[Webkit-unassigned] [Bug 36856] New: REGRESSION (r56439) - Crash choosing the icon for file uploads

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=36856

           Summary: REGRESSION (r56439) - Crash choosing the icon for file
                    uploads
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: Page Loading
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: beidson at apple.com


REGRESSION (r56439) - Crash choosing the icon for file uploads

Drag a file onto a "Choose file..." button somewhere in an input type=file.

I used http://www.largefilesasap.com, for example.

The FileChooser passed to the ChromeClient is null, resulting in a null deref
crash:

#0    0x1023ad6ac in WTF::RefPtr<WebCore::Icon>::operator= at RefPtr.h:129
#1    0x1023ad2b3 in WebCore::FileChooser::iconLoaded at FileChooser.cpp:87
#2    0x101b50afd in WebChromeClient::chooseIconForFiles at
WebChromeClient.mm:649
#3    0x102148eda in WebCore::Chrome::chooseIconForFiles at Chrome.cpp:435
#4    0x1029107e7 in WebCore::RenderFileUploadControl::chooseIconForFiles at
RenderFileUploadControl.cpp:120
#5    0x1023ad28f in WebCore::FileChooser::loadIcon at FileChooser.cpp:82
#6    0x1023ad899 in WebCore::FileChooser::FileChooser at FileChooser.cpp:44
#7    0x1023ad4a8 in WebCore::FileChooser::create at FileChooser.cpp:49
#8    0x102910d5c in WebCore::RenderFileUploadControl::RenderFileUploadControl
at RenderFileUploadControl.cpp:73
#9    0x10249c8c1 in WebCore::HTMLInputElement::createRenderer at
HTMLInputElement.cpp:1186
#10    0x1028458b7 in WebCore::Node::createRendererIfNeeded at Node.cpp:1387
#11    0x10238a0c3 in WebCore::Element::attach at Element.cpp:830
#12    0x102486a4d in WebCore::HTMLFormControlElement::attach at
HTMLFormControlElement.cpp:129
#13    0x10249d951 in WebCore::HTMLInputElement::attach at
HTMLInputElement.cpp:1222
#14    0x102389a0e in WebCore::Element::recalcStyle at Element.cpp:908
#15    0x102486549 in WebCore::HTMLFormControlElement::recalcStyle at
HTMLFormControlElement.cpp:258
#16    0x102389fc2 in WebCore::Element::recalcStyle at Element.cpp:971
...
#48    0x102389fc2 in WebCore::Element::recalcStyle at Element.cpp:971
#49    0x102293c91 in WebCore::Document::recalcStyle at Document.cpp:1357
#50    0x102293310 in WebCore::Document::updateStyleIfNeeded at
Document.cpp:1399
#51    0x10228d27a in WebCore::Document::updateStyleForAllDocuments at
Document.cpp:1416
#52    0x1028418d7 in WebCore::Node::dispatchGenericEvent at Node.cpp:2704
#53    0x1028419ad in WebCore::Node::dispatchEvent at Node.cpp:2567
#54    0x1024863c6 in
WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent at
HTMLFormControlElement.cpp:214
#55    0x1029108e6 in WebCore::RenderFileUploadControl::valueChanged at
RenderFileUploadControl.cpp:99
#56    0x1023ad430 in WebCore::FileChooser::chooseFiles at FileChooser.cpp:76
#57    0x1023ad465 in WebCore::FileChooser::chooseFile at FileChooser.cpp:66
#58    0x10290f4cb in WebCore::RenderFileUploadControl::receiveDroppedFiles at
RenderFileUploadControl.cpp:299
#59    0x10236d738 in WebCore::DragController::concludeEditDrag at
DragController.cpp:411
#60    0x10236e896 in WebCore::DragController::performDrag at
DragController.cpp:197
#61    0x101c1d5d5 in -[WebView performDragOperation:] at WebView.mm:3460

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.