Bug 92024 - Crash when setting empty class name on a new element
Summary: Crash when setting empty class name on a new element
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Stephen Chenney
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-07-23 13:40 PDT by Stephen Chenney
Modified: 2012-07-23 13:57 PDT (History)
3 users (show)

See Also:


Attachments
Patch (3.23 KB, patch)
2012-07-23 13:48 PDT, Stephen Chenney
kling: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stephen Chenney 2012-07-23 13:40:56 PDT
This test crashes:

<!DOCTYPE html>
<script>
  document.createElementNS("http://www.w3.org/2000/svg", "svg").className.baseVal = "";
</script>

because in WebCore/dom/StyledElement.cpp:176 we call

attributeData()->clearClass();

when the class name is empty without checking if attributeData exists. Attribute data will not exist on SVG nodes (at least) immediately upon creation.

This is Chromium http://code.google.com/p/chromium/issues/detail?id=138552
Comment 1 Stephen Chenney 2012-07-23 13:48:43 PDT
Created attachment 153855 [details]
Patch
Comment 2 Stephen Chenney 2012-07-23 13:57:42 PDT
Committed r123377: <http://trac.webkit.org/changeset/123377>