Bug 44178 - WebCore::ResourceLoader::setShouldBufferData WriteAV@NULL
Summary: WebCore::ResourceLoader::setShouldBufferData WriteAV@NULL
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Windows Vista
: P1 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-08-18 08:45 PDT by Berend-Jan Wever
Modified: 2010-09-29 12:12 PDT (History)
3 users (show)

See Also:


Attachments
Repro (153 bytes, text/html)
2010-08-18 08:45 PDT, Berend-Jan Wever
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Berend-Jan Wever 2010-08-18 08:45:51 PDT
Created attachment 64715 [details]
Repro

The following repro causes a NULL pointer write AV in latest Chromium on Windows with QuickTime installed.
<script>
  var win = window.open('repro.wav', 'test');
  setTimeout(function () {
    win.document.open();
    win.document.close();
  }, 100);
</script>
Note: you should make a "repro.wav" file available with the right mime-type to cause the QuickTime plugin to load. The content of the .wav file is not important: it can be empty and you can also use a "repro.mp3" file, as long as the QuickTime plugin gets loaded. I guess that if QuickTime is installed, the plugin is opened in the window without an actual "document" (or a stub that is missing certain features). This causes problems when you try to open/close the document.

id:             WebCore::ResourceLoader::setShouldBufferData WriteAV@NULL (f6f1dbd366ffad2e955db625bd543082)
description:    Attempt to write to NULL pointer (+0x25D) in WebCore::ResourceLoader::setShouldBufferData
stack:          WebCore::ResourceLoader::setShouldBufferData
                WebCore::PluginDocumentParser::appendBytes
                WebCore::DocumentWriter::endIfNotLoadingMainResource
                WebCore::Document::close
                WebCore::HTMLDocumentInternal::closeCallback
                v8::internal::HandleApiCallHelper<...>
                v8::internal::Builtin_HandleApiCall
                v8::internal::Invoke
                v8::internal::Execution::Call
                ...
Comment 1 Eric Seidel (no email) 2010-08-18 09:12:50 PDT
I like that your'e fuzzing with open/close!  We definitely have a bunch of bugs here.

I don't think this is realted to bug 43055, or at least not directly.  But we should wait to try and fix it until after bug 43055 lands as the open/close landscape will dramatically change.
Comment 2 Berend-Jan Wever 2010-09-29 12:12:20 PDT
This no longer reproduces in Chrome/Chromium, marking as fixed.