Bug 10098

Summary: REGRESSION: Reproducible crash loading multi part jpeg image from webcam
Product: WebKit Reporter: Alexander Kellett <a>
Component: Page LoadingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Major CC: andersca, ap, ddkilzer, mitz
Priority: P1 Keywords: Regression
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
URL: http://www.warwick.ac.uk/newwebcam/cgi-bin/webcam.pl?dummy=garb
Attachments:
Description Flags
Assertion failure crash log (r15614) none

Description Alexander Kellett 2006-07-25 02:42:31 PDT
loading the above url, and many others like it (multi part jpeg i think)
crashes webkit. the actual backtraces i see are useless.
Comment 1 Alexey Proskuryakov 2006-07-25 03:19:55 PDT
HTTP/1.1 200 OK
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Transfer-Encoding: chunked
Date: Tue, 25 Jul 2006 10:18:23 GMT
Content-Type: multipart/x-mixed-replace; boundary=--myboundary
Server: Apache/1.3.27 (Unix) PHP/4.3.1 DAV/0.9.15 mod_ssl/2.8.10 OpenSSL/0.9.6d mod_perl/1.27
Keep-Alive: timeout=15, max=250
Comment 2 David Kilzer (:ddkilzer) 2006-07-25 04:32:00 PDT
In a debug build of WebKit r15614, an assertion failure is produced:

=================
ASSERTION FAILED: d->m_doc->parsing() (/Users/ddkilzer/Projects/Cocoa/WebKit/WebCore/page/Frame.cpp:2712 void WebCore::Frame::addData(const char*, int))
=================
Segmentation fault

Using production Safari 2.0.4 (419.3) on Mac OS X 10.4.7 (8J135/PowerPC), the multipart image eventually stops loading, but Safari doesn't crash.

Will post a crash log next.

Comment 3 David Kilzer (:ddkilzer) 2006-07-25 04:32:43 PDT
Created attachment 9669 [details]
Assertion failure crash log (r15614)
Comment 4 mitz 2006-07-25 09:30:39 PDT
I wonder if the fix is as simple as skipping that assertion for documents whose tokenizer wants raw data.
Comment 5 mitz 2006-07-25 09:32:09 PDT
(In reply to comment #4)
> I wonder if the fix is as simple as skipping that assertion for documents whose
> tokenizer wants raw data.
> 

Oops, that was silly - it crashes the release build.
Comment 6 Stephanie Lewis 2006-11-06 18:59:51 PST
Doesn't crash with nightly 17633.  Given the amount of work done in loader lately, something changed