Bug 15024 – REGRESSION (r24872-r25143) : sometimes Reproducible crash

• Component: Plug-ins
• Status: RESOLVED FIXED

[Alexander Luck]

I have a crash on some heise.de pages. Sometimes load this, but most crash safari at load.

Backtrace:

*----> Stack Back Trace <----*
ChildEBP RetAddr  Args to Child              
0013edf0 101bbb73 00000000 7ff0e220 00000001 WebKit!WebCore__PluginViewWin__updateWindow+0x88
0013ee1c 100d727b 0013ee30 7f9ba62c 0013f074 WebKit!WebCore__PluginViewWin__setFrameGeometry+0x73
0013ee60 101152f0 00000078 00000258 00000258 WebKit!WebCore__Widget__resize+0x4b (FPO: [2,14,1])
0013ee90 10115458 00000078 00000258 7f9ba62c WebKit!WebCore__RenderWidget__resizeWidget+0x90
0013eec4 102abe1a 7ff0e220 7ff0e220 7f9ba62c WebKit!WebCore__RenderWidget__setWidget+0x118
0013eed4 100babc4 7ff0e220 0013efd0 7f9ba62c WebKit!WebCore__RenderPart__setWidget+0x2a (FPO: [1,0,0])
0013ef2c 100baa20 0013efd0 0013f060 0013f074 WebKit!WebCore__FrameLoader__loadPlugin+0x114 (FPO: [EBP 0x7fec96c0] [5,17,3])
0013f034 1023e901 7fec96c0 7f9ba62c 0013f064 WebKit!WebCore__FrameLoader__requestObject+0x130 (FPO: [EBP 0x00000000] [5,56,4])
0013f0b0 101aa590 00000000 7fa0e2b4 00000000 WebKit!WebCore__RenderPartObject__updateWidget+0x821
00000000 00000000 00000000 00000000 00000000 WebKit!WebCore__GlyphPageTreeNode__getChild+0x20


*----> Statusabbild für Threadkennung 0xe8c <----*

eax=0013ede0 ebx=7ff0e3c8 ecx=00000258 edx=00000078 esi=7ff0e220 edi=00000000
eip=101bb8e8 esp=0013ed88 ebp=0013edf0 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

Funktion: WebKit!WebCore__PluginViewWin__updateWindow
        101bb8cc 8b4808           mov     ecx,[eax+0x8]
        101bb8cf 8b500c           mov     edx,[eax+0xc]
        101bb8d2 8b06             mov     eax,[esi]
        101bb8d4 894c2410         mov     [esp+0x10],ecx
        101bb8d8 8d4c2458         lea     ecx,[esp+0x58]
        101bb8dc 89542414         mov     [esp+0x14],edx
        101bb8e0 8b501c           mov     edx,[eax+0x1c]
        101bb8e3 51               push    ecx
        101bb8e4 8bce             mov     ecx,esi
        101bb8e6 ffd2             call    edx
FEHLER ->101bb8e8 8b5708           mov     edx,[edi+0x8]     ds:0023:00000008=????????
        101bb8eb 8b08             mov     ecx,[eax]
        101bb8ed 8b7a08           mov     edi,[edx+0x8]
        101bb8f0 8b4004           mov     eax,[eax+0x4]
        101bb8f3 8b520c           mov     edx,[edx+0xc]
        101bb8f6 2bcf             sub     ecx,edi
        101bb8f8 2bc2             sub     eax,edx
        101bb8fa 894c2418         mov     [esp+0x18],ecx
        101bb8fe 8944241c         mov     [esp+0x1c],eax
        101bb902 8b44240c         mov     eax,[esp+0xc]
        101bb906 8d4c2418         lea     ecx,[esp+0x18]

[Adam Roben (:aroben)]

Thanks for the report, Alexander! Could you attach a crash dump as described at <http://webkit.org/quality/crashlogs.html>?

[Alexander Luck]

Created attachment 16034 [details]
dump file

The dr. watson dump file of the crash.

[Alexander Luck]

r25168: No crash with this nightly build

[Robert Blaut]

(In reply to comment #3)
> r25168: No crash with this nightly build
> 

Per reporter comment I resolve the bug as FIXED.