Bug 44178 – WebCore::ResourceLoader::setShouldBufferData WriteAV@NULL

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Berend-Jan Wever]

Created attachment 64715 [details]
Repro

The following repro causes a NULL pointer write AV in latest Chromium on Windows with QuickTime installed.
<script>
  var win = window.open('repro.wav', 'test');
  setTimeout(function () {
    win.document.open();
    win.document.close();
  }, 100);
</script>
Note: you should make a "repro.wav" file available with the right mime-type to cause the QuickTime plugin to load. The content of the .wav file is not important: it can be empty and you can also use a "repro.mp3" file, as long as the QuickTime plugin gets loaded. I guess that if QuickTime is installed, the plugin is opened in the window without an actual "document" (or a stub that is missing certain features). This causes problems when you try to open/close the document.

id:             WebCore::ResourceLoader::setShouldBufferData WriteAV@NULL (f6f1dbd366ffad2e955db625bd543082)
description:    Attempt to write to NULL pointer (+0x25D) in WebCore::ResourceLoader::setShouldBufferData
stack:          WebCore::ResourceLoader::setShouldBufferData
                WebCore::PluginDocumentParser::appendBytes
                WebCore::DocumentWriter::endIfNotLoadingMainResource
                WebCore::Document::close
                WebCore::HTMLDocumentInternal::closeCallback
                v8::internal::HandleApiCallHelper<...>
                v8::internal::Builtin_HandleApiCall
                v8::internal::Invoke
                v8::internal::Execution::Call
                ...

[Eric Seidel (no email)]

I like that your'e fuzzing with open/close!  We definitely have a bunch of bugs here.

I don't think this is realted to bug 43055, or at least not directly.  But we should wait to try and fix it until after bug 43055 lands as the open/close landscape will dramatically change.

[Berend-Jan Wever]

This no longer reproduces in Chrome/Chromium, marking as fixed.