Bug 6962 - REGRESSION: www.usa.phillips.com crashes due to <param> with no name
Summary: REGRESSION: www.usa.phillips.com crashes due to <param> with no name
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Darin Adler
URL: http://www.usa.philips.com/index.html
Keywords: EasyFix, HasReduction, Regression
Depends on:
Blocks:
 
Reported: 2006-01-31 04:28 PST by Kevin Day
Modified: 2006-02-05 11:15 PST (History)
2 users (show)

See Also:

Attachments
Crash backtrace (9.81 KB, text/plain)
2006-01-31 04:29 PST, Kevin Day 		no flags Details
Reduction (27 bytes, text/html)
2006-01-31 04:47 PST, mitz 		no flags Details
patch to fix the problem, including change log and test (3.28 KB, patch)
2006-02-05 00:28 PST, Darin Adler 		mjs: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kevin Day 2006-01-31 04:28:53 PST 
http://www.usa.philips.com/index.html crashes on both 12467 and 12486 shortly after the page begins rendering. Backtrace attached.
Comment 1 Kevin Day 2006-01-31 04:29:51 PST 
Created attachment 6143 [details]
Crash backtrace
Comment 2 mitz 2006-01-31 04:47:10 PST 
Created attachment 6144 [details]
Reduction

The crash happens when RenderPartObject::updateWidget tries to add a null pointer to a HashSet<DOMStringImpl*, CaseInsensitiveHash> (in this case, the value of the missing "name" attribute of the <param> element).
Comment 3 Darin Adler 2006-02-02 09:38:03 PST 
I believe we can simply add a check to skip over <param> elements with a name that's empty. The bug/crash will only happen with names that are null, but I think there's no reason to include parameters with an empty name.
Comment 4 Darin Adler 2006-02-05 00:28:36 PST 
Created attachment 6261 [details]
patch to fix the problem, including change log and test
Comment 5 Maciej Stachowiak 2006-02-05 01:05:57 PST 
Comment on attachment 6261 [details]
patch to fix the problem, including change log and test

r=me