Bug#803192: SIGSEGV on some image-loads (../Source/WebCore/html/ImageDocument.cpp: No such file or directory.)

[Stefan Schörghofer]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Package: libwebkitgtk-3.0-0
Version: 2.4.9-2+b1

When i open some image files in my favourite browser (xombrero) which
uses libwebkitgtk-3.0-0 for rendering, it exits with SIGSEGV.

Please see the gdb backtrace for more details:

(gdb) run
Starting program: /usr/bin/xombrero 
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/lib/x86_64-linux-gnu/libthread_db.so.1". [New Thread 0x7fffe2902700
(LWP 4707)] [New Thread 0x7fffa20ff700 (LWP 4708)]
[New Thread 0x7fffa14e1700 (LWP 4709)]
[New Thread 0x7fffa089d700 (LWP 4710)]
[New Thread 0x7fff93fff700 (LWP 4711)]
[New Thread 0x7fff8ac86700 (LWP 4712)]
[New Thread 0x7fff8a485700 (LWP 4713)]
[New Thread 0x7fff89c84700 (LWP 4714)]
[New Thread 0x7fff89483700 (LWP 4715)]
[New Thread 0x7fff7bfff700 (LWP 4793)]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff65d755a in WebCore::ImageDocumentParser::appendBytes
(this=0x7ffff7ed8d00) at ../Source/WebCore/html/ImageDocument.cpp:130
130	../Source/WebCore/html/ImageDocument.cpp: No such file or
directory. (gdb) backtrace #0  0x00007ffff65d755a in
WebCore::ImageDocumentParser::appendBytes(WebCore::DocumentWriter&,
char const*, unsigned long) (this=0x7ffff7ed8d00)
at ../Source/WebCore/html/ImageDocument.cpp:130 #1  0x00007ffff6746b0f
in WebCore::DocumentLoader::commitData(char const*, unsigned long)
(this=this at entry=0x7ffff7e4f900, bytes=bytes at entry=0xaa5a00
"\211PNG\r\n\032\n", length=length at entry=512)
at ../Source/WebCore/loader/DocumentLoader.cpp:843 #2
0x00007ffff608e2ee in
WebKit::FrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char
const*, int) (this=0x9df6b0, loader=0x7ffff7e4f900, data=0xaa5a00
"\211PNG\r\n\032\n", length=512)
at ../Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:164 #3
0x00007ffff67452a6 in WebCore::DocumentLoader::commitLoad(char const*,
int) (this=0x7ffff7e4f900, data=0xaa5a00 "\211PNG\r\n\032\n",
length=512) at ../Source/WebCore/loader/DocumentLoader.cpp:773 #4
0x00007ffff672af0f in
WebCore::CachedRawResource::notifyClientsDataWasReceived(char const*,
unsigned int) (this=0x7ffff7e75a00, data=0xaa5a00 "\211PNG\r\n\032\n",
length=512) at ../Source/WebCore/loader/cache/CachedRawResource.cpp:110
#5  0x00007ffff672b101 in
WebCore::CachedRawResource::addDataBuffer(WebCore::ResourceBuffer*)
(this=0x7ffff7e75a00, data=0x7ffff7e19708)
at ../Source/WebCore/loader/cache/CachedRawResource.cpp:66 #6
0x00007ffff679a1fd in
WebCore::SubresourceLoader::didReceiveDataOrBuffer(char const*, int,
WTF::PassRefPtr<WebCore::SharedBuffer>, long long,
WebCore::DataPayloadType) (this=0x7ffff7e1f400, data=0x0, length=0,
prpBuffer=..., encodedDataLength=<optimized out>,
dataPayloadType=WebCore::DataPayloadBytes)
at ../Source/WebCore/loader/SubresourceLoader.cpp:274 #7
0x00007ffff679a3b9 in
WebCore::SubresourceLoader::didReceiveBuffer(WTF::PassRefPtr<WebCore::SharedBuffer>,
long long, WebCore::DataPayloadType) (this=<optimized out>, buffer=...,
encodedDataLength=<optimized out>, dataPayloadType=<optimized out>)
at ../Source/WebCore/loader/SubresourceLoader.cpp:255 #8
0x00007ffff678f660 in
WebCore::ResourceLoader::didReceiveBuffer(WebCore::ResourceHandle*,
WTF::PassRefPtr<WebCore::SharedBuffer>, int)
(this=this at entry=0x7ffff7e1f400, buffer=...,
encodedDataLength=encodedDataLength at entry=512)
at ../Source/WebCore/loader/ResourceLoader.cpp:511 #9
0x00007ffff6f9e233 in WebCore::readCallback(GObject*, GAsyncResult*,
gpointer) (asyncResult=<optimized out>, data=0x7ffff7e19b58)
at ../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1365
#10 0x00007ffff3cf8fda in async_ready_callback_wrapper
(source_object=0x7fff70003380 [SoupClientInputStream], res=0x1238120,
user_data=0x7ffff7e19b58)
at /build/glib2.0-l3js1a/glib2.0-2.46.1/./gio/ginputstream.c:529 #11
0x00007ffff3d1f5f3 in g_task_return_now (task=0x1238120 [GTask])
at /build/glib2.0-l3js1a/glib2.0-2.46.1/./gio/gtask.c:1104 #12
0x00007ffff3d1f629 in complete_in_idle_cb (task=0x1238120)
at /build/glib2.0-l3js1a/glib2.0-2.46.1/./gio/gtask.c:1118 #13
0x00007ffff3781e9a in g_main_context_dispatch (context=0x6c8c40)
at /build/glib2.0-l3js1a/glib2.0-2.46.1/./glib/gmain.c:3154 #14
0x00007ffff3781e9a in g_main_context_dispatch
(context=context at entry=0x6c8c40)
at /build/glib2.0-l3js1a/glib2.0-2.46.1/./glib/gmain.c:3769 #15
0x00007ffff3782240 in g_main_context_iterate (context=0x6c8c40,
block=block at entry=1, dispatch=dispatch at entry=1, self=<optimized out>)
at /build/glib2.0-l3js1a/glib2.0-2.46.1/./glib/gmain.c:3840 #16
0x00007ffff3782562 in g_main_loop_run (loop=0x8efe40)
at /build/glib2.0-l3js1a/glib2.0-2.46.1/./glib/gmain.c:4034 #17
0x00007ffff552f745 in gtk_main ()
at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0 #18 0x000000000040c2e9 in
() #19 0x00007ffff2a5db45 in __libc_start_main (main=0x40b850, argc=1,
argv=0x7fffffffe448, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x7fffffffe438) at
libc-start.c:287 #20 0x000000000040c934 in  () (gdb) quit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlYv3QMACgkQZIX0zDQZ1scbCQEAmbCUVdJrDVHBkUR0FfRHqUny
9zg859hTcv8pscIsHMUBAK1o0ObafjtS0lj6QtPzFYUkjOca0pLIa2Y15Ck1nRJO
=vxMx
-----END PGP SIGNATURE-----