Bug 10098 – REGRESSION: Reproducible crash loading multi part jpeg image from webcam

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: Page Loading

[Alexander Kellett]

loading the above url, and many others like it (multi part jpeg i think)
crashes webkit. the actual backtraces i see are useless.

[Alexey Proskuryakov]

HTTP/1.1 200 OK
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Transfer-Encoding: chunked
Date: Tue, 25 Jul 2006 10:18:23 GMT
Content-Type: multipart/x-mixed-replace; boundary=--myboundary
Server: Apache/1.3.27 (Unix) PHP/4.3.1 DAV/0.9.15 mod_ssl/2.8.10 OpenSSL/0.9.6d mod_perl/1.27
Keep-Alive: timeout=15, max=250

[David Kilzer (:ddkilzer)]

In a debug build of WebKit r15614, an assertion failure is produced:

=================
ASSERTION FAILED: d->m_doc->parsing() (/Users/ddkilzer/Projects/Cocoa/WebKit/WebCore/page/Frame.cpp:2712 void WebCore::Frame::addData(const char*, int))
=================
Segmentation fault

Using production Safari 2.0.4 (419.3) on Mac OS X 10.4.7 (8J135/PowerPC), the multipart image eventually stops loading, but Safari doesn't crash.

Will post a crash log next.

[David Kilzer (:ddkilzer)]

Created attachment 9669 [details]
Assertion failure crash log (r15614)

I wonder if the fix is as simple as skipping that assertion for documents whose tokenizer wants raw data.

(In reply to comment #4)
> I wonder if the fix is as simple as skipping that assertion for documents whose
> tokenizer wants raw data.
> 

Oops, that was silly - it crashes the release build.

[Stephanie Lewis]

Doesn't crash with nightly 17633.  Given the amount of work done in loader lately, something changed