Created attachment 236020 [details] Test case The failing test: <script onbeforeload=document.write('<') src=a></script> Backtrace: ASSERTION FAILED: m_tokenizer->state() == HTMLTokenizer::DataState ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp(324) : void WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff97334700 (LWP 22359)] 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff3841a98 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x808cd0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:324 #2 0x00007ffff3841125 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x808cd0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:189 #3 0x00007ffff38422b7 in WebCore::HTMLDocumentParser::append (this=0x808cd0, inputSource=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:440 #4 0x00007ffff353462f in WebCore::DecodedDataDocumentParser::flush (this=0x808cd0, writer=...) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #5 0x00007ffff399140b in WebCore::DocumentWriter::end (this=0x7a2ab0) at ../../Source/WebCore/loader/DocumentWriter.cpp:247 #6 0x00007ffff397e49b in WebCore::DocumentLoader::finishedLoading (this=0x7a2a10, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441 #7 0x00007ffff397e204 in WebCore::DocumentLoader::notifyFinished (this=0x7a2a10, resource=0x855a80) at ../../Source/WebCore/loader/DocumentLoader.cpp:375 #8 0x00007ffff3a24a99 in WebCore::CachedResource::checkNotify (this=0x855a80) at ../../Source/WebCore/loader/cache/CachedResource.cpp:334 #9 0x00007ffff3a24b80 in WebCore::CachedResource::finishLoading (this=0x855a80) at ../../Source/WebCore/loader/cache/CachedResource.cpp:350 #10 0x00007ffff3a21b3a in WebCore::CachedRawResource::finishLoading (this=0x855a80, data=0x83a210) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:98 #11 0x00007ffff39d87da in WebCore::SubresourceLoader::didFinishLoading (this=0x8396f0, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:310 #12 0x00007ffff39d4cc7 in WebCore::ResourceLoader::didFinishLoading (this=0x8396f0, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:517 #13 0x00007ffff4297429 in WebCore::readCallback (asyncResult=0x87a1d0, data=0x83a810) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #14 0x00007fffec1d82ea in async_ready_callback_wrapper (source_object=0x98cb30, res=0x87a1d0, user_data=0x83a810) at ginputstream.c:519 #15 0x00007fffec1f7ceb in g_task_return_now (task=0x87a1d0) at gtask.c:1108 #16 0x00007fffec1f7d09 in complete_in_idle_cb (task=0x87a1d0) at gtask.c:1117 #17 0x00007fffeb44e2e6 in g_main_dispatch (context=0x677bb0) at gmain.c:3065 #18 g_main_context_dispatch (context=context@entry=0x677bb0) at gmain.c:3641 #19 0x00007fffeb44e638 in g_main_context_iterate (context=0x677bb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3712 #20 0x00007fffeb44ea3a in g_main_loop_run (loop=0x70c750) at gmain.c:3906 #21 0x00007ffff306a156 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #22 0x00007ffff2fa35e0 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #23 0x00007ffff2fa3445 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #24 0x000000000040085d in main (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32
*** This bug has been marked as a duplicate of bug 110546 ***