[Webkit-unassigned] [Bug 48799] Crash when dragging and dropping in a document with an invalid XHTML header

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=48799


Tony Chang <tony at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abarth at webkit.org




--- Comment #6 from Tony Chang <tony at chromium.org>  2010-11-08 16:03:20 PST ---
I did some testing, it looks like the svg file isn't rendered as svg, it's just parsed as XML.  So you can repro this bug by loading a random XML document without a body tag and then dragging anything into the XML document.

I'm not exactly sure why this doesn't repro in DRT.  It looks like DRT always loads random XML as an HTML document.  Maybe abarth has some insight into how we decide if something is an XML document vs an HTML document.

Here's an example: http://plexode.com/eval3/#ht=%3Ciframe%20src%3D%22data%3Atext%2Fxml%2C%3Cfoo%3E%3C%2Ffoo%3E%22%3E%3C%2Fiframe%3E&ohh=1&ohj=1&jt=&ojh=1&ojj=1&ms=100&oth=0&otj=0&cex=1
If you drag anything into the iframe (e.g., a bookmark from the bookmark toolbar), we crash trying to reference body.  The check seems OK, but it seems better if we can verify that we have an HTML document.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.