Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-30081

Crash doing http-equiv refresh with 0 delay from website with favicon

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P2: Important
    • 4.8.5
    • 4.8.4
    • WebKit
    • None
    • Microsoft Windows XP Professional SP3
    • baa9ec2b3f240fd0e4c5de025a9d9e023f2620a7

    Description

      A crash occurs with QWebView in the following case:
      1. QWebSettings::globalSettings()->setIconDatabasePath is called to enable fetching of favicons
      2. A website is loaded with a favicon and contains http-equiv refresh with 0 delay to another site. This results in the page load being canceled.
      3. The slot on_webView_loadFinished which handles the QWebView::loadFinished signal shows a message box which re-enters the event loop and delays returning control to the sender of the loadFinished signal for some time. During this time, other signals may fire and run in a different order than normally expected because control has not yet returned to the sender of the loadFinished signal.
      4. As a result of the previous step, ResourceLoader::didFinishLoading is executed first and calls releaseResources() which nulls m_documentLoader + sets m_reachedTerminalState to true. ResourceLoader::didCancel is executed afterwards, the asserts fail and a null pointer is dereferenced: m_documentLoader->cancelPendingSubstituteLoad(this).

      Attachments

        1. 0001-Webkit-Avoid-null-pointer-dereference-when-canceling.patch
          1 kB
          Jonathan Liu
        2. main.cpp
          2 kB
          Jonathan Liu
        3. stacktrace.txt
          10 kB
          Jonathan Liu

        Activity

          People

            jturcott Jocelyn Turcotte
            net147 Jonathan Liu
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: