Bug 10190 - REGRESSION: Repro crash when navigating away from an image document that hasn't finished loading
Summary: REGRESSION: Repro crash when navigating away from an image document that hasn...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Nobody
URL:
Keywords: Regression
Depends on:
Blocks:
 
Reported: 2006-08-01 13:44 PDT by mitz
Modified: 2006-10-01 02:15 PDT (History)
0 users

See Also:


Attachments
Patch, still no test or change log (473 bytes, patch)
2006-08-01 13:47 PDT, mitz
no flags Details | Formatted Diff | Diff
Same old patch, but with a change log (1.04 KB, patch)
2006-09-25 14:28 PDT, mitz
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2006-08-01 13:44:39 PDT
You need a slow-loading image in order to reporduce this crash. Open the image URL, and when you start seeing part of the image, but before it finishes loading, go to a different (fast-loading) URL. As the new document is received, you get a crash in RenderBox::calcWidth(), due to dereferencing a null view() pointer.

I have a patch, but no test yet.
Comment 1 mitz 2006-08-01 13:47:02 PDT
Created attachment 9800 [details]
Patch, still no test or change log

Other classes' imageChanged() implementations seem safe.
Comment 2 mitz 2006-09-25 14:28:08 PDT
Created attachment 10766 [details]
Same old patch, but with a change log

I tried to make an http+navigationController test for this, but with the current DumpRenderTree functionality (and even with some additions) I couldn't get it to crash.
Comment 3 Darin Adler 2006-09-25 14:34:17 PDT
Comment on attachment 10766 [details]
Same old patch, but with a change log

r=me
Comment 4 Alexey Proskuryakov 2006-10-01 02:15:45 PDT
Committed revision 16697.