Bug 12964 - REGRESSION: crash in -[WebBaseNetscapePluginStream _deliverData] at simpsonsmovie.com
Summary: REGRESSION: crash in -[WebBaseNetscapePluginStream _deliverData] at simpsonsm...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Plug-ins (show other bugs)
Version: 523.x (Safari 3)
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Darin Adler
URL: http://www.simpsonsmovie.com
Keywords: InRadar, NeedsReduction, Regression
Depends on:
Blocks:
 
Reported: 2007-03-04 07:50 PST by Stuart Bryant
Modified: 2007-03-11 20:39 PDT (History)
3 users (show)

See Also:


Attachments
patch with change log (7.40 KB, patch)
2007-03-11 10:24 PDT, Darin Adler
adele: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stuart Bryant 2007-03-04 07:50:30 PST
Once the site is loaded and you get past the country selection screen, as the progress indicator is counting up, the nightly build quits everytime. Regular 10.4.8 Safari copes with the site fine, as does Firefox 2.0.0.2 and Opera 9.10.
Comment 1 David Kilzer (:ddkilzer) 2007-03-04 09:08:58 PST
D'OH!  We can't have simpsonsmovie.com crashing WebKit!

Comment 2 David Kilzer (:ddkilzer) 2007-03-04 15:33:40 PST
Stack trace from WebKit r19952 (looks like a case of an over-released object):

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x322b2028

Thread 0 Crashed:
0   <<00000000>> 	0xfffeff10 objc_msgSend_rtp + 16
1   com.apple.WebKit               	0x00319ce8 -[WebBaseNetscapePluginStream _deliverData] + 792 (WebBaseNetscapePluginStream.m:418)
2   com.apple.WebKit               	0x0031a118 -[WebBaseNetscapePluginStream receivedData:] + 364 (WebBaseNetscapePluginStream.m:456)
3   com.apple.WebCore              	0x01457f78 WebCore::NetscapePlugInStreamLoader::didReceiveData(char const*, int, long long, bool) + 216 (NetscapePlugInStreamLoaderMac.mm:97)
4   com.apple.WebCore              	0x01490868 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 108
5   com.apple.WebCore              	0x01466588 -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] + 240 (ResourceHandleMac.mm:352)
6   com.apple.Foundation           	0x929935d4 -[NSURLConnection(NSURLConnectionInternal) _sendDidReceiveDataCallback] + 564
7   com.apple.Foundation           	0x92991a74 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 488
8   com.apple.Foundation           	0x92991810 _sendCallbacks + 156
9   com.apple.CoreFoundation       	0x907dd4cc __CFRunLoopDoSources0 + 384
10  com.apple.CoreFoundation       	0x907dc9fc __CFRunLoopRun + 452
11  com.apple.CoreFoundation       	0x907dc47c CFRunLoopRunSpecific + 268
12  com.apple.HIToolbox            	0x93208740 RunCurrentEventLoopInMode + 264
13  com.apple.HIToolbox            	0x93207dd4 ReceiveNextEventCommon + 380
14  com.apple.HIToolbox            	0x93207c40 BlockUntilNextEventMatchingListInMode + 96
15  com.apple.AppKit               	0x9370cae4 _DPSNextEvent + 384
16  com.apple.AppKit               	0x9370c7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
17  com.apple.Safari               	0x00006740 0x1000 + 22336
18  com.apple.AppKit               	0x93708cec -[NSApplication run] + 472
19  com.apple.AppKit               	0x937f987c NSApplicationMain + 452
20  com.apple.Safari               	0x0005c77c 0x1000 + 374652
21  com.apple.Safari               	0x0005c624 0x1000 + 374308

Comment 3 Jeff McGlynn 2007-03-05 02:56:03 PST
The first time that I tried this it didn't crash WebKit on my PPC mac.  This may be because I spent at least 5 minutes trying to find my country in the list.  Instead it redirected me to /?#splash/ and played the same sequence again.  The only problem was that the audio didn't stop playing from previous pageviews.  I had to close the browser to get rid of the background music -- closing the page had no effect.

After restarting WebKit I reproduced the crash with r19962, and I haven't been able to reproduce what happened on my first attempt.
Comment 4 Mark Rowe (bdash) 2007-03-07 06:46:58 PST
<rdar://problem/5045717>
Comment 5 Darin Adler 2007-03-11 10:24:02 PDT
Created attachment 13585 [details]
patch with change log
Comment 6 Darin Adler 2007-03-11 20:39:02 PDT
Committed revision 20107.