11439 2006-10-27 13:46:25 -0700 REGRESSION: Another page loading crash 2006-10-27 14:35:29 -0700 1 1 1 Unclassified WebKit Page Loading 420+ Mac OS X 10.4 RESOLVED FIXED http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=windows&articleId=9004437&taxonomyId=125 P1 Normal --- 1 dev+webkit sullivan sullivan oldest_to_newest 49310 0 dev+webkit 2006-10-27 13:46:25 -0700 The above url causes WebKit to crash with the following backtrace: 0 com.apple.WebCore 0x013f5130 WebCore::DocumentLoader::originalRequestCopy() const + 0 1 com.apple.WebKit 0x0032c0b0 -[WebFrame(WebInternal) _createItemTreeWithTargetFrame:clippedAtTarget:] + 80 2 com.apple.WebKit 0x0032c13c -[WebFrame(WebInternal) _createItemTreeWithTargetFrame:clippedAtTarget:] + 220 3 com.apple.WebKit 0x0032788c -[WebFrame(WebInternal) _addBackForwardItemClippedAtTarget:] + 108 4 com.apple.WebCore 0x013fa9d4 WebCore::FrameLoader::transitionToCommitted(NSDictionary*) + 372 5 com.apple.WebCore 0x013fc0fc WebCore::FrameLoader::commitProvisionalLoad(NSDictionary*) + 252 6 com.apple.WebCore 0x013f4e98 WebCore::DocumentLoader::commitLoad(NSData*) + 56 7 com.apple.WebCore 0x013f5504 WebCore::DocumentLoader::receivedData(NSData*) + 164 8 com.apple.WebCore 0x013ffedc WebCore::WebResourceLoader::didReceiveData(NSData*, long long, bool) + 76 9 com.apple.WebCore 0x01401c14 WebCore::MainResourceLoader::didReceiveData(NSData*, long long, bool) + 52 10 com.apple.WebCore 0x013ff0d4 -[WebCoreResourceLoaderAsDelegate connection:didReceiveData:lengthReceived:] + 84 49254 1 sullivan 2006-10-27 14:07:33 -0700 Crash is here: if (useOriginal) request = [dataSrc _documentLoader]->originalRequestCopy(); else request = [dataSrc request]; I suspect the fix is to fall back to [dataSrc request] in the case where [dataSrc _documentLoader] returns nil, but someone should check what this code used to do in the case where [dataSrc _documentLoader] returned nil. 49201 2 sullivan 2006-10-27 14:22:47 -0700 - (WebHistoryItem *)_createItem:(BOOL)useOriginal { WebDataSource *dataSrc = [self dataSource]; dataSrc is nil here, which is why [dataSrc _documentLoader]->originalRequestCopy() crashes. The crashing line used to be: request = [[dataSrc _documentLoader] originalRequestCopy]; The change was in 17245. I'll test the simple fix of changing this one line. 49202 3 11261 sullivan 2006-10-27 14:31:51 -0700 Created attachment 11261 patch to restore nil-handling behavior 49203 4 11261 andersca 2006-10-27 14:34:10 -0700 Comment on attachment 11261 patch to restore nil-handling behavior r=me 49204 5 sullivan 2006-10-27 14:35:29 -0700 Checked in as svn revision 17388. 11261 2006-10-27 14:31:51 -0700 2006-10-27 14:34:10 -0700 patch to restore nil-handling behavior 11439_patch.txt text/plain 1538 sullivan SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cgICAocmV2aXNpb24gMTcz ODcpCisrKyBDaGFuZ2VMb2cgICAod29ya2luZyBjb3B5KQpAQCAtMSw1ICsxLDE2IEBACiAyMDA2 LTEwLTI3ICBKb2huIFN1bGxpdmFuICA8c3VsbGl2YW5AYXBwbGUuY29tPgogCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgLSBmaXhlZCBodHRw Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTQzOSAKKyAgICAgICAgICBSRUdS RVNTSU9OOiBBbm90aGVyIHBhZ2UgbG9hZGluZyBjcmFzaAorCisgICAgICAgICogV2ViVmlldy9X ZWJGcmFtZS5tbToKKyAgICAgICAgKC1bV2ViRnJhbWUgX2NyZWF0ZUl0ZW06XSk6CisgICAgICAg IEhhbmRsZSBuaWwgZG9jdW1lbnRMb2FkZXIgdGhlIHdheSB3ZSBkaWQgYmVmb3JlIE9iakMtPkMr KyBjaGFuZ2VzCisKKzIwMDYtMTAtMjcgIEpvaG4gU3VsbGl2YW4gIDxzdWxsaXZhbkBhcHBsZS5j b20+CisKICAgICAgICAgUmV2aWV3ZWQgYnkgQW5kZXJzCiAKICAgICAgICAgKiBXZWJWaWV3L1dl YkhUTUxWaWV3Lm06CkluZGV4OiBXZWJWaWV3L1dlYkZyYW1lLm1tCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdl YlZpZXcvV2ViRnJhbWUubW0gKHJldmlzaW9uIDE3Mzg3KQorKysgV2ViVmlldy9XZWJGcmFtZS5t bSAod29ya2luZyBjb3B5KQpAQCAtMjQ4LDkgKzI0OCwxMCBAQAogICAgIE5TVVJMICpVUkw7CiAg ICAgTlNVUkwgKm9yaWdpbmFsVVJMOwogICAgIFdlYkhpc3RvcnlJdGVtICpiZkl0ZW07CisgICAg V2ViQ29yZURvY3VtZW50TG9hZGVyICpkb2N1bWVudExvYWRlciA9IFtkYXRhU3JjIF9kb2N1bWVu dExvYWRlcl07CiAKICAgICBpZiAodXNlT3JpZ2luYWwpCi0gICAgICAgIHJlcXVlc3QgPSBbZGF0 YVNyYyBfZG9jdW1lbnRMb2FkZXJdLT5vcmlnaW5hbFJlcXVlc3RDb3B5KCk7CisgICAgICAgIHJl cXVlc3QgPSBkb2N1bWVudExvYWRlciA/IGRvY3VtZW50TG9hZGVyLT5vcmlnaW5hbFJlcXVlc3RD b3B5KCkgOiBuaWw7CiAgICAgZWxzZQogICAgICAgICByZXF1ZXN0ID0gW2RhdGFTcmMgcmVxdWVz dF07CiAKQEAgLTI1OSw3ICsyNjAsNyBAQAogICAgICAgICBvcmlnaW5hbFVSTCA9IHVucmVhY2hh YmxlVVJMOwogICAgIH0gZWxzZSB7CiAgICAgICAgIFVSTCA9IFtyZXF1ZXN0IFVSTF07Ci0gICAg ICAgIG9yaWdpbmFsVVJMID0gW1tkYXRhU3JjIF9kb2N1bWVudExvYWRlcl0tPm9yaWdpbmFsUmVx dWVzdENvcHkoKSBVUkxdOworICAgICAgICBvcmlnaW5hbFVSTCA9IGRvY3VtZW50TG9hZGVyID8g W2RvY3VtZW50TG9hZGVyLT5vcmlnaW5hbFJlcXVlc3RDb3B5KCkgVVJMXSA6IG5pbDsKICAgICB9 CiAKICAgICBMT0cgKEhpc3RvcnksICJjcmVhdGluZyBpdGVtIGZvciAlQCIsIHJlcXVlc3QpOwo=