[Webkit-unassigned] [Bug 44172] New: WebKit::WebFormElement::getFormControlElements ReadAV at NULL

Wed Aug 18 06:47:32 PDT 2010

https://bugs.webkit.org/show_bug.cgi?id=44172

           Summary: WebKit::WebFormElement::getFormControlElements
                    ReadAV at NULL
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skylined at chromium.org
                CC: eric at webkit.org


Created an attachment (id=64700)
 --> (https://bugs.webkit.org/attachment.cgi?id=64700)
Repro

The following repro causes a NULL pointer in Chromium latest:
<body onload="
  document.write('<svg><form><strike><form>');
  document.close();
">

id:             WebKit::WebFormElement::getFormControlElements ReadAV at NULL (c289b174a22e30d5c270e0327fe517e9)
description:    Attempt to read from NULL pointer (+0x60) in WebKit::WebFormElement::getFormControlElements
stack:          WebKit::WebFormElement::getFormControlElements
                FormManager::ExtractForms
                AutoFillHelper::FrameContentsAvailable
                RenderView::didFinishDocumentLoad
                WebKit::FrameLoaderClientImpl::dispatchDidFinishDocumentLoad
                WebCore::FrameLoader::finishedParsing
                WebCore::Document::finishedParsing
                WebCore::DocumentWriter::endIfNotLoadingMainResource
                WebCore::Document::close
                WebCore::HTMLDocumentInternal::closeCallback
                v8::internal::HandleApiCallHelper<...>
                v8::internal::Builtin_HandleApiCall
                v8::internal::Invoke
                v8::internal::Execution::Call
                ...

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.