Bug 30105 – Crash in WebCore::StringImpl::reverseFind when trying to load a null stylesheet for a site specific hack.

• Component: CSS
• Status: RESOLVED FIXED

[Stephanie Lewis]

Created attachment 40680 [details]
Crashlog

Crash when trying to load a null KHTMLFixes stylesheet.  Caused by http://trac.webkit.org/changeset/48818

Found on membuster.  Crashes on TOT with Safari on Mac and Windows

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000001011e101a WebCore::StringImpl::reverseFind(WebCore::StringImpl*, int, bool) + 42 (StringImpl.cpp:673)
1   com.apple.WebCore             	0x0000000100d90c34 WebCore::HTMLLinkElement::setCSSStyleSheet(WebCore::String const&, WebCore::String const&, WebCore::CachedCSSStyleSheet const*) + 660 (PlatformString.h:123)
2   com.apple.WebCore             	0x0000000100b0db32 WebCore::CachedCSSStyleSheet::checkNotify() + 146 (RefPtr.h:53)
3   com.apple.WebCore             	0x0000000101051f99 WebCore::Loader::Host::didReceiveData(WebCore::SubresourceLoader*, char const*, int) + 281 (loader.cpp:509)
4   com.apple.WebCore             	0x00000001011e8e6e WebCore::SubresourceLoader::didReceiveData(char const*, int, long long, bool) + 94 (SubresourceLoader.cpp:170)
5   com.apple.Foundation          	0x00007fff86f6d50b _NSURLConnectionDidReceiveData + 137
6   com.apple.CFNetwork           	0x00007fff80696770 URLConnectionClient::_clientDidReceiveData(__CFData const*, URLConnectionClient::ClientConnectionEventQueue*) + 236
7   com.apple.CFNetwork           	0x00007fff806f9282 URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 218
8   com.apple.CFNetwork           	0x00007fff806f9512 URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 874
9   com.apple.CFNetwork           	0x00007fff8068362b URLConnectionClient::processEvents() + 121
10  com.apple.CFNetwork           	0x00007fff80683406 MultiplexerSource::perform() + 160
11  com.apple.CoreFoundation      	0x00007fff82efd281 __CFRunLoopDoSources0 + 1361
12  com.apple.CoreFoundation      	0x00007fff82efb879 __CFRunLoopRun + 873
13  com.apple.CoreFoundation      	0x00007fff82efb03f CFRunLoopRunSpecific + 575
14  com.apple.HIToolbox           	0x00007fff87380c4e RunCurrentEventLoopInMode + 333
15  com.apple.HIToolbox           	0x00007fff87380a53 ReceiveNextEventCommon + 310
16  com.apple.HIToolbox           	0x00007fff8738090c BlockUntilNextEventMatchingListInMode + 59
17  com.apple.AppKit              	0x00007fff8464e570 _DPSNextEvent + 718
18  com.apple.AppKit              	0x00007fff8464ded9 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 155
19  com.apple.Safari              	0x00000001000375b5 -[BrowserApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 177 (BrowserApplication.mm:322)
20  com.apple.AppKit              	0x00007fff84613b29 -[NSApplication run] + 395
21  com.apple.AppKit              	0x00007fff8460c844 NSApplicationMain + 364
22  com.apple.Safari              	0x000000010000226c start + 52

[Stephanie Lewis]

Created attachment 40681 [details]
testcase - needs to be run from a server

[Stephanie Lewis]

Created attachment 40682 [details]
patch

[Stephanie Lewis]

Committed revision 49145

[Alexey Proskuryakov]

*** Bug 30114 has been marked as a duplicate of this bug. ***