[Webkit-unassigned] [Bug 135599] New: ASSERTION FAILED: m_tokenizer->state() == HTMLTokenizer::DataState in WebCore::HTMLDocumentParser::pumpTokenizer

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=135599

           Summary: ASSERTION FAILED: m_tokenizer->state() ==
                    HTMLTokenizer::DataState in
                    WebCore::HTMLDocumentParser::pumpTokenizer
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rhodovan.u-szeged at partner.samsung.com
                CC: andersca at apple.com, tonyg at chromium.org
            Blocks: 116980


Created an attachment (id=236020)
 --> (https://bugs.webkit.org/attachment.cgi?id=236020&action=review)
Test case

The failing test:

<script onbeforeload=document.write('<') src=a></script>


Backtrace:

ASSERTION FAILED: m_tokenizer->state() == HTMLTokenizer::DataState
../../Source/WebCore/html/parser/HTMLDocumentParser.cpp(324) : void WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff97334700 (LWP 22359)]
0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329
329        *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329
#1  0x00007ffff3841a98 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x808cd0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:324
#2  0x00007ffff3841125 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x808cd0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:189
#3  0x00007ffff38422b7 in WebCore::HTMLDocumentParser::append (this=0x808cd0, inputSource=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:440
#4  0x00007ffff353462f in WebCore::DecodedDataDocumentParser::flush (this=0x808cd0, writer=...) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60
#5  0x00007ffff399140b in WebCore::DocumentWriter::end (this=0x7a2ab0) at ../../Source/WebCore/loader/DocumentWriter.cpp:247
#6  0x00007ffff397e49b in WebCore::DocumentLoader::finishedLoading (this=0x7a2a10, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441
#7  0x00007ffff397e204 in WebCore::DocumentLoader::notifyFinished (this=0x7a2a10, resource=0x855a80) at ../../Source/WebCore/loader/DocumentLoader.cpp:375
#8  0x00007ffff3a24a99 in WebCore::CachedResource::checkNotify (this=0x855a80) at ../../Source/WebCore/loader/cache/CachedResource.cpp:334
#9  0x00007ffff3a24b80 in WebCore::CachedResource::finishLoading (this=0x855a80) at ../../Source/WebCore/loader/cache/CachedResource.cpp:350
#10 0x00007ffff3a21b3a in WebCore::CachedRawResource::finishLoading (this=0x855a80, data=0x83a210) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:98
#11 0x00007ffff39d87da in WebCore::SubresourceLoader::didFinishLoading (this=0x8396f0, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:310
#12 0x00007ffff39d4cc7 in WebCore::ResourceLoader::didFinishLoading (this=0x8396f0, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:517
#13 0x00007ffff4297429 in WebCore::readCallback (asyncResult=0x87a1d0, data=0x83a810) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302
#14 0x00007fffec1d82ea in async_ready_callback_wrapper (source_object=0x98cb30, res=0x87a1d0, user_data=0x83a810) at ginputstream.c:519
#15 0x00007fffec1f7ceb in g_task_return_now (task=0x87a1d0) at gtask.c:1108
#16 0x00007fffec1f7d09 in complete_in_idle_cb (task=0x87a1d0) at gtask.c:1117
#17 0x00007fffeb44e2e6 in g_main_dispatch (context=0x677bb0) at gmain.c:3065
#18 g_main_context_dispatch (context=context at entry=0x677bb0) at gmain.c:3641
#19 0x00007fffeb44e638 in g_main_context_iterate (context=0x677bb0, block=block at entry=1, dispatch=dispatch at entry=1, self=<optimized out>) at gmain.c:3712
#20 0x00007fffeb44ea3a in g_main_loop_run (loop=0x70c750) at gmain.c:3906
#21 0x00007ffff306a156 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59
#22 0x00007ffff2fa35e0 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#23 0x00007ffff2fa3445 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73
#24 0x000000000040085d in main (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.