Bug 61619 - [Qt] Webcore crashes consistently on setUpIterator while parsing plaintext presented as html
Summary: [Qt] Webcore crashes consistently on setUpIterator while parsing plaintext pr...
Status: RESOLVED DUPLICATE of bug 55139
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Windows 7
: P2 Major
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-05-27 01:51 PDT by Patrick Thomas
Modified: 2011-05-27 02:09 PDT (History)
6 users (show)

See Also:

Attachments
Backtrace for AV crash (3.98 KB, text/plain)
2011-05-27 01:56 PDT, Patrick Thomas 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Patrick Thomas 2011-05-27 01:51:38 PDT 
+++ This bug was initially created as a clone of Bug #61514 +++
(Found while trying to repro 61514 on other pages, don't know if it's related)

Consistent crash with access violation while parsing simple text presented as html. 
> Unhandled exception at 0x5940c8ec (msvcr100d.dll) in browser.exe: 0xC0000005: Access violation reading location 0x02aa0054.

Repro:
1) Open Qt browser demo (qt-everywhere-opensource-src-4.8.0-tp\demos\browser\debug)
2) In the URL bar, paste "http://coffeetocode.net/qt/qt_crash.html"
3) Hit enter
4) Crash should happen within a second

Reduced the repro to the above, but didn't get consistent crashes reducing it further; it seems that there may be a minimum size of the page necessary to trigger the issue while parsing.


Crashes with: 
- Qt 4.8 Tech Preview (http://get.qt.nokia.com/qt/source/qt-everywhere-opensource-src-4.8.0-tp.zip compiled with MSVC2010 on Win7)
- Qt 4.7.2  (qt-everywhere-opensource-src-4.7.2.zip compiled with MSVC2010 on Win7)

Will attach stack trace momentarily.
Comment 1 Patrick Thomas 2011-05-27 01:56:56 PDT 
Created attachment 95146 [details]
Backtrace for AV crash

Same crash location across repeated repros.
Comment 2 Andreas Kling 2011-05-27 02:09:12 PDT 

*** This bug has been marked as a duplicate of bug 55139 ***