[Webkit-unassigned] [Bug 44178] New: WebCore::ResourceLoader::setShouldBufferData WriteAV at NULL

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44178

           Summary: WebCore::ResourceLoader::setShouldBufferData
                    WriteAV at NULL
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skylined at chromium.org
                CC: eric at webkit.org


Created an attachment (id=64715)
 --> (https://bugs.webkit.org/attachment.cgi?id=64715)
Repro

The following repro causes a NULL pointer write AV in latest Chromium on Windows with QuickTime installed.
<script>
  var win = window.open('repro.wav', 'test');
  setTimeout(function () {
    win.document.open();
    win.document.close();
  }, 100);
</script>
Note: you should make a "repro.wav" file available with the right mime-type to cause the QuickTime plugin to load. The content of the .wav file is not important: it can be empty and you can also use a "repro.mp3" file, as long as the QuickTime plugin gets loaded. I guess that if QuickTime is installed, the plugin is opened in the window without an actual "document" (or a stub that is missing certain features). This causes problems when you try to open/close the document.

id:             WebCore::ResourceLoader::setShouldBufferData WriteAV at NULL (f6f1dbd366ffad2e955db625bd543082)
description:    Attempt to write to NULL pointer (+0x25D) in WebCore::ResourceLoader::setShouldBufferData
stack:          WebCore::ResourceLoader::setShouldBufferData
                WebCore::PluginDocumentParser::appendBytes
                WebCore::DocumentWriter::endIfNotLoadingMainResource
                WebCore::Document::close
                WebCore::HTMLDocumentInternal::closeCallback
                v8::internal::HandleApiCallHelper<...>
                v8::internal::Builtin_HandleApiCall
                v8::internal::Invoke
                v8::internal::Execution::Call
                ...

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.