Bug 29670 – Crash observed while loading plugin content

• Status: RESOLVED
• Resolution: INVALID
• Component: WebKit Qt

[rashmi]

When clicked on the test case link, music player plugin is launched to play the content. But before the music player is launched, pluginView while checking for response received, coughs up an error and is set to NULL in setMainDocumentError().After this, immediately pluginView pointer is used, thus leading to QtLauncher crash.


Steps to Reproduce
------------------
1)Launch the QtLauncher.
2)Provide the below link in the QtLauncher
http://waplabdc.nokia-boston.com/browser/users/cwrt/BAT/index.html
3)Click on Download mp3.

Expected Result
---------------
QtLauncher should not crash.

Actual Result
--------------
QtLauncher crash is observed.

[rashmi]

Created attachment 39983 [details]
qtWebkit fix for mp3 play crash

null check added when plugin response failed to catch and m_pluginView tried to access again

[Tor Arne Vestbø]

Comment on attachment 39983 [details]
qtWebkit fix for mp3 play crash

Why isn't this already caught by the null-check 4 lines above the didReciveData call?

    // We re-check here as the plugin can have been created
    if (m_pluginView) {
        if (!m_hasSentResponseToPlugin) {
            m_pluginView->didReceiveResponse(loader->response());
            // didReceiveResponse sets up a new stream to the plug-in. on a full-page plug-in, a failure in
            // setting up this stream can cause the main document load to be cancelled, setting m_pluginView
            // to null
            if (!m_pluginView)
                return;
            m_hasSentResponseToPlugin = true;
        }
        m_pluginView->didReceiveData(data, length);
    }

Also, for future reference:

 - Do patches based on the root of the webkit source tree, not inside WebKit
 - Follow the QtWebKit bug reporting guidlines http://trac.webkit.org/wiki/QtWebKitContrib#ReportingBugs
   - In particular, choose the right component and add the Qt keyword
 - You can safely leave out comments like the one in this patch, that's what the changelog/commit message is for

[rashmi]

Thank you for the review comments.

I have branched webkit in which prior to my fix the crash was still reproducible with QtLauncher.

I will close this bug once I find that this crash is not reproducible on the latest webkit code.

[Simon Hausmann]

Comment on attachment 39983 [details]
qtWebkit fix for mp3 play crash

Indeed, this crash was fixed in http://trac.webkit.org/changeset/45814