[Webkit-unassigned] [Bug 23858] New: Crash when removing a HTMLSelectElement from the document from inside its focus event handler

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=23858

           Summary: Crash when removing a HTMLSelectElement from the
                    document from inside its focus event handler
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Macintosh
               URL: http://jimeh.info/webkit-bomb
        OS/Version: Mac OS X 10.5
            Status: NEW
          Keywords: HasReduction, InRadar, ReviewedForRadar
          Severity: Normal
          Priority: P1
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: mrowe at apple.com


<select id="bomb" onfocus="this.parentNode.removeChild(this)">
                <option>Click me to crash WebKit/Safari/Chrome.</option>
        </select><br />

This crashes because HTMLSelectElement::menuListDefaultEventHandler retrieves
its renderer into a local variable, calls focus() which calls into JS to call
the focus event handler, and then uses the renderer.  The event handler can
cause the renderer to be destroyed.

<rdar://problem/6570513>


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.