[Webkit-unassigned] [Bug 10886] New: REGRESSION (r16387): Reproducible crash when mousing over HTML document

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=10886

           Summary: REGRESSION (r16387): Reproducible crash when mousing
                    over HTML document
           Product: WebKit
           Version: 420+ (nightly)
          Platform: Macintosh
        OS/Version: Mac OS X 10.4
            Status: NEW
          Keywords: Regression
          Severity: critical
          Priority: P1
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at opendarwin.org
        ReportedBy: opendarwin.org at mitzpettel.com
                CC: sam.weinig at gmail.com


Safari crashes as soon as you mouse over an HTML document. The reason appears
to be that the auto-generated -[DOMNode ownerDocument] calls
Node::ownerDocument(), which returns 0 for the document itself. The old version
in called Node::document(). You should keep (or generate) that custom behavior.

Thread 0 Crashed:
0    WebCore::Document::frame() const + 28 (Document.cpp:773)
1    +[WebCoreFrameBridge bridgeForDOMDocument:] + 76
(WebCoreFrameBridge.mm:459)
2    -[DOMNode(WebDOMNodeOperations) _bridge] + 112 (WebDOMOperations.m:45)
3    -[DOMDocument(WebDOMDocumentOperations) webFrame] + 64
(WebDOMOperations.m:89)
4    -[WebHTMLView(WebDocumentInternalProtocols)
elementAtPoint:allowShadowContent:] + 244 (WebHTMLView.m:5835)
5    -[WebHTMLView(WebDocumentInternalProtocols) elementAtPoint:] + 84
(WebHTMLView.m:5826)
6    -[WebHTMLView(WebPrivate) _updateMouseoverWithEvent:] + 1492
(WebHTMLView.m:1192)
7    -[WebHTMLView(WebPrivate) _updateMouseoverWithFakeEvent] + 580
(WebHTMLView.m:800)
8    __NSFireDelayedPerform + 304
9    __CFRunLoopDoTimer + 184


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.