Bug 10190

Summary:

REGRESSION: Repro crash when navigating away from an image document that hasn't finished loading

Product:

WebKit

Reporter:

mitz

Component:

Layout and Rendering

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

Keywords:

Regression

Priority:

Version:

420+

Hardware:

Mac

OS:

OS X 10.4

Attachments:

Description	Flags
Patch, still no test or change log	none
Same old patch, but with a change log	darin: review+

Description mitz 2006-08-01 13:44:39 PDT

You need a slow-loading image in order to reporduce this crash. Open the image URL, and when you start seeing part of the image, but before it finishes loading, go to a different (fast-loading) URL. As the new document is received, you get a crash in RenderBox::calcWidth(), due to dereferencing a null view() pointer.

I have a patch, but no test yet.

Comment 1 mitz 2006-08-01 13:47:02 PDT

Created attachment 9800 [details]
Patch, still no test or change log

Other classes' imageChanged() implementations seem safe.

Comment 2 mitz 2006-09-25 14:28:08 PDT

Created attachment 10766 [details]
Same old patch, but with a change log

I tried to make an http+navigationController test for this, but with the current DumpRenderTree functionality (and even with some additions) I couldn't get it to crash.

Comment 3 Darin Adler 2006-09-25 14:34:17 PDT

Comment on attachment 10766 [details]
Same old patch, but with a change log

r=me

Comment 4 Alexey Proskuryakov 2006-10-01 02:15:45 PDT

Committed revision 16697.