Bug 50149 - chrome.dll!WebCore::CSSStyleSelector::loadPendingImages ReadAV@NULL (830f1940d708882124521ea60de442b0)
Summary: chrome.dll!WebCore::CSSStyleSelector::loadPendingImages ReadAV@NULL (830f1940...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P1 Normal
Assignee: Simon Fraser (smfr)
URL: http://code.google.com/p/chromium/iss...
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2010-11-29 05:59 PST by Berend-Jan Wever
Modified: 2010-11-29 11:09 PST (History)
4 users (show)

See Also:

Attachments
Repro (108 bytes, text/html)
2010-11-29 05:59 PST, Berend-Jan Wever 		no flags Details
Patch (3.87 KB, patch)
2010-11-29 11:02 PST, Simon Fraser (smfr) 		mitz: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Berend-Jan Wever 2010-11-29 05:59:53 PST 
Created attachment 75019 [details]
Repro

Repro:
<style>
  *{
    -webkit-box-reflect: none !important;
    -webkit-box-reflect: below 0 url(x);
  }
</style>

id:             chrome.dll!WebCore::CSSStyleSelector::loadPendingImages ReadAV@NULL (830f1940d708882124521ea60de442b0)
description:    Attempt to read from unallocated NULL pointer+0xC in chrome.dll!WebCore::CSSStyleSelector::loadPendingImages
application:    Chromium 9.0.596.0
stack:          chrome.dll!WebCore::CSSStyleSelector::loadPendingImages
                chrome.dll!WebCore::CSSStyleSelector::styleForElement
                chrome.dll!WebCore::Element::recalcStyle
                chrome.dll!WebCore::Document::recalcStyle
                chrome.dll!WebCore::Document::styleSelectorChanged
                chrome.dll!WebCore::Document::removePendingSheet
                chrome.dll!WebCore::StyleElement::sheetLoaded
                chrome.dll!WebCore::SVGStyleElement::sheetLoaded
                chrome.dll!WebCore::CSSStyleSheet::checkLoaded
                chrome.dll!WebCore::StyleElement::createSheet
                chrome.dll!WebCore::StyleElement::process
                chrome.dll!WebCore::StyleElement::finishParsingChildren
                chrome.dll!WebCore::HTMLStyleElement::finishParsingChildren
                chrome.dll!WebCore::HTMLElementStack::popCommon
                chrome.dll!WebCore::HTMLTreeBuilder::processEndTag
                chrome.dll!WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken
                chrome.dll!WebCore::HTMLTreeBuilder::constructTreeFromToken
                chrome.dll!WebCore::HTMLDocumentParser::pumpTokenizer
                chrome.dll!WebCore::HTMLDocumentParser::insert
                chrome.dll!WebCore::Document::write
                chrome.dll!WebCore::V8HTMLDocument::writeCallback
                chrome.dll!v8::internal::HandleApiCallHelper<...>
                chrome.dll!v8::internal::Builtin_HandleApiCall
                chrome.dll!v8::internal::Invoke
                chrome.dll!v8::internal::Execution::Call
                ...
Comment 1 Alexey Proskuryakov 2010-11-29 10:05:50 PST 
See also: bug 46224.
Comment 2 Simon Fraser (smfr) 2010-11-29 10:16:03 PST 
<rdar://problem/8706182>
Comment 3 Simon Fraser (smfr) 2010-11-29 10:19:20 PST 
Crashes WebKit mac too.
Comment 4 Simon Fraser (smfr) 2010-11-29 11:02:21 PST 
Created attachment 75042 [details]
Patch
Comment 5 Simon Fraser (smfr) 2010-11-29 11:09:11 PST 
http://trac.webkit.org/changeset/72814