[Webkit-unassigned] [Bug 149316] New: Null dereference loading Blink layout test svg/filters/feImage-failed-load-crash.html

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=149316

            Bug ID: 149316
           Summary: Null dereference loading Blink layout test
                    svg/filters/feImage-failed-load-crash.html
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Keywords: BlinkMergeCandidate, HasReduction, NeedsRadar
          Severity: Normal
          Priority: P2
         Component: SVG
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jhoneycutt at apple.com
                CC: webkit-bug-importer at group.apple.com,
                    zimmermann at kde.org

Created attachment 261454
  --> https://bugs.webkit.org/attachment.cgi?id=261454&action=review
crashing test

Null dereference loading Blink layout test svg/filters/feImage-failed-load-crash.html.

Stack trace:

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000014
Exception Note:        EXC_CORPSE_NOTIFY

VM Regions Near 0x14:
--> 
    __TEXT                 00000001065fe000-0000000106600000 [    8K] r-x/rwx SM=COW  /Users/USER/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development

Application Specific Information:
CRASHING TEST: temp-tests/svg/filters/feImage-failed-load-crash.html

Global Trace Buffer (reverse chronological seconds):
18446743971.992725 CFNetwork                     0x00007fff88d43b97 Explicitly setting CF cookie storage singleton
18446743971.993103 CFNetwork                     0x00007fff88d8f211 Explicitly setting cookie storage singleton

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                 0x000000010f16e585 non-virtual thunk to WebCore::SVGFEImageElement::notifyFinished(WebCore::CachedResource*) + 37 (Node.h:638)
1   com.apple.WebCore                 0x000000010e3b8179 WebCore::CachedResource::checkNotify() + 153 (CachedResourceClientWalker.h:51)
2   com.apple.WebCore                 0x000000010e3b2a91 WebCore::CachedImage::error(WebCore::CachedResource::Status) + 113 (CachedImage.cpp:443)
3   com.apple.WebCore                 0x000000010f12f807 WebCore::SubresourceLoader::didFail(WebCore::ResourceError const&) + 375 (SubresourceLoader.cpp:401)
4   com.apple.WebKit                  0x000000010cc75d35 void IPC::handleMessage<Messages::WebResourceLoader::DidFailResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::ResourceError const&)>(IPC::MessageDecoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::ResourceError const&)) + 100 (StdLibExtras.h:366)
5   com.apple.WebKit                  0x000000010ca4f1f1 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 (memory:2636)
6   com.apple.WebKit                  0x000000010ca51b4a IPC::Connection::dispatchOneMessage() + 126 (memory:2656)
7   com.apple.JavaScriptCore          0x000000010de93985 WTF::RunLoop::performWork() + 437 (functional:1742)
8   com.apple.JavaScriptCore          0x000000010de93d32 WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39)
9   com.apple.CoreFoundation          0x00007fff949e2c01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
10  com.apple.CoreFoundation          0x00007fff949d4b1c __CFRunLoopDoSources0 + 556
11  com.apple.CoreFoundation          0x00007fff949d403f __CFRunLoopRun + 927
12  com.apple.CoreFoundation          0x00007fff949d3a38 CFRunLoopRunSpecific + 296
13  com.apple.HIToolbox               0x00007fff88e673bd RunCurrentEventLoopInMode + 235
14  com.apple.HIToolbox               0x00007fff88e67153 ReceiveNextEventCommon + 432
15  com.apple.HIToolbox               0x00007fff88e66f93 _BlockUntilNextEventMatchingListInModeWithFilter + 71
16  com.apple.AppKit                  0x00007fff870b81e7 _DPSNextEvent + 1076
17  com.apple.AppKit                  0x00007fff8748490d -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454
18  com.apple.AppKit                  0x00007fff870ae0b8 -[NSApplication run] + 682
19  com.apple.AppKit                  0x00007fff87030396 NSApplicationMain + 1176
20  libxpc.dylib                      0x00007fff8c70ff70 _xpc_objc_main + 793
21  libxpc.dylib                      0x00007fff8c7116bf xpc_main + 494
22  com.apple.WebKit.WebContent.Development    0x00000001065ff424 main + 409 (XPCServiceMain.Development.mm:187)
23  libdyld.dylib                     0x00007fff93aa15ad start + 1

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150917/cf18c9d8/attachment-0001.html>