[Webkit-unassigned] [Bug 144371] New: Reproducible crash removing name attribute from <img> node
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Apr 28 19:31:20 PDT 2015
https://bugs.webkit.org/show_bug.cgi?id=144371
Bug ID: 144371
Summary: Reproducible crash removing name attribute from <img>
node
Classification: Unclassified
Product: WebKit
Version: 528+ (Nightly build)
Hardware: Macintosh
OS: Mac OS X 10.10
Status: NEW
Severity: Normal
Priority: P2
Component: HTML DOM
Assignee: webkit-unassigned at lists.webkit.org
Reporter: neilj at fastmail.com
Created attachment 251916
--> https://bugs.webkit.org/attachment.cgi?id=251916&action=review
Minimal test case to crash Safari
Steps to reproduce (or see attached minimal test case):
1. Create a document using document.implementation.createHTMLDocument('')
2. Add an image node to this document with both a name and an id attribute.
3. Attempt to remove the name attribute from the image node.
Expected result:
The name attribute is removed. Safari does not crash.
Actual result:
Safari crashes.
This reproduces in the latest stable Safari (8.0.5) on both OS X and iOS.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150429/0c2ae5c9/attachment.html>
More information about the webkit-unassigned
mailing list