<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>28250</bug_id>
          
          <creation_ts>2009-08-13 02:56:00 -0700</creation_ts>
          <short_desc>Crash in FrameLoader::loadResourceSynchronously</short_desc>
          <delta_ts>2012-10-30 09:34:33 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Page Loading</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>Linux</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Xan Lopez">xan.lopez</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>ap</cc>
    
    <cc>d-r</cc>
    
    <cc>plaes</cc>
    
    <cc>robin.webkit</cc>
    
    <cc>xan.lopez</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>139765</commentid>
    <comment_count>0</comment_count>
      <attachid>34726</attachid>
    <who name="Xan Lopez">xan.lopez</who>
    <bug_when>2009-08-13 02:56:00 -0700</bug_when>
    <thetext>Created attachment 34726
mem_test.html

Running ToT (r47187), execute the attached testcase in a new tab/window, and then close it. It will crash with the following bt, confirmed in at least GTK and Qt ports.

[Thread debugging using libthread_db enabled]
[New Thread 0xb454f700 (LWP 22030)]
[New Thread 0xb3534b90 (LWP 22041)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb454f700 (LWP 22030)]
0xb6e8e7aa in WTF::OwnPtr&lt;WebCore::ApplicationCacheHost&gt;::get (this=0x4dc)
    at ../../../JavaScriptCore/wtf/OwnPtr.h:55
55	        PtrType get() const { return m_ptr; }
(gdb) bt
#0  0xb6e8e7aa in WTF::OwnPtr&lt;WebCore::ApplicationCacheHost&gt;::get (this=0x4dc)
    at ../../../JavaScriptCore/wtf/OwnPtr.h:55
#1  0xb6e8e7d0 in WebCore::DocumentLoader::applicationCacheHost (this=0x0)
    at ../../../WebCore/loader/DocumentLoader.h:208
#2  0xb6f5b9d1 in WebCore::FrameLoader::loadResourceSynchronously (
    this=0x8aea19c, request=@0xbfabc278, 
    storedCredentials=WebCore::AllowStoredCredentials, error=@0xbfabc19c, 
    response=@0xbfabc104, data=@0xbfabc1b0)
    at ../../../WebCore/loader/FrameLoader.cpp:3728
#3  0xb6f4b05a in WebCore::DocumentThreadableLoader::loadResourceSynchronously
    (document=0x8dfdbe0, request=@0xbfabc278, client=@0x8e151d4, 
    storedCredentials=WebCore::AllowStoredCredentials)
    at ../../../WebCore/loader/DocumentThreadableLoader.cpp:55
#4  0xb6f9800c in WebCore::ThreadableLoader::loadResourceSynchronously (
    context=0x8dfdc10, request=@0xbfabc278, client=@0x8e151d4, 
    storedCredentials=WebCore::AllowStoredCredentials)
    at ../../../WebCore/loader/ThreadableLoader.cpp:69
#5  0xb71e27cf in WebCore::XMLHttpRequest::loadRequestSynchronously (
    this=0x8e151c8, request=@0xbfabc278, ec=@0xbfabc44c)
    at ../../../WebCore/xml/XMLHttpRequest.cpp:663
#6  0xb71e2a60 in WebCore::XMLHttpRequest::makeSameOriginRequest (
    this=0x8e151c8, ec=@0xbfabc44c)
    at ../../../WebCore/xml/XMLHttpRequest.cpp:510
---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
#7  0xb71e452b in WebCore::XMLHttpRequest::createRequest (this=0x8e151c8, 
    ec=@0xbfabc44c) at ../../../WebCore/xml/XMLHttpRequest.cpp:488
#8  0xb71e49b1 in WebCore::XMLHttpRequest::send (this=0x8e151c8, 
    body=@0xbfabc3e8, ec=@0xbfabc44c)
    at ../../../WebCore/xml/XMLHttpRequest.cpp:446
#9  0xb71e49f2 in WebCore::XMLHttpRequest::send (this=0x8e151c8, 
    ec=@0xbfabc44c) at ../../../WebCore/xml/XMLHttpRequest.cpp:389
#10 0xb6b96f3b in WebCore::JSXMLHttpRequest::send (this=0xb2b11400, 
    exec=0xb2b34050, args=@0xbfabc4bc)
    at ../../../WebCore/bindings/js/JSXMLHttpRequestCustom.cpp:125
#11 0xb7759b84 in WebCore::jsXMLHttpRequestPrototypeFunctionSend (
    exec=0xb2b34050, thisValue={m_ptr = 0xb2b11400}, args=@0xbfabc4bc)
    at generated/debug/JSXMLHttpRequest.cpp:373
#12 0xb38d9167 in ?? ()
#13 0xb6a6307d in JSC::JITCode::execute (this=0x8e15530, 
    registerFile=0x8e04f78, callFrame=0xb2b34024, globalData=0x8e02e18, 
    exception=0x8e03334) at ../../../JavaScriptCore/jit/JITCode.h:79
#14 0xb6a641b7 in JSC::Interpreter::execute (this=0x8e04f70, 
    functionBodyNode=0x8e15518, callFrame=0x8e05454, function=0xb2b11380, 
    thisObj=0xb2b10000, args=@0xbfabc6e0, scopeChain=0x8e057e0, 
    exception=0x8e03334)
    at ../../../JavaScriptCore/interpreter/Interpreter.cpp:722
#15 0xb6ac2890 in JSC::JSFunction::call (this=0xb2b11380, exec=0x8e05454,</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>493422</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2011-10-31 11:23:19 -0700</bug_when>
    <thetext>I cannot reproduce this in Safari/WebKit ToT.

This sounds a bit like bug 70218, but that was only about Soup, not Qt.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>754362</commentid>
    <comment_count>2</comment_count>
    <who name="Dominik Röttsches (drott)">d-r</who>
    <bug_when>2012-10-30 07:46:03 -0700</bug_when>
    <thetext>Can&apos;t reproduce it on EFL, and I doubt it would reproduce on GTK any more. Can we close it, Xan?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>754440</commentid>
    <comment_count>3</comment_count>
    <who name="Xan Lopez">xan.lopez</who>
    <bug_when>2012-10-30 09:34:33 -0700</bug_when>
    <thetext>Can&apos;t repro in GTK+ anymore either, closing.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>34726</attachid>
            <date>2009-08-13 02:56:00 -0700</date>
            <delta_ts>2009-08-13 02:56:00 -0700</delta_ts>
            <desc>mem_test.html</desc>
            <filename>mem_test.htm</filename>
            <type>text/html</type>
            <size>311</size>
            <attacher name="Xan Lopez">xan.lopez</attacher>
            
              <data encoding="base64">PGh0bWw+PGhlYWQ+CjxtZXRhIGh0dHAtZXF1aXY9ImNvbnRlbnQtdHlwZSIgY29udGVudD0idGV4
dC9odG1sOyBjaGFyc2V0PVVURi04Ij4KPC9oZWFkPjxib2R5Pgo8c2NyaXB0IHR5cGU9InRleHQv
amF2YXNjcmlwdCI+CnZhciB4bWxIdHRwPW5ldyBYTUxIdHRwUmVxdWVzdCgpOwoKZnVuY3Rpb24g
dGVzdCgpIHsKCXhtbEh0dHAub3BlbigiR0VUIiwibWVtX3Rlc3QuaHRtIiwgZmFsc2UpOwoJeG1s
SHR0cC5zZW5kKG51bGwpOwogICAgc2V0VGltZW91dCh0ZXN0LDEwMCk7Cn0KCnRlc3QoKTsKPC9z
Y3JpcHQ+ClRlc3QKPC9ib2R5PjwvaHRtbD4=
</data>

          </attachment>
      

    </bug>

</bugzilla>