The following code is from a test page that always will cause Safari to crash. More discussion on this can be found here: http://www.pmachine.com/forums/viewthread/24217/P0/ <html> <head> <title>test</title> </head> <body> <form> <textarea cols='30' rows='10'></textarea> <div style="display:none;"> <table> <tr> <td>test</td> </tr> </table> </div> <div><input type='text' name='bla' value='' size="33" /></div> </form> </body> </html>
The report is missing a key step to reproduce: the crash only occurs after you begin typing in the bottom text entry field. This occurs with both WebKit 412 and ToT CVS. Crash log from ToT included below: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c Thread 0 Crashed: 0 com.apple.WebCore 0x011dfed4 khtml::RenderTableCell::table() const + 0 (icplusplus.c:28) 1 <<00000000>> 0xbfffe324 0 + -1073749212 2 com.apple.WebCore 0x010204b8 KWQKHTMLPart::searchForLabelsBeforeElement(NSArray*, DOM::ElementImpl*) + 204 (icplusplus.c:28) 3 com.apple.Safari 0x0009956c 0x1000 + 623980 4 com.apple.Safari 0x00098edc 0x1000 + 622300 5 com.apple.Safari 0x000958f8 0x1000 + 608504 6 com.apple.Safari 0x00095b50 0x1000 + 609104 7 com.apple.Safari 0x0004402c 0x1000 + 274476 8 com.apple.Foundation 0x92886d18 __NSFireDelayedPerform + 304 9 com.apple.CoreFoundation 0x9075deb0 __CFRunLoopDoTimer + 184 10 com.apple.CoreFoundation 0x9074a828 __CFRunLoopRun + 1680 11 com.apple.CoreFoundation 0x90749ddc CFRunLoopRunSpecific + 268 12 com.apple.HIToolbox 0x93122ca0 RunCurrentEventLoopInMode + 264 13 com.apple.HIToolbox 0x93122334 ReceiveNextEventCommon + 380 14 com.apple.HIToolbox 0x931221a0 BlockUntilNextEventMatchingListInMode + 96 15 com.apple.AppKit 0x9362b1a4 _DPSNextEvent + 384 16 com.apple.AppKit 0x9362ae68 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116 17 com.apple.Safari 0x00007058 0x1000 + 24664 18 com.apple.AppKit 0x936273cc -[NSApplication run] + 472 19 com.apple.AppKit 0x93717c1c NSApplicationMain + 452 20 com.apple.Safari 0x00002700 0x1000 + 5888 21 com.apple.Safari 0x00057190 0x1000 + 352656
A easiliy accessible case for this bug is at http://pmachine.com/misc/safari_crash.html It consists of the HTML included in the initial bug report.
Created attachment 2799 [details] minimal testcase Removing either the table or the display:none prevents the crash.
Created attachment 2800 [details] minimal testcase This time the testcase tells hows to recreate the problem.
Created attachment 2858 [details] Proposed fix This patch checks for the existence of the cell renderer.
Comment on attachment 2858 [details] Proposed fix The fix looks good, but this patch isn't going to merge any more after the changes from 3405. Can you make the fix again and attach a new patch? Thanks.
Created attachment 2888 [details] Merging patch Here you go.
Comment on attachment 2888 [details] Merging patch Changed name of patch, since it could seem now as if you just attached the patch again...
Comment on attachment 2888 [details] Merging patch r=me
I'll commit this
Closing since this has been committed.
This is also in Radar as <rdar://problem/4146880>