[Webkit-unassigned] [Bug 25694] New: HTMLParser::createHead() ASSERT: Creating an element, calling document.open() and writing to the document NULL ptr

Mon May 11 08:09:47 PDT 2009

https://bugs.webkit.org/show_bug.cgi?id=25694

           Summary: HTMLParser::createHead() ASSERT: Creating an element,
                    calling  document.open() and writing to the document
                    NULL ptr
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Keywords: GoogleBug
          Severity: Normal
          Priority: P1
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skylined at chromium.org
                CC: eric at webkit.org

The following code seems to destroy the "Document" element and then cause the
code to access it regardless, causing a NULL ptr. This is detected by an ASSERT
in debug builds.

<SCRIPT>
  setTimeout(function () {
    node = document.createElement("M");
    document.open();
    node.innerHTML = "<body>";
  }, 1);
</SCRIPT>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.