Bug 12964

Summary: REGRESSION: crash in -[WebBaseNetscapePluginStream _deliverData] at simpsonsmovie.com
Product: WebKit Reporter: Stuart Bryant <srb_uk>
Component: Plug-insAssignee: Darin Adler <darin>
Status: RESOLVED FIXED    
Severity: Normal CC: ddkilzer, mitz, webkit
Priority: P1 Keywords: InRadar, NeedsReduction, Regression
Version: 523.x (Safari 3)   
Hardware: Mac   
OS: OS X 10.4   
URL: http://www.simpsonsmovie.com
Attachments:
Description Flags
patch with change log adele: review+

Stuart Bryant
Reported 2007-03-04 07:50:30 PST
Once the site is loaded and you get past the country selection screen, as the progress indicator is counting up, the nightly build quits everytime. Regular 10.4.8 Safari copes with the site fine, as does Firefox 2.0.0.2 and Opera 9.10.
Attachments
patch with change log (7.40 KB, patch)
2007-03-11 10:24 PDT, Darin Adler 		adele: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
David Kilzer (:ddkilzer)
Comment 1 2007-03-04 09:08:58 PST
D'OH! We can't have simpsonsmovie.com crashing WebKit!
David Kilzer (:ddkilzer)
Comment 2 2007-03-04 15:33:40 PST
Stack trace from WebKit r19952 (looks like a case of an over-released object): Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0x322b2028 Thread 0 Crashed: 0 <<00000000>> 0xfffeff10 objc_msgSend_rtp + 16 1 com.apple.WebKit 0x00319ce8 -[WebBaseNetscapePluginStream _deliverData] + 792 (WebBaseNetscapePluginStream.m:418) 2 com.apple.WebKit 0x0031a118 -[WebBaseNetscapePluginStream receivedData:] + 364 (WebBaseNetscapePluginStream.m:456) 3 com.apple.WebCore 0x01457f78 WebCore::NetscapePlugInStreamLoader::didReceiveData(char const*, int, long long, bool) + 216 (NetscapePlugInStreamLoaderMac.mm:97) 4 com.apple.WebCore 0x01490868 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 108 5 com.apple.WebCore 0x01466588 -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] + 240 (ResourceHandleMac.mm:352) 6 com.apple.Foundation 0x929935d4 -[NSURLConnection(NSURLConnectionInternal) _sendDidReceiveDataCallback] + 564 7 com.apple.Foundation 0x92991a74 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 488 8 com.apple.Foundation 0x92991810 _sendCallbacks + 156 9 com.apple.CoreFoundation 0x907dd4cc __CFRunLoopDoSources0 + 384 10 com.apple.CoreFoundation 0x907dc9fc __CFRunLoopRun + 452 11 com.apple.CoreFoundation 0x907dc47c CFRunLoopRunSpecific + 268 12 com.apple.HIToolbox 0x93208740 RunCurrentEventLoopInMode + 264 13 com.apple.HIToolbox 0x93207dd4 ReceiveNextEventCommon + 380 14 com.apple.HIToolbox 0x93207c40 BlockUntilNextEventMatchingListInMode + 96 15 com.apple.AppKit 0x9370cae4 _DPSNextEvent + 384 16 com.apple.AppKit 0x9370c7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116 17 com.apple.Safari 0x00006740 0x1000 + 22336 18 com.apple.AppKit 0x93708cec -[NSApplication run] + 472 19 com.apple.AppKit 0x937f987c NSApplicationMain + 452 20 com.apple.Safari 0x0005c77c 0x1000 + 374652 21 com.apple.Safari 0x0005c624 0x1000 + 374308
Jeff McGlynn
Comment 3 2007-03-05 02:56:03 PST
The first time that I tried this it didn't crash WebKit on my PPC mac. This may be because I spent at least 5 minutes trying to find my country in the list. Instead it redirected me to /?#splash/ and played the same sequence again. The only problem was that the audio didn't stop playing from previous pageviews. I had to close the browser to get rid of the background music -- closing the page had no effect. After restarting WebKit I reproduced the crash with r19962, and I haven't been able to reproduce what happened on my first attempt.
Mark Rowe (bdash)
Comment 4 2007-03-07 06:46:58 PST
<rdar://problem/5045717>
Darin Adler
Comment 5 2007-03-11 10:24:02 PDT
Created attachment 13585 [details] patch with change log
Darin Adler
Comment 6 2007-03-11 20:39:02 PDT
Committed revision 20107.
Note You need to log in before you can comment on or make changes to this bug.