Bug 10098

Summary: REGRESSION: Reproducible crash loading multi part jpeg image from webcam
Product: WebKit Reporter: Alexander Kellett <a>
Component: Page LoadingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Major CC: andersca, ap, ddkilzer, mitz
Priority: P1 Keywords: Regression
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
URL: http://www.warwick.ac.uk/newwebcam/cgi-bin/webcam.pl?dummy=garb
Attachments:
Description Flags
Assertion failure crash log (r15614) none

Alexander Kellett
Reported 2006-07-25 02:42:31 PDT
loading the above url, and many others like it (multi part jpeg i think) crashes webkit. the actual backtraces i see are useless.
Attachments
Assertion failure crash log (r15614) (20.73 KB, text/plain)
2006-07-25 04:32 PDT, David Kilzer (:ddkilzer) 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2006-07-25 03:19:55 PDT
HTTP/1.1 200 OK Connection: Keep-Alive Proxy-Connection: Keep-Alive Transfer-Encoding: chunked Date: Tue, 25 Jul 2006 10:18:23 GMT Content-Type: multipart/x-mixed-replace; boundary=--myboundary Server: Apache/1.3.27 (Unix) PHP/4.3.1 DAV/0.9.15 mod_ssl/2.8.10 OpenSSL/0.9.6d mod_perl/1.27 Keep-Alive: timeout=15, max=250
David Kilzer (:ddkilzer)
Comment 2 2006-07-25 04:32:00 PDT
In a debug build of WebKit r15614, an assertion failure is produced: ================= ASSERTION FAILED: d->m_doc->parsing() (/Users/ddkilzer/Projects/Cocoa/WebKit/WebCore/page/Frame.cpp:2712 void WebCore::Frame::addData(const char*, int)) ================= Segmentation fault Using production Safari 2.0.4 (419.3) on Mac OS X 10.4.7 (8J135/PowerPC), the multipart image eventually stops loading, but Safari doesn't crash. Will post a crash log next.
David Kilzer (:ddkilzer)
Comment 3 2006-07-25 04:32:43 PDT
Created attachment 9669 [details] Assertion failure crash log (r15614)
mitz
Comment 4 2006-07-25 09:30:39 PDT
I wonder if the fix is as simple as skipping that assertion for documents whose tokenizer wants raw data.
mitz
Comment 5 2006-07-25 09:32:09 PDT
(In reply to comment #4) > I wonder if the fix is as simple as skipping that assertion for documents whose > tokenizer wants raw data. > Oops, that was silly - it crashes the release build.
Stephanie Lewis
Comment 6 2006-11-06 18:59:51 PST
Doesn't crash with nightly 17633. Given the amount of work done in loader lately, something changed
Note You need to log in before you can comment on or make changes to this bug.