Bug 10098 - REGRESSION: Reproducible crash loading multi part jpeg image from webcam
Summary: REGRESSION: Reproducible crash loading multi part jpeg image from webcam
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Major
Assignee: Nobody
URL: http://www.warwick.ac.uk/newwebcam/cg...
Keywords: Regression
Depends on:
Blocks:
 
Reported: 2006-07-25 02:42 PDT by Alexander Kellett
Modified: 2006-11-06 18:59 PST (History)
4 users (show)

See Also:

Attachments
Assertion failure crash log (r15614) (20.73 KB, text/plain)
2006-07-25 04:32 PDT, David Kilzer (:ddkilzer) 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Kellett 2006-07-25 02:42:31 PDT 
loading the above url, and many others like it (multi part jpeg i think)
crashes webkit. the actual backtraces i see are useless.
Comment 1 Alexey Proskuryakov 2006-07-25 03:19:55 PDT 
HTTP/1.1 200 OK
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Transfer-Encoding: chunked
Date: Tue, 25 Jul 2006 10:18:23 GMT
Content-Type: multipart/x-mixed-replace; boundary=--myboundary
Server: Apache/1.3.27 (Unix) PHP/4.3.1 DAV/0.9.15 mod_ssl/2.8.10 OpenSSL/0.9.6d mod_perl/1.27
Keep-Alive: timeout=15, max=250
Comment 2 David Kilzer (:ddkilzer) 2006-07-25 04:32:00 PDT 
In a debug build of WebKit r15614, an assertion failure is produced:

=================
ASSERTION FAILED: d->m_doc->parsing() (/Users/ddkilzer/Projects/Cocoa/WebKit/WebCore/page/Frame.cpp:2712 void WebCore::Frame::addData(const char*, int))
=================
Segmentation fault

Using production Safari 2.0.4 (419.3) on Mac OS X 10.4.7 (8J135/PowerPC), the multipart image eventually stops loading, but Safari doesn't crash.

Will post a crash log next.
Comment 3 David Kilzer (:ddkilzer) 2006-07-25 04:32:43 PDT 
Created attachment 9669 [details]
Assertion failure crash log (r15614)
Comment 4 mitz 2006-07-25 09:30:39 PDT 
I wonder if the fix is as simple as skipping that assertion for documents whose tokenizer wants raw data.
Comment 5 mitz 2006-07-25 09:32:09 PDT 
(In reply to comment #4)
> I wonder if the fix is as simple as skipping that assertion for documents whose
> tokenizer wants raw data.
> 

Oops, that was silly - it crashes the release build.
Comment 6 Stephanie Lewis 2006-11-06 18:59:51 PST 
Doesn't crash with nightly 17633.  Given the amount of work done in loader lately, something changed