[Webkit-unassigned] [Bug 90885] Accessing width or height of a detached image input element causes crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=90885


Alexey Proskuryakov (on vacation until 7/18) <ap at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Accessing the width or      |Accessing width or height
                   |height of an image input    |of a detached image input
                   |field caused crash          |element causes crash
                 CC|                            |ap at webkit.org




--- Comment #1 from Alexey Proskuryakov (on vacation until 7/18) <ap at webkit.org>  2012-07-11 00:31:06 PST ---
In a debug build:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                 0x000000010429ef88 WTF::OwnPtr<WebCore::HTMLImageLoader>::operator->() const + 88 (OwnPtr.h:64)
1   com.apple.WebCore                 0x000000010438b005 WebCore::ImageInputType::height() const + 165 (ImageInputType.cpp:193)
2   com.apple.WebCore                 0x00000001042c37f0 WebCore::HTMLInputElement::height() const + 48 (HTMLInputElement.cpp:1712)
3   com.apple.WebCore                 0x00000001046e807a WebCore::jsHTMLInputElementHeight(JSC::ExecState*, JSC::JSValue, JSC::PropertyName) + 74 (JSHTMLInputElement.cpp:378)
4   com.apple.JavaScriptCore          0x0000000102e2e739 JSC::PropertySlot::getValue(JSC::ExecState*, JSC::PropertyName) const + 249 (PropertySlot.h:75)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.