RESOLVED WORKSFORME25876
crash in malformed html 
https://bugs.webkit.org/show_bug.cgi?id=25876
Summary crash in malformed html
Robert Hogan
Reported 2009-05-19 14:55:19 PDT
<html> <frameset cols="25%,50%,25%"> <frame src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1" type="application/x-shockwave-flash" width="5" height="200"> </frameset> </html> The above html crashes for me when using Arora. It crashes in webkit though, hence reporting here: gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet (gdb) quitquit The program is running. Exit anyway? (y or n) [answered Y; input not from terminal] (gdb) Process exited gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet (gdb) quitgdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet (gdb) quitquit The program is running. Exit anyway? (y or n) [answered Y; input not from terminal] (gdb) Process exited gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet (gdb) p clipRect p clipRect $126 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}} ^done(gdb) p clipRect p clipRect $147 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}} ^done(gdb) p static_cast<FrameView*>(parentScrollView)->windowClipRect() p static_cast<FrameView*>(parentScrollView)->windowClipRect() No symbol "static_cast<FrameView*>" in current context. ^error,msg="No symbol \"static_cast<FrameView*>\" in current context."(gdb) p (parentScrollView)->windowClipRect() p (parentScrollView)->windowClipRect() too few arguments in function call ^error,msg="too few arguments in function call"(gdb) p parentScrollView->windowClipRect() p parentScrollView->windowClipRect() too few arguments in function call ^error,msg="too few arguments in function call"(gdb) p windowRect p windowRect $168 = {m_location = {m_x = 8, m_y = 8}, m_size = {m_width = 110, m_height = 25}} ^done(gdb) p clipRect p clipRect $179 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 6, m_height = 807}} ^done(gdb) p clipRect.isEmpty() p clipRect.isEmpty() $180 = false ^done(gdb) p clipRect.isEmpty() p clipRect.isEmpty() $186 = true ^done(gdb) quitquit The program is running. Exit anyway? (y or n) [answered Y; input not from terminal] (gdb) Process exited gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet (gdb) bt bt #0 0xb72c37a3 in typeinfo name for WebCore::QtPluginWidget () from /home/robert/WebKit/WebKitBuild/Debug/lib/libQtWebKit.so.4 #1 0xb67ad6cc in WebCore::ResourceLoader::didSendData (this=0x870cc40, bytesSent=3280145686516, totalBytesToBeSent=599739804683467960) at ../../../WebCore/loader/ResourceLoader.cpp:396 #2 0xb676f9ea in WebCore::FrameLoader::committedLoad (this=0x852b42c, loader=0x85e31f8, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:3617 #3 0xb675d987 in WebCore::DocumentLoader::commitLoad (this=0x85e31f8, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:361 #4 0xb675da16 in WebCore::DocumentLoader::receivedData (this=0x85e31f8, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:373 #5 0xb67747b5 in WebCore::FrameLoader::receivedData (this=0x852b42c, data=0x86aa1d0 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:2443 #6 0xb67a6998 in WebCore::MainResourceLoader::addData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:148 #7 0xb67ae652 in WebCore::ResourceLoader::didReceiveData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/ResourceLoader.cpp:257 #8 0xb67a56e2 in WebCore::MainResourceLoader::didReceiveData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:360 #9 0xb67ad70a in WebCore::ResourceLoader::didReceiveData (this=0x85175b8, data=0x86aa1d0 "CWS\bZ\005", length=763, lengthReceived=763) at ../../../WebCore/loader/ResourceLoader.cpp:411 #10 0xb6a71bbd in WebCore::QNetworkReplyHandler::forwardData (this=0x857c108) at ../../../WebCore/platform/network/qt/QNetworkReplyHandler.cpp:338 #11 0xb6a735f4 in WebCore::QNetworkReplyHandler::qt_metacall (this=0x857c108, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x85e5550) at ./moc_QNetworkReplyHandler.cpp:71 #12 0xb451037b in QMetaCallEvent::placeMetaCall (this=0x8474158, object=0x857c108) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:489 #13 0xb4511ec8 in QObject::event (this=0x857c108, e=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:1109 #14 0xb4969a7f in QApplicationPrivate::notify_helper (this=0x821f5c0, receiver=0x857c108, e=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:4084 #15 0xb496d6b9 in QApplication::notify (this=0xbfd205b8, receiver=0x857c108, e=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3631 #16 0xb450081b in QCoreApplication::notifyInternal (this=0xbfd205b8, receiver=0x857c108, event=0x8474158) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:602 #17 0xb450198e in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x821f690) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:213 #18 0xb4501c3d in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:1132 #19 0xb452cc8f in postEventSourceDispatch (s=0x8227f10) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:218 #20 0xb431db88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #21 0xb43210eb in ?? () from /usr/lib/libglib-2.0.so.0 #22 0xb4321268 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 #23 0xb452d03e in QEventDispatcherGlib::processEvents (this=0x82253b8, flags=@0xbfd204b8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventdispatcher_glib.cpp:323 #24 0xb4a03bd5 in QGuiEventDispatcherGlib::processEvents (this=0x82253b8, flags=@0xbfd204e8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qguieventdispatcher_glib.cpp:202 #25 0xb44ff9ed in QEventLoop::processEvents (this=0xbfd20560, flags=@0xbfd20528) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:149 #26 0xb44ffd5d in QEventLoop::exec (this=0xbfd20560, flags=@0xbfd20568) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:200 #27 0xb4501cfc in QCoreApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:880 #28 0xb4969217 in QApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3553 #29 0x08129bd4 in main (argc=1, argv=0xbfd20684) at main.cpp:37 ^done(gdb) quitquit The program is running. Exit anyway? (y or n) [answered Y; input not from terminal] (gdb) Process exited gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet (gdb) p clipRegion p clipRegion $43 = {d = 0xa3cbc78} ^done(gdb) p clipRegion.isEmpty() p clipRegion.isEmpty() $44 = false ^done(gdb) p clipRect p clipRect $45 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 1, m_height = 25}} ^done(gdb) p clipRect p clipRect $70 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 1, m_height = 25}} ^done(gdb) p clipRect p clipRect $83 = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}} ^done(gdb) p clipRegion.isEmpty() p clipRegion.isEmpty() $84 = true ^done(gdb) quitquit The program is running. Exit anyway? (y or n) [answered Y; input not from terminal] (gdb) Process exited gdb /home/robert/Development/torora/arora --interpreter=mi2 -quiet (gdb) bt bt #0 0xb72d6563 in typeinfo name for WebCore::QtPluginWidget () from /home/robert/WebKit/WebKitBuild/Debug/lib/libQtWebKit.so.4 #1 0xb67c05fc in WebCore::ResourceLoader::didSendData (this=0x86f14e8, bytesSent=3280145764340, totalBytesToBeSent=613671922676468680) at ../../../WebCore/loader/ResourceLoader.cpp:396 #2 0xb678291a in WebCore::FrameLoader::committedLoad (this=0x884335c, loader=0x88f4428, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:3617 #3 0xb67708b7 in WebCore::DocumentLoader::commitLoad (this=0x88f4428, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:361 #4 0xb6770946 in WebCore::DocumentLoader::receivedData (this=0x88f4428, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/DocumentLoader.cpp:373 #5 0xb67876e5 in WebCore::FrameLoader::receivedData (this=0x884335c, data=0x89b0da8 "CWS\bZ\005", length=763) at ../../../WebCore/loader/FrameLoader.cpp:2443 #6 0xb67b98c8 in WebCore::MainResourceLoader::addData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:148 #7 0xb67c1582 in WebCore::ResourceLoader::didReceiveData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/ResourceLoader.cpp:257 #8 0xb67b8612 in WebCore::MainResourceLoader::didReceiveData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, lengthReceived=763, allAtOnce=false) at ../../../WebCore/loader/MainResourceLoader.cpp:360 #9 0xb67c063a in WebCore::ResourceLoader::didReceiveData (this=0x88f5c30, data=0x89b0da8 "CWS\bZ\005", length=763, lengthReceived=763) at ../../../WebCore/loader/ResourceLoader.cpp:411 #10 0xb6a84aed in WebCore::QNetworkReplyHandler::forwardData (this=0x8776300) at ../../../WebCore/platform/network/qt/QNetworkReplyHandler.cpp:338 #11 0xb6a86524 in WebCore::QNetworkReplyHandler::qt_metacall (this=0x8776300, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x8987a68) at ./moc_QNetworkReplyHandler.cpp:71 #12 0xb452337b in QMetaCallEvent::placeMetaCall (this=0x8a1e0d8, object=0x8776300) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:489 #13 0xb4524ec8 in QObject::event (this=0x8776300, e=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qobject.cpp:1109 #14 0xb497ca7f in QApplicationPrivate::notify_helper (this=0x85205c0, receiver=0x8776300, e=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:4084 #15 0xb49806b9 in QApplication::notify (this=0xbfc314c8, receiver=0x8776300, e=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3631 #16 0xb451381b in QCoreApplication::notifyInternal (this=0xbfc314c8, receiver=0x8776300, event=0x8a1e0d8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:602 #17 0xb451498e in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x8520690) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:213 #18 0xb4514c3d in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:1132 #19 0xb453fc8f in postEventSourceDispatch (s=0x8528f10) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.h:218 #20 0xb4330b88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #21 0xb43340eb in ?? () from /usr/lib/libglib-2.0.so.0 #22 0xb4334268 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 #23 0xb454003e in QEventDispatcherGlib::processEvents (this=0x85263b8, flags=@0xbfc313c8) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventdispatcher_glib.cpp:323 #24 0xb4a16bd5 in QGuiEventDispatcherGlib::processEvents (this=0x85263b8, flags=@0xbfc313f8) at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qguieventdispatcher_glib.cpp:202 #25 0xb45129ed in QEventLoop::processEvents (this=0xbfc31470, flags=@0xbfc31438) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:149 #26 0xb4512d5d in QEventLoop::exec (this=0xbfc31470, flags=@0xbfc31478) at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qeventloop.cpp:200 #27 0xb4514cfc in QCoreApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/corelib/kernel/qcoreapplication.cpp:880 #28 0xb497c217 in QApplication::exec () at /var/tmp/qt-x11-src-4.5.0/src/gui/kernel/qapplication.cpp:3553 #29 0x08129bd4 in main (argc=1, argv=0xbfc31594) at main.cpp:37 ^done
Attachments
Add attachment proposed patch, testcase, etc.
Tor Arne Vestbø
Comment 1 2009-09-07 10:26:54 PDT
Can't reproduce in WebKit trunk (r48110), against Qt 4.6 (77fd77d6), on Mac OS 10.5 Used: data:text/html,<html> <frameset cols="25%,50%,25%"> <frame src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1" type="application/x-shockwave-flash" width="5" height="200"> </frameset> </html> Please reopen if still valid.
Note You need to log in before you can comment on or make changes to this bug.