Safari autocomplete segfault

Here’s a fun bug in Safari. Below is a form input field with maxlength set to 37. In Safari on OS X, type the following 36 characters:

The building is closed for maintenan

You should have “maintenance” pop up as an autocomplete. Click the word to autocomplete. Safari will segfault.

 

The crash report shows:

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000020

NB If you copy/paste the text, the autocomplete won’t popup, so you need to at least type the last word.
NBB This has been verified in Safari on OS X 10.8 – 10.10.

This bug has been reported to Apple.