[Webkit-unassigned] [Bug 12942] New: Reproducible crash on qantas.com.au changing selected item in <select> via JS

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=12942

           Summary: Reproducible crash on qantas.com.au changing selected
                    item in <select> via JS
           Product: WebKit
           Version: 522+ (nightly)
          Platform: Macintosh
               URL: http://www.qantas.com.au/regions/dyn/home/qualifier-
                    region-au
        OS/Version: Mac OS X 10.4
            Status: NEW
          Keywords: NeedsReduction, NeedsRadar
          Severity: Major
          Priority: P1
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: bdash at webkit.org


Steps to reproduce:
1. Load <http://www.qantas.com.au/regions/dyn/home/qualifier-region-au>.
2. Select 'April 2007' from the "Depart" dropdown.
3. From the "Return" day dropdown select "Tuesday 10".

Expected results:
Page updates to match new selection.

Actual results:
Beachball, then crash.

0   com.apple.WebCore                   0x010aa4d4
WebCore::HTMLSelectElement::setSelectedIndex(int, bool, bool) + 326
(HTMLSelectElement.cpp:188)
1   com.apple.WebCore                   0x013c278d
WebCore::JSHTMLSelectElement::putValueProperty(KJS::ExecState*, int,
KJS::JSValue*, int) + 153 (JSHTMLSelectElement.cpp:224)
2   com.apple.WebCore                   0x015bf15a bool
KJS::lookupPut<WebCore::JSHTMLSelectElement>(KJS::ExecState*, KJS::Identifier
const&, KJS::JSValue*, int, KJS::HashTable const*,
WebCore::JSHTMLSelectElement*) + 162 (lookup.h:254)

Will attach the full backtrace.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.