Bug 39448 – Crash when XHTMLMP is enabled

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Yong Li]

In Document's ctor:

#if ENABLE(XHTMLMP)
    m_shouldProcessNoScriptElement = m_frame->script()->canExecuteScripts(NotAboutToExecuteScript);
#endif

But m_frame can be null. DOMImplementation::createDocument() has a path to call Document::create(0), where 0 is the frame pointer.

Patch is coming. it will be simply like this

-    m_shouldProcessNoScriptElement = m_frame->script()->canExecuteScripts(NotAboutToExecuteScript);
+    m_shouldProcessNoScriptElement = m_frame && m_frame->script()->canExecuteScripts(NotAboutToExecuteScript);

[Yong Li]

Created attachment 56635 [details]
 The patch

[Alexey Proskuryakov]

+        No new tests because it is obvious and it must be reproduced with
+        XHTMLMP enabled.

I'm not convinced by this explanation. Documents with XHTML Mobile doctype are treated as XHTML when XHTMLMP is not enabled, so such a test would work in Safari - even if it would pass regardless of this fix.

[Yong Li]

(In reply to comment #2)
> +        No new tests because it is obvious and it must be reproduced with
> +        XHTMLMP enabled.
> 
> I'm not convinced by this explanation. Documents with XHTML Mobile doctype are treated as XHTML when XHTMLMP is not enabled, so such a test would work in Safari - even if it would pass regardless of this fix.

It doesn't need a XHMTL doc to happen. I believe there must be a current layout test that can trigger this. I'll try to find one.

[Yong Li]

XMLHttpReqeust can call Document::create(0).

I've seen the problem can be reproduced with this test case.

LayoutTests\http\tests\xmlhttprequest\docLoaderFrame.html

[WebKit Commit Bot]

Comment on attachment 56635 [details]
 The patch

Clearing flags on attachment: 56635

Committed r60016: <http://trac.webkit.org/changeset/60016>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[WebKit Review Bot]

http://trac.webkit.org/changeset/60017 might have broken Qt Linux ARMv5 Release

[Lucas Forschler]

Mass moving XML DOM bugs to the "DOM" Component.