991c> /System/Library/Frameworks/SecurityInterface.framework/Versions/A/SecurityInterface
0x9291b000 - 0x92931fff  com.apple.DictionaryServices 1.0.0 (1.0.0) <7d20b8d1fb238c3e71d0fa6fda18c4f7> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices
0x92932000 - 0x92938fff  com.apple.print.framework.Print 218.0.2 (220.1) <6c2ddea45d9cdff9a9be0666a13e2dd4> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x92a1b000 - 0x92a59ff7  libGLImage.dylib ??? (???) <1123b8a48bcbe9cc7aa8dd8e1a214a66> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x92a5a000 - 0x92ad7feb  com.apple.audio.CoreAudio 3.1.1 (3.1.1) <f35477a5e23db0fa43233c37da01ae1c> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x92ae4000 - 0x92b1effe  com.apple.securityfoundation 3.0.1 (35844) <2fbb6a1177ef98350b8aefc60737ba0e> /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation
0x92b1f000 - 0x92b99ff8  com.apple.print.framework.PrintCore 5.5.3 (245.3) <98633ef67d419c1b02f56556cb4d843d> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x92d0a000 - 0x92d49fef  libTIFF.dylib ??? (???) <d4bcc9b9c508e53849d2d46bb6900922> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x92d4a000 - 0x92d6efff  libxslt.1.dylib ??? (???) <0a9778d6368ae668826f446878deb99b> /usr/lib/libxslt.1.dylib
0x92d6f000 - 0x92dc0ff7  com.apple.HIServices 1.7.0 (???) <01b690d1f376e400ac873105533e39eb> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x92e2f000 - 0x92e47fff  com.apple.openscripting 1.2.8 (???) <0129d2f750f5ddcb92f4acf8a3541952> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x92f1d000 - 0x92f79ff7  com.apple.htmlrendering 68 (1.1.3) <1c5c0c417891b920dfe139385fc6c155> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x92f7a000 - 0x92f81ffe  libbsm.dylib ??? (???) <fa7ae5f1a621d9b69e7e18747c9405fb> /usr/lib/libbsm.dylib
0x92f82000 - 0x92f87fff  com.apple.backup.framework 1.0 (1.0) /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup
0x92f88000 - 0x9308bfe7  com.apple.PubSub 1.0.4 (65.6) /System/Library/Frameworks/PubSub.framework/Versions/A/PubSub
0x9308f000 - 0x9308fffd  com.apple.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/vecLib.framework/Versions/A/vecLib
0x93090000 - 0x93170fff  libobjc.A.dylib ??? (???) <400e943f9e8a678eea22a1d1205490ee> /usr/lib/libobjc.A.dylib
0x93171000 - 0x93176fff  com.apple.CommonPanels 1.2.4 (85) <c135f02edd6b2e2864311e0b9d08a98d> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x93177000 - 0x93177ffd  com.apple.Accelerate 1.4.2 (Accelerate 1.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x93178000 - 0x931c7fff  com.apple.QuickLookUIFramework 1.3.1 (170.9) /System/Library/PrivateFrameworks/QuickLookUI.framework/Versions/A/QuickLookUI
0x931c8000 - 0x931d4ffe  libGL.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x931d5000 - 0x932baff3  com.apple.CoreData 100.1 (186) <50219bcb005cb15ea999a19391a8d523> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x932bb000 - 0x932d9ff3  com.apple.DirectoryService.Framework 3.5.5 (3.5.5) <f8931f64103c8a86b82e9714352f4323> /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService
0x932da000 - 0x932daffb  com.apple.installserver.framework 1.0 (8) /System/Library/PrivateFrameworks/InstallServer.framework/Versions/A/InstallServer
0x932db000 - 0x932dbff8  com.apple.ApplicationServices 34 (34) <ee7bdf593da050bb30c7a1fc446eb8a6> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x932dc000 - 0x9369afea  libLAPACK.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x9369b000 - 0x9374dffb  libcrypto.0.9.7.dylib ??? (???) <75b80bff0d5cfaf10b6b6fe982da3578> /usr/lib/libcrypto.0.9.7.dylib
0x9374e000 - 0x938a0ff3  com.apple.audio.toolbox.AudioToolbox 1.5.2 (1.5.2) /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x938a1000 - 0x938fbff7  com.apple.CoreText 2.0.4 (???) <f9a90116ae34a2b0d84e87734766fb3a> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
0x938fc000 - 0x93927fe7  libauto.dylib ??? (???) <2e44c523b851e8e25f05d13a48070a58> /usr/lib/libauto.dylib
0x93945000 - 0x93bc0fe7  com.apple.Foundation 6.5.7 (677.22) <8fe77b5d15ecdae1240b4cb604fc6d0b> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x93bc1000 - 0x93fd1fef  libBLAS.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x93fd2000 - 0x942acff3  com.apple.CoreServices.CarbonCore 786.11 (786.11) <f06fe5d92d56ac5aa52d1ba182745924> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x942ad000 - 0x942b6fff  com.apple.speech.recognition.framework 3.7.24 (3.7.24) <da2d8411921a3fd8bc898dc753b7f3ee> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x942b7000 - 0x94ab5fef  com.apple.AppKit 6.5.6 (949.43) <a3a300499bbe4f1dfebf71d752d01916> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x94ab6000 - 0x94afafeb  com.apple.DirectoryService.PasswordServerFramework 3.0.3 (3.0.3) <29109fed9f54cbe3d3faea0603362719> /System/Library/PrivateFrameworks/PasswordServer.framework/Versions/A/PasswordServer
0x94afb000 - 0x94afbffe  com.apple.quartzframework 1.5 (1.5) <6865aa0aeaa584b5a54d43f2f21d6c08> /System/Library/Frameworks/Quartz.framework/Versions/A/Quartz
0x94afc000 - 0x94b59ffb  libstdc++.6.dylib ??? (???) <f75e5133d72769de5ce6c06153fc65f6> /usr/lib/libstdc++.6.dylib
0x94b5a000 - 0x94b65fe7  libCSync.A.dylib ??? (???) <e6aceed359bd228f42bc1246af5919c9> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x94b6e000 - 0x94ca6ff7  libicucore.A.dylib ??? (???) <18098dcf431603fe47ee027a60006c85> /usr/lib/libicucore.A.dylib
0x94ca7000 - 0x94ca9ff5  libRadiance.dylib ??? (???) <82d606c49f5dc77231f9d0e2be9ed6ab> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x95c86000 - 0x95cd7feb  com.apple.framework.familycontrols 1.0.3 (1.0.3) <52c7ec091f6d3dc99ec42e1e185c38a7> /System/Library/PrivateFrameworks/FamilyControls.framework/Versions/A/FamilyControls
0x95e3a000 - 0x95e83fef  com.apple.Metadata 10.5.2 (398.25) <e0572f20350523116f23000676122a8d> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x95e84000 - 0x95e84ffd  com.apple.Accelerate.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x95e9d000 - 0x9623afef  com.apple.QuartzCore 1.5.7 (1.5.7) <2fed2dd7565c84a0f0c608d41d4d172c> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x96248000 - 0x9624cfff  libGIF.dylib ??? (???) <7714ae24eb64b48fa719fb99bcbe34f3> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x9624d000 - 0x9625afe7  com.apple.opengl 1.5.9 (1.5.9) <7e5048a2677b41098c84045305f42f7f> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x9625b000 - 0x9625bff8  com.apple.Cocoa 6.5 (???) <a1bc9247cf65c20f1a44d0973cbe649c> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x9625c000 - 0x96284fff  libcups.2.dylib ??? (???) <16bec7c6a004f744804e2281a1b1c094> /usr/lib/libcups.2.dylib
0x96285000 - 0x9633cff3  com.apple.QTKit 7.6 (1290) /System/Library/Frameworks/QTKit.framework/Versions/A/QTKit
0x9633d000 - 0x963dafe4  com.apple.CFNetwork 422.15.2 (422.15.2) <80851410a5592b7c3b149b2ff849bcc1> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x963db000 - 0x96467ff7  com.apple.LaunchServices 290.3 (290.3) <6f9629f4ed1ba3bb313548e6838b2888> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x96468000 - 0x96470fff  com.apple.DiskArbitration 2.2.1 (2.2.1) <2664eeb3a4d0c95a21c089892a0ae8d0> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x96471000 - 0x96b11fff  com.apple.CoreGraphics 1.407.2 (???) <3a91d1037afde01d1d8acdf9cd1caa14> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x96b12000 - 0x96b3aff7  com.apple.shortcut 1 (1.0) <35cd17d0179ca839c5fb08694f3dc5ef> /System/Library/PrivateFrameworks/Shortcut.framework/Versions/A/Shortcut
0x96b3b000 - 0x96b3dfff  com.apple.securityhi 3.0 (30817) <40562b85d99118354c974e76c32fa6fb> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x96b3e000 - 0x96c09fff  com.apple.ColorSync 4.5.1 (4.5.1) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x96c0a000 - 0x96c37feb  libvDSP.dylib ??? (???) <4daafed78a471133ec30b3ae634b6d3e> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x96c38000 - 0x96cc2fe3  com.apple.DesktopServices 1.4.7 (1.4.7) <c3591383780dd12594c37dbde59958b6> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x96cc3000 - 0x96d8aff2  com.apple.vImage 3.0 (3.0) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x96d8b000 - 0x96d90fff  com.apple.DisplayServicesFW 2.0.2 (2.0.2) <97878a73074e7da4fe31ea010a5d5ae1> /System/Library/PrivateFrameworks/DisplayServices.framework/Versions/A/DisplayServices
0x96d91000 - 0x96dd2fe7  libRIP.A.dylib ??? (???) <5d0b5af7992e14de017f9a9c7cb05960> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x96dd3000 - 0x96dd3fff  com.apple.Carbon 136 (136) <4177916bbf70e0ddc446f94001d54c95> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x96dd4000 - 0x96e0bfff  com.apple.SystemConfiguration 1.9.2 (1.9.2) <eab546255ac099b9616df999c9359d0e> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x96e0c000 - 0x96e97fff  com.apple.framework.IOKit 1.5.1 (???) <f9f5f0d070e197a832d86751e1d44545> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x96e98000 - 0x96f2bff3  com.apple.ApplicationServices.ATS 3.4 (???) <8c51de0ec3deaef416578cd59df38754> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x96f2c000 - 0x97251fe2  com.apple.QuickTime 7.6.0 (1290) <bc0920abbbaad03f5513ac7ffbd30633> /System/Library/Frameworks/QuickTime.framework/Versions/A/QuickTime
0x97252000 - 0x972d9ff7  libsqlite3.0.dylib ??? (???) <eeedc8bf6881ac9f2c1954b1c8037720> /usr/lib/libsqlite3.0.dylib
0x972da000 - 0x9736dfff  com.apple.ink.framework 101.3 (86) <d4c85b5cafa8027fff042b84a8be71dc> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x973e2000 - 0x973f1ffe  com.apple.DSObjCWrappers.Framework 1.3 (1.3) <182986b74247b459b2a67a47071bdc6b> /System/Library/PrivateFrameworks/DSObjCWrappers.framework/Versions/A/DSObjCWrappers
0x973f2000 - 0x9741bfff  com.apple.CoreMediaPrivate 15.0 (15.0) /System/Library/PrivateFrameworks/CoreMediaPrivate.framework/Versions/A/CoreMediaPrivate
0x974c0000 - 0x974c7fe9  libgcc_s.1.dylib ??? (???) <e280ddf3f5fb3049e674edcb109f389a> /usr/lib/libgcc_s.1.dylib
0x974c8000 - 0x974ddffb  com.apple.ImageCapture 5.0.1 (5.0.1) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x974de000 - 0x9755dff5  com.apple.SearchKit 1.2.1 (1.2.1) <f28f8dd0f155a6453411a0c9b5702764> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x9755e000 - 0x97568feb  com.apple.audio.SoundManager 3.9.2 (3.9.2) <df077a8048afc3075c6f2d9e7780e78e> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0xfffe8000 - 0xfffebfff  libobjc.A.dylib ??? (???) /usr/lib/libobjc.A.dylib
0xffff0000 - 0xffff1780  libSystem.B.dylib ??? (???) /usr/lib/libSystem.B.dylib

[Eric Seidel (no email)]

Looks straightforward.  I'll take a crack at it tomorrow if no one else has fixed it before then.

[Eric Seidel (no email)]

Oh, and FYI:  Mark Rowe has pointed out to me, that current best-practice is to attach the stack-trace as an attachment instead of pasting it in the bug itself.  I seem to remember we used to paste them in the bug itself back in the day, but I've come to agree with him, it seems cleaner to attach it as an attachment.

[Eric Seidel (no email)]

Actually, it has nothing to do with XML.  The server is sending these as html pages. :)

curl -I "http://www.wdr.de/mediathek/html/regional/ergebnisse/sendung.xml"
HTTP/1.1 200 OK
Date: Thu, 09 Apr 2009 08:59:54 GMT
Server: Apache
Set-Cookie: JSESSIONID=73A594B715709A69F9B21AA22CACFE42.mediathek1; Path=/mediathek
Content-Type: text/html;charset=ISO-8859-1

Got to love the web!

[Eric Seidel (no email)]

The bug reproduces in the remote file, but not when I pull the file down locally and add a <base> tag. :(

[Eric Seidel (no email)]

This must be a regression.

The crashing test case is:
<script>
document.implementation.createDocument(null, "foo:bar", null);
</script>

Which it's hard for me to imagine that we've always crashed on. :)

The reason we crash is that createElementNS is strict about namespace URIs and prefixes matching.  I remember making this change:
http://trac.webkit.org/browser/trunk/WebCore/dom/Document.cpp#L753

We fail that check, thus return 0 from createElementNS, and the caller:
http://trac.webkit.org/browser/trunk/WebCore/dom/DOMImplementation.cpp#L253
doesn't null-check the return value like it should. :)

I suspect the caller lack of null check is the recent regression.  However, I'm not yet sure what our behavior here should be, so I need to make a more comprehensive test first. :(

[Eric Seidel (no email)]

Created attachment 29362 [details]
Fix and test case

 LayoutTests/ChangeLog                              |   15 ++
 .../createDocument-namespace-err-expected.txt      |   51 +++++++
 .../createDocument-namespace-err.html              |   13 ++
 .../resources/createDocument-namespace-err.js      |  146 ++++++++++++++++++++
 WebCore/ChangeLog                                  |   14 ++
 WebCore/dom/ContainerNode.cpp                      |    1 +
 WebCore/dom/DOMImplementation.cpp                  |    5 +-
 7 files changed, 243 insertions(+), 2 deletions(-)

[Eric Seidel (no email)]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	LayoutTests/ChangeLog
	A	LayoutTests/fast/dom/DOMImplementation/createDocument-namespace-err-expected.txt
	A	LayoutTests/fast/dom/DOMImplementation/createDocument-namespace-err.html
	A	LayoutTests/fast/dom/DOMImplementation/resources/createDocument-namespace-err.js
	M	WebCore/ChangeLog
	M	WebCore/dom/ContainerNode.cpp
	M	WebCore/dom/DOMImplementation.cpp
Committed r42351

[Alexey Proskuryakov]

That's an impressive test case!