36856 2010-03-30 15:31:30 -0700 REGRESSION (r56439) - Crash choosing the icon for file uploads 2010-03-30 18:09:17 -0700 1 1 1 Unclassified WebKit Page Loading 528+ (Nightly build) All All RESOLVED DUPLICATE 36723 InRadar P1 Normal --- 1 beidson webkit-unassigned tkent oldest_to_newest 206207 0 beidson 2010-03-30 15:31:30 -0700 REGRESSION (r56439) - Crash choosing the icon for file uploads Drag a file onto a "Choose file..." button somewhere in an input type=file. I used http://www.largefilesasap.com, for example. The FileChooser passed to the ChromeClient is null, resulting in a null deref crash: #0 0x1023ad6ac in WTF::RefPtr<WebCore::Icon>::operator= at RefPtr.h:129 #1 0x1023ad2b3 in WebCore::FileChooser::iconLoaded at FileChooser.cpp:87 #2 0x101b50afd in WebChromeClient::chooseIconForFiles at WebChromeClient.mm:649 #3 0x102148eda in WebCore::Chrome::chooseIconForFiles at Chrome.cpp:435 #4 0x1029107e7 in WebCore::RenderFileUploadControl::chooseIconForFiles at RenderFileUploadControl.cpp:120 #5 0x1023ad28f in WebCore::FileChooser::loadIcon at FileChooser.cpp:82 #6 0x1023ad899 in WebCore::FileChooser::FileChooser at FileChooser.cpp:44 #7 0x1023ad4a8 in WebCore::FileChooser::create at FileChooser.cpp:49 #8 0x102910d5c in WebCore::RenderFileUploadControl::RenderFileUploadControl at RenderFileUploadControl.cpp:73 #9 0x10249c8c1 in WebCore::HTMLInputElement::createRenderer at HTMLInputElement.cpp:1186 #10 0x1028458b7 in WebCore::Node::createRendererIfNeeded at Node.cpp:1387 #11 0x10238a0c3 in WebCore::Element::attach at Element.cpp:830 #12 0x102486a4d in WebCore::HTMLFormControlElement::attach at HTMLFormControlElement.cpp:129 #13 0x10249d951 in WebCore::HTMLInputElement::attach at HTMLInputElement.cpp:1222 #14 0x102389a0e in WebCore::Element::recalcStyle at Element.cpp:908 #15 0x102486549 in WebCore::HTMLFormControlElement::recalcStyle at HTMLFormControlElement.cpp:258 #16 0x102389fc2 in WebCore::Element::recalcStyle at Element.cpp:971 ... #48 0x102389fc2 in WebCore::Element::recalcStyle at Element.cpp:971 #49 0x102293c91 in WebCore::Document::recalcStyle at Document.cpp:1357 #50 0x102293310 in WebCore::Document::updateStyleIfNeeded at Document.cpp:1399 #51 0x10228d27a in WebCore::Document::updateStyleForAllDocuments at Document.cpp:1416 #52 0x1028418d7 in WebCore::Node::dispatchGenericEvent at Node.cpp:2704 #53 0x1028419ad in WebCore::Node::dispatchEvent at Node.cpp:2567 #54 0x1024863c6 in WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent at HTMLFormControlElement.cpp:214 #55 0x1029108e6 in WebCore::RenderFileUploadControl::valueChanged at RenderFileUploadControl.cpp:99 #56 0x1023ad430 in WebCore::FileChooser::chooseFiles at FileChooser.cpp:76 #57 0x1023ad465 in WebCore::FileChooser::chooseFile at FileChooser.cpp:66 #58 0x10290f4cb in WebCore::RenderFileUploadControl::receiveDroppedFiles at RenderFileUploadControl.cpp:299 #59 0x10236d738 in WebCore::DragController::concludeEditDrag at DragController.cpp:411 #60 0x10236e896 in WebCore::DragController::performDrag at DragController.cpp:197 #61 0x101c1d5d5 in -[WebView performDragOperation:] at WebView.mm:3460 206208 1 beidson 2010-03-30 15:32:47 -0700 In radar as <rdar://problem/7802461> 206215 2 beidson 2010-03-30 15:39:40 -0700 Seems to not repro when I have certain breakpoints enabled - somehow timing related. Very reliable without breakpoints, though. 206247 3 beidson 2010-03-30 16:20:19 -0700 RenderFileUploadControl::chooseIconForFiles is being called from within the RenderFileUploadControl constructor, while the FileChooser is still being created. 206299 4 tkent 2010-03-30 18:09:17 -0700 *** This bug has been marked as a duplicate of bug 36723 ***