[Webkit-unassigned] [Bug 20508] Memory corruption while performing page transition

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=20508


ap at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|WebKit Misc.                |Page Loading
     Ever Confirmed|0                           |1
           Keywords|                            |NeedsRadar
         OS/Version|Windows XP                  |All
           Priority|P2                          |P1
           Platform|PC                          |All
            Summary|Concurrency issues while    |Memory corruption while
                   |performing page transition  |performing page transition




------- Comment #4 from ap at webkit.org  2008-08-25 07:54 PDT -------
Thank you!

With a Mac debug build, I'm getting various errors pretty quickly with a single
tab, the first being an error form malloc:

#0  0x957f65ae in malloc_printf ()
#1  0x957f10a2 in szone_error ()
#2  0x95715743 in szone_free ()
#3  0x957155ad in free ()
#4  0x007dc24e in WTF::fastFree (p=0x6a52600) at FastMalloc.cpp:214
#5  0x037e7740 in WebCore::TextTokenizer::finish (this=0x1c370820) at
/Users/ap/Safari/OpenSource/WebCore/loader/TextDocument.cpp:161
#6  0x03338dbe in WebCore::Document::finishParsing (this=0x69d0a00) at
/Users/ap/Safari/OpenSource/WebCore/dom/Document.cpp:1703
#7  0x033ef8ea in WebCore::FrameLoader::stop (this=0x69c5e24) at
/Users/ap/Safari/OpenSource/WebCore/loader/FrameLoader.cpp:653
#8  0x033ef982 in WebCore::FrameLoader::receivedMainResourceError
(this=0x69c5e24, error=@0xbfffe438, isComplete=true) at
/Users/ap/Safari/OpenSource/WebCore/loader/FrameLoader.cpp:3517
#9  0x035efc81 in WebCore::MainResourceLoader::receivedError (this=0x6a6d800,
error=@0xbfffe438) at
/Users/ap/Safari/OpenSource/WebCore/loader/MainResourceLoader.cpp:78
#10 0x035efdd3 in WebCore::MainResourceLoader::didFail (this=0x6a6d800,
error=@0xbfffe438) at
/Users/ap/Safari/OpenSource/WebCore/loader/MainResourceLoader.cpp:337
#11 0x0370059d in WebCore::ResourceLoader::didFail (this=0x6a6d800,
error=@0xbfffe438) at
/Users/ap/Safari/OpenSource/WebCore/loader/ResourceLoader.cpp:403
#12 0x036fe873 in -[WebCoreResourceHandleAsDelegate
connection:didFailWithError:] (self=0x1bf8e890, _cmd=0x97248fbc,
con=0x1c3a72c0, error=0x1bf569b0) at
/Users/ap/Safari/OpenSource/WebCore/platform/network/mac/ResourceHandleMac.mm:539
#13 0x90370470 in -[NSURLConnection(NSURLConnectionReallyInternal)
sendDidFail:] ()
#14 0x903703ca in _NSURLConnectionDidFail ()
#15 0x9692ed97 in didFailWithError ()
#16 0x9690ce6b in _CFURLConnectionSendCallbacks ()
#17 0x9690c573 in muxerSourcePerform ()
#18 0x90d40615 in CFRunLoopRunSpecific ()
#19 0x90d40cf8 in CFRunLoopRunInMode ()
#20 0x91c5fda4 in RunCurrentEventLoopInMode ()
#21 0x91c5fbbd in ReceiveNextEventCommon ()
#22 0x91c5fa31 in BlockUntilNextEventMatchingListInMode ()
#23 0x926ec505 in _DPSNextEvent ()
#24 0x926ebdb8 in -[NSApplication
nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#25 0x0001e3fc in -[BrowserApplication
nextEventMatchingMask:untilDate:inMode:dequeue:] (self=0xf21ed0,
_cmd=0x9723dbe0, mask=4294967295, expiration=0xf49750, mode=0xa0136b40,
dequeue=1 '\001') at
/Users/ap/Safari/Internal/Safari/mac/BrowserApplication.m:202
#26 0x926e4df3 in -[NSApplication run] ()
#27 0x926b2030 in NSApplicationMain ()
#28 0x00096750 in main (argc=1, argv=0xbffff814) at
/Users/ap/Safari/Internal/Safari/mac/main.m:13

This is a double free; on another run, I got "malloc: *** error for object
0x6c84200: non-page-aligned, non-allocated pointer being freed".


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.