Bug 36976 - REGRESSION(r54783): Silverlight plug-in causes Safari to crash if JavaScript is disabled
Summary: REGRESSION(r54783): Silverlight plug-in causes Safari to crash if JavaScript ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Plug-ins (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.6
: P1 Normal
Assignee: Alexey Proskuryakov
URL:
Keywords: InRadar, Regression
Depends on:
Blocks:
 
Reported: 2010-04-01 12:13 PDT by Alexey Proskuryakov
Modified: 2010-04-01 14:00 PDT (History)
1 user (show)

See Also:


Attachments
proposed fix (2.29 KB, patch)
2010-04-01 12:48 PDT, Alexey Proskuryakov
oliver: review+
Details | Formatted Diff | Diff
more fixes (2.50 KB, patch)
2010-04-01 13:26 PDT, Alexey Proskuryakov
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2010-04-01 12:13:52 PDT
If JavaScript is disabled then loading a page that contains the Silverlight plug-in will cause Safari to crash.

* STEPS TO REPRODUCE
1. Disable JavaScript.
2. Load <http://feralpixel.com/default.htm#/Algorithms/A13.xaml>.

* RESULTS
Crash.
Comment 1 Alexey Proskuryakov 2010-04-01 12:48:24 PDT
Created attachment 52323 [details]
proposed fix
Comment 2 Alexey Proskuryakov 2010-04-01 12:48:43 PDT
<rdar://problem/7817498>
Comment 3 Oliver Hunt 2010-04-01 12:51:03 PDT
Comment on attachment 52323 [details]
proposed fix

r=me
Comment 4 Darin Adler 2010-04-01 12:58:36 PDT
Comment on attachment 52323 [details]
proposed fix

> +        (WebKit::NetscapePluginInstanceProxy::LocalObjectMap::get): Use find() instead of get(),
> +        because the latter fails with an assertion when looking up 0 or -1.

Why doesn't find() fail with an assertion looking up 0 or -1? Makes no sense to me that it would not.
Comment 5 Alexey Proskuryakov 2010-04-01 13:00:01 PDT
Committed <http://trac.webkit.org/changeset/56932>.
Comment 6 Alexey Proskuryakov 2010-04-01 13:14:06 PDT
That's because find() has an early return if m_table is null, and get() doesn't. You are right, the first part of this change is incorrect.
Comment 7 Alexey Proskuryakov 2010-04-01 13:26:01 PDT
Created attachment 52326 [details]
more fixes
Comment 8 Darin Adler 2010-04-01 13:54:50 PDT
Comment on attachment 52326 [details]
more fixes

r=me
Comment 9 Alexey Proskuryakov 2010-04-01 14:00:20 PDT
Follow-up committed <http://trac.webkit.org/changeset/56935>.