Bug 25876 - crash in malformed html
Summary: crash in malformed html
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Qt (show other bugs)
Version: 528+ (Nightly build)
Hardware: Other Linux
: P2 Major
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-05-19 14:55 PDT by Robert Hogan
Modified: 2009-09-07 10:30 PDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Hogan 2009-05-19 14:55:19 PDT
<html>
<frameset cols="25%,50%,25%">
  <frame src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1"
                        type="application/x-shockwave-flash" 
                        width="5" height="200">
</frameset>
</html>

The above html crashes for me when using Arora. It crashes in webkit though, hence reporting here:

gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet
(gdb) quitquit
The program is running.  Exit anyway? (y or n) [answered Y; input not from terminal]
(gdb) Process exited
gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet
(gdb) quitgdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet
(gdb) quitquit
The program is running.  Exit anyway? (y or n) [answered Y; input not from terminal]
(gdb) Process exited
gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet
(gdb) p clipRect
p clipRect
$126 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}
^done(gdb) p clipRect
p clipRect
$147 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}
^done(gdb) p static_cast<FrameView*>(parentScrollView)->windowClipRect()
p static_cast<FrameView*>(parentScrollView)->windowClipRect()
No symbol "static_cast<FrameView*>" in current context.
^error,msg="No symbol \"static_cast<FrameView*>\" in current context."(gdb) p (parentScrollView)->windowClipRect()
p (parentScrollView)->windowClipRect()
too few arguments in function call
^error,msg="too few arguments in function call"(gdb) p parentScrollView->windowClipRect()
p parentScrollView->windowClipRect()
too few arguments in function call
^error,msg="too few arguments in function call"(gdb) p windowRect
p windowRect
$168 = {m_location = {m_x = 8, m_y = 8}, m_size = {m_width = 110, m_height = 25}}
^done(gdb) p clipRect
p clipRect
$179 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 6, m_height = 807}}
^done(gdb) p clipRect.isEmpty()
p clipRect.isEmpty()
$180 = false
^done(gdb) p clipRect.isEmpty()
p clipRect.isEmpty()
$186 = true
^done(gdb) quitquit
The program is running.  Exit anyway? (y or n) [answered Y; input not from terminal]
(gdb) Process exited
gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet
(gdb) bt
bt
#0  0xb72c37a3 in typeinfo name for WebCore::QtPluginWidget () from /home/robert/WebKit/WebKitBuild/Debug/lib/libQtWebKit.so.4
#1  0xb67ad6cc in WebCore::ResourceLoader::didSendData (this=0x870cc40, bytesSent=3280145686516, totalBytesToBeSent=599739804683467960) at ../../../WebCore/loader/ResourceLoader.cpp:396
#2  0xb676f9ea in WebCore::FrameLoader::committedLoad (this=0x852b42c, loader=0x85e31f8, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:3617
#3  0xb675d987 in WebCore::DocumentLoader::commitLoad (this=0x85e31f8, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:361
#4  0xb675da16 in WebCore::DocumentLoader::receivedData (this=0x85e31f8, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:373
#5  0xb67747b5 in WebCore::FrameLoader::receivedData (this=0x852b42c, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:2443
#6  0xb67a6998 in WebCore::MainResourceLoader::addData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:148
#7  0xb67ae652 in WebCore::ResourceLoader::didReceiveData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/ResourceLoader.cpp:257
#8  0xb67a56e2 in WebCore::MainResourceLoader::didReceiveData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:360
#9  0xb67ad70a in WebCore::ResourceLoader::didReceiveData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, lengthReceived=763) at ../../../WebCore/loader/ResourceLoader.cpp:411
#10 0xb6a71bbd in WebCore::QNetworkReplyHandler::forwardData (this=0x857c108) at ../../../WebCore/platform/network/qt/QNetworkReplyHandler.cpp:338
#11 0xb6a735f4 in WebCore::QNetworkReplyHandler::qt_metacall (this=0x857c108, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x85e5550) at ./moc_QNetworkReplyHandler.cpp:71
#12 0xb451037b in QMetaCallEvent::placeMetaCall (this=0x8474158, object=0x857c108) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:489
#13 0xb4511ec8 in QObject::event (this=0x857c108, e=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:1109
#14 0xb4969a7f in QApplicationPrivate::notify_helper (this=0x821f5c0, receiver=0x857c108, e=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:4084
#15 0xb496d6b9 in QApplication::notify (this=0xbfd205b8, receiver=0x857c108, e=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3631
#16 0xb450081b in QCoreApplication::notifyInternal (this=0xbfd205b8, receiver=0x857c108, event=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:602
#17 0xb450198e in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x821f690) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:213
#18 0xb4501c3d in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:1132
#19 0xb452cc8f in postEventSourceDispatch (s=0x8227f10) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:218
#20 0xb431db88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#21 0xb43210eb in ?? () from /usr/lib/libglib-2.0.so.0
#22 0xb4321268 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#23 0xb452d03e in QEventDispatcherGlib::processEvents (this=0x82253b8, flags=@0xbfd204b8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventdispatcher_glib.cpp:323
#24 0xb4a03bd5 in QGuiEventDispatcherGlib::processEvents (this=0x82253b8, flags=@0xbfd204e8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qguieventdispatcher_glib.cpp:202
#25 0xb44ff9ed in QEventLoop::processEvents (this=0xbfd20560, flags=@0xbfd20528) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:149
#26 0xb44ffd5d in QEventLoop::exec (this=0xbfd20560, flags=@0xbfd20568) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:200
#27 0xb4501cfc in QCoreApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:880
#28 0xb4969217 in QApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3553
#29 0x08129bd4 in main (argc=1, argv=0xbfd20684) at main.cpp:37
^done(gdb) quitquit
The program is running.  Exit anyway? (y or n) [answered Y; input not from terminal]
(gdb) Process exited
gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet
(gdb) p clipRegion
p clipRegion
$43 = {d = 0xa3cbc78}
^done(gdb) p clipRegion.isEmpty()
p clipRegion.isEmpty()
$44 = false
^done(gdb) p clipRect
p clipRect
$45 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 1, m_height = 25}}
^done(gdb) p clipRect
p clipRect
$70 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 1, m_height = 25}}
^done(gdb) p clipRect
p clipRect
$83 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}
^done(gdb) p clipRegion.isEmpty()
p clipRegion.isEmpty()
$84 = true
^done(gdb) quitquit
The program is running.  Exit anyway? (y or n) [answered Y; input not from terminal]
(gdb) Process exited
gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet
(gdb) bt
bt
#0  0xb72d6563 in typeinfo name for WebCore::QtPluginWidget () from /home/robert/WebKit/WebKitBuild/Debug/lib/libQtWebKit.so.4
#1  0xb67c05fc in WebCore::ResourceLoader::didSendData (this=0x86f14e8, bytesSent=3280145764340, totalBytesToBeSent=613671922676468680) at ../../../WebCore/loader/ResourceLoader.cpp:396
#2  0xb678291a in WebCore::FrameLoader::committedLoad (this=0x884335c, loader=0x88f4428, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:3617
#3  0xb67708b7 in WebCore::DocumentLoader::commitLoad (this=0x88f4428, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:361
#4  0xb6770946 in WebCore::DocumentLoader::receivedData (this=0x88f4428, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:373
#5  0xb67876e5 in WebCore::FrameLoader::receivedData (this=0x884335c, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:2443
#6  0xb67b98c8 in WebCore::MainResourceLoader::addData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:148
#7  0xb67c1582 in WebCore::ResourceLoader::didReceiveData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/ResourceLoader.cpp:257
#8  0xb67b8612 in WebCore::MainResourceLoader::didReceiveData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:360
#9  0xb67c063a in WebCore::ResourceLoader::didReceiveData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, lengthReceived=763) at ../../../WebCore/loader/ResourceLoader.cpp:411
#10 0xb6a84aed in WebCore::QNetworkReplyHandler::forwardData (this=0x8776300) at ../../../WebCore/platform/network/qt/QNetworkReplyHandler.cpp:338
#11 0xb6a86524 in WebCore::QNetworkReplyHandler::qt_metacall (this=0x8776300, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x8987a68) at ./moc_QNetworkReplyHandler.cpp:71
#12 0xb452337b in QMetaCallEvent::placeMetaCall (this=0x8a1e0d8, object=0x8776300) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:489
#13 0xb4524ec8 in QObject::event (this=0x8776300, e=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:1109
#14 0xb497ca7f in QApplicationPrivate::notify_helper (this=0x85205c0, receiver=0x8776300, e=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:4084
#15 0xb49806b9 in QApplication::notify (this=0xbfc314c8, receiver=0x8776300, e=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3631
#16 0xb451381b in QCoreApplication::notifyInternal (this=0xbfc314c8, receiver=0x8776300, event=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:602
#17 0xb451498e in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x8520690) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:213
#18 0xb4514c3d in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:1132
#19 0xb453fc8f in postEventSourceDispatch (s=0x8528f10) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:218
#20 0xb4330b88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#21 0xb43340eb in ?? () from /usr/lib/libglib-2.0.so.0
#22 0xb4334268 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#23 0xb454003e in QEventDispatcherGlib::processEvents (this=0x85263b8, flags=@0xbfc313c8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventdispatcher_glib.cpp:323
#24 0xb4a16bd5 in QGuiEventDispatcherGlib::processEvents (this=0x85263b8, flags=@0xbfc313f8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qguieventdispatcher_glib.cpp:202
#25 0xb45129ed in QEventLoop::processEvents (this=0xbfc31470, flags=@0xbfc31438) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:149
#26 0xb4512d5d in QEventLoop::exec (this=0xbfc31470, flags=@0xbfc31478) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:200
#27 0xb4514cfc in QCoreApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:880
#28 0xb497c217 in QApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3553
#29 0x08129bd4 in main (argc=1, argv=0xbfc31594) at main.cpp:37
^done
Comment 1 Tor Arne Vestbø 2009-09-07 10:26:54 PDT
Can't reproduce in WebKit trunk (r48110), against Qt 4.6 (77fd77d6), on Mac OS 10.5

Used: 

data:text/html,<html>
<frameset cols="25%,50%,25%">
<frame src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1"
type="application/x-shockwave-flash" 
width="5" height="200">
</frameset>
</html>

Please reopen if still valid.