[Webkit-unassigned] [Bug 14894] Malformed table innerHTML causes Safari to crash

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=14894


ap at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|WebCore JavaScript          |HTML DOM
     Ever Confirmed|0                           |1
           Keywords|                            |HasReduction, NeedsRadar
           Priority|P2                          |P1




------- Comment #2 from ap at webkit.org  2007-08-07 05:38 PDT -------
Confirmed with r24875.

Thread 0 Crashed:
0   com.apple.WebCore                   0x0101b55c
WebCore::HTMLParser::handleError(WebCore::Node*, bool, WebCore::AtomicString
const&, int) + 3836
1   com.apple.WebCore                   0x0101bb2d
WebCore::HTMLParser::insertNode(WebCore::Node*, bool) + 509
2   com.apple.WebCore                   0x0101c0fe
WebCore::HTMLParser::parseToken(WebCore::Token*) + 606
3   com.apple.WebCore                   0x0101f102
WebCore::HTMLTokenizer::processToken() + 626
4   com.apple.WebCore                   0x01024b2c
WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&, bool) + 780
5   com.apple.WebCore                   0x0102522f
WebCore::parseHTMLDocumentFragment(WebCore::String const&,
WebCore::DocumentFragment*) + 191
6   com.apple.WebCore                   0x01012df5
WebCore::HTMLElement::createContextualFragment(WebCore::String const&) + 229
7   com.apple.WebCore                   0x010132c0
WebCore::HTMLElement::setInnerHTML(WebCore::String const&, int&) + 32


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.