Bug 48789 – REGRESSION(49798): Crash in HTMLObjectElement::parseMappedAttribute

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[David Levin]

Load the given url and refresh.

Stack Trace
------------
Thread 0 *CRASHED* ( EXCEPTION_ACCESS_VIOLATION_READ @ 0x00000008 )

0x02654732	 [chrome.dll	 - stringimpl.cpp:195]	WTF::StringImpl::lower()
0x02653b5e	 [chrome.dll	 - atomicstring.cpp:293]	WTF::AtomicString::lower()
0x02171c08	 [chrome.dll	 - htmlobjectelement.cpp:71]	WebCore::HTMLObjectElement::parseMappedAttribute(WebCore::Attribute *)
0x021dda1c	 [chrome.dll	 - styledelement.cpp:183]	WebCore::StyledElement::attributeChanged(WebCore::Attribute *,bool)
0x021db8e8	 [chrome.dll	 - namednodemap.cpp:296]	WebCore::NamedNodeMap::removeAttribute(WebCore::QualifiedName const &)
0x020ffa5a	 [chrome.dll	 - element.cpp:592]	WebCore::Element::setAttribute(WebCore::QualifiedName const &,WTF::AtomicString const &,int &)
0x021cf659	 [chrome.dll	 - v8binding.cpp:569]	WebCore::setElementStringAttr(v8::AccessorInfo const &,WebCore::QualifiedName const &,v8::Local<v8::Value>)
0x02695cdb	 [chrome.dll	 - v8htmlulistelement.cpp:67]	WebCore::HTMLUListElementInternal::typeAttrSetter
0x027fd186	 [chrome.dll	 - objects.cc:1581]	v8::internal::JSObject::SetPropertyWithCallback(v8::internal::Object *,v8::internal::String *,v8::internal::Object *,v8::internal::JSObject *)

Related chromium bug: http://code.google.com/p/chromium/issues/detail?id=55345

[Eric Seidel (no email)]

I've found the problem.  When AtomicString::lower() was optimized, the contract of "it's always safe to call member functions even when the string is null" was broken.

[Eric Seidel (no email)]

Created attachment 72588 [details]
Patch

[Eric Seidel (no email)]

--suggest-reviewers may have gone a little overboard on this one.  Please feel free to remove yourself from the CC list if you're not interested in this patch.

[Gavin Barraclough]

Comment on attachment 72588 [details]
Patch

Looks good

[WebKit Commit Bot]

Comment on attachment 72588 [details]
Patch

Rejecting patch 72588 from commit-queue.

Failed to run "['./WebKitTools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=abarth-cq-sl', 'apply-attachment', '--force-clean', '--non-interactive', 72588]" exit_code: 2
Last 500 characters of output:
 fuzz 3.
patching file LayoutTests/fast/dom/HTMLObjectElement/set-type-to-null-crash-expected.txt
patching file LayoutTests/fast/dom/HTMLObjectElement/set-type-to-null-crash.html
patching file WebCore/WebCore.xcodeproj/project.pbxproj
Hunk #1 FAILED at 21305.
1 out of 1 hunk FAILED -- saving rejects to file WebCore/WebCore.xcodeproj/project.pbxproj.rej

Failed to run "[u'/Users/abarth/git/webkit-queue/WebKitTools/Scripts/svn-apply', u'--reviewer', u'Gavin Barraclough', u'--force']" exit_code: 1

Full output: http://queues.webkit.org/results/5008013

[Eric Seidel (no email)]

Created attachment 72946 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 72946 [details]
Patch for landing

Clearing flags on attachment: 72946

Committed r71345: <http://trac.webkit.org/changeset/71345>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.