Issue metadata
Sign in to add a comment
|
Malformed <font> tag in anchor crashes Chrome
Reported by
chris.sh...@fairfaxmedia.com.au,
Jul 14 2016
|
||||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 Steps to reproduce the problem: I have cut down the pages to a reproducible test case. If you extract the testcase.zip file to a tempoary folder, open the index-bad.html file and hover the mouse over the URL "2016/07/14" and Chrome crashes. Now open the file index-good.html and hover the mouse over the URL "2016/07/14" and notice that it doesn't crash Chrome. What is the expected behavior? What went wrong? The difference between the two files is that I have closed the <font> tag that exists within the anchor tag used for that hyperlink. Crashed report ID: How much crashed? Just one tab Is it a problem with a plugin? No Did this work before? N/A Chrome version: 51.0.2704.103 m Channel: stable OS Version: 6.1 (Windows 7, Windows Server 2008 R2) Flash Version: Shockwave Flash 22.0 r0 This is so ridiculously obscure it's ridiculous.
,
Jul 20 2016
Thank you for the bug report, it looks like you've put some effort into reducing it. Could you cut and paste the crash ID from chrome://crashes? Thanks! I can't reproduce this on Linux 51.0.2704.106 (Official Build) (64-bit); it might be platform-specific.
,
Jul 20 2016
Tentatively me.
,
Jul 20 2016
Thanks for looking at this folks. Crash ID: crash/0fb04c7600000000 I'm running Windows 7, winver.exe tells me the version is Version 6.1 (build 7601: Service Pack 1). One of our Linux server admins loaded up the page on Windows 2008 R2 standard and couldn't reproduce the issue, and on Windows 7 it seems to happen to me about 90% of the time when I access the internal corporate PHP web app, and so far 100% of the time when I use the local test case. If you need me to get something further, let me know and I'll see what I can do!
,
Jul 20 2016
Thanks! This looks like a problem with layout or hit testing.
,
Jul 21 2016
Can the layout team look at the https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/layout/LayoutInline.cpp?sq=package:chromium&rcl=1469099736&l=791 and see if that makes sense. I wonder if we are running into a case where we are trying to hit test a culled inline but it shouldn't call https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/layout/LayoutInline.cpp?sq=package:chromium&rcl=1469099736&l=534
,
Jul 21 2016
Cannot reproduce on linux either will try windows layer.
,
Jul 21 2016
Looks to be a duplicate of 625436
,
Jul 22 2016
,
Aug 25 2016
Moving Blink>Input>HitTesting to Blink>HitTesting |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by cbiesin...@chromium.org
, Jul 19 2016