[Webkit-unassigned] [Bug 13701] REGRESSION (r21431): Reproducible crash resulting from calling adoptNode on a password field

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=13701





------- Comment #4 from beidson at apple.com  2007-05-12 17:56 PDT -------
Fwiw, Mitz's test case causes havok for non-password elements as well.  Change
it to input type=text, for example.  Then run through the test.  You won't
crash right after clicking to go back to the cached page, but you will crash
when the view is torn down (close the tab, close the browser, etc)

This is because of the HTMLInputElements mis-registration for form state (a
problem existant before my patch) -
Thread 0 Crashed:
0   <<00000000>>        0x00000000 0 + 0
1   com.apple.WebCore           0x01381b60
WebCore::FrameLoader::saveDocumentState() + 356 (FrameLoader.cpp:3767)
2   com.apple.WebCore           0x01388bf5 WebCore::FrameLoader::closeURL() +
17 (FrameLoader.cpp:628)
3   com.apple.WebCore           0x01388c50
WebCore::FrameLoader::detachFromParent() + 44 (FrameLoader.cpp:2967)
4   com.apple.WebKit            0x0045d9e5 -[WebView(WebPrivate) _close] + 451
(WebView.mm:671)

I hope to fix both these in one fell swoop


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.