Bug 192755 - (reduced testcase) Konqueror crashes when uploading a file with return key in a form
Summary: (reduced testcase) Konqueror crashes when uploading a file with return key in...
Status: RESOLVED FIXED
Alias: None
Product: konqueror
Classification: Applications
Component: general (show other bugs)
Version: unspecified
Platform: unspecified Linux
: NOR crash
Target Milestone: ---
Assignee: Konqueror Developers
URL:
Keywords: testcase
: 192235 206078 206891 (view as bug list)
Depends on:
Blocks:
 
Reported: 2009-05-15 12:31 UTC by Andreas Pietzowski
Modified: 2009-09-30 22:58 UTC (History)
6 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Pietzowski 2009-05-15 12:31:50 UTC
Version:           4.2.2 (KDE 4.2.2) (using 4.2.3 (KDE 4.2.3), Kubuntu packages)
Compiler:          cc
OS:                Linux (x86_64) release 2.6.28-11-generic

When you have a form where you can choose a file from your hard drive for uploading and then commit the form with the submit button it works perfectly. But when you submit the file with the return or enter key Konqueror asks two times if the file should be uploaded and then crashes down.

Here is an example page where you can reproduce the bug easily:

http://www.pietzowski.de/upload.html

Choose a random file and press return in the input field.

Thanks for fixing this because I hate to use the mouse and click on the submit-button ;-)
Comment 1 Dario Andres 2009-05-15 14:15:44 UTC
Here using:

Qt: 4.5.1 (qt-copy  958974)
KDE: 4.2.85 (KDE 4.2.85 (KDE 4.3 Beta1))
kdelibs svn rev. 967040 / kdebase svn rev. 967041
on ArchLinux i686 - Kernel 2.6.29.2

I can reproduce the double dialog, but not the crash.
Comment 2 Frank Reininghaus 2009-05-16 18:06:40 UTC
I can confirm the crash (segfault) in 4.2.3 and trunk (rev. 968518).

Thread 1 (Thread 0xb5c68700 (LWP 5326)):
[KCrash Handler]
#6  0xb673175e in QString::isEmpty (this=0x8df8f18) at ../../include/QtCore/../../src/corelib/tools/qstring.h:691
#7  0xb6c4ef02 in QLineEditPrivate::hasSelectedText (this=0x8df8e00) at widgets/qlineedit_p.h:179
#8  0xb6c41346 in QLineEdit::selectedText (this=0x886f008) at widgets/qlineedit.cpp:1078
#9  0xb79db65b in KLineEdit::keyPressEvent (this=0x886f008, e=0x8eaf608) at /home/kde-devel/kde/src/KDE/kdelibs/kdeui/widgets/klineedit.cpp:899
#10 0xb34550ee in khtml::RenderWidget::EventPropagator::sendEvent (this=0x886f008, e=0x8eaf608) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_replaced.cpp:882
#11 0xb3456c7a in khtml::RenderWidget::handleEvent (this=0x8b0280c, ev=@0x8f42080) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_replaced.cpp:1137
#12 0xb33aadf6 in DOM::HTMLGenericFormElementImpl::defaultEventHandler (this=0x88b1160, evt=0x8f42080) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/html/html_formimpl.cpp:1049
#13 0xb33b8358 in DOM::HTMLInputElementImpl::defaultEventHandler (this=0x88b1160, evt=0x8f42080) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/html/html_formimpl.cpp:1954
#14 0xb3328a88 in DOM::NodeImpl::dispatchGenericEvent (this=0x88b1160, evt=0x8f42080) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:526
#15 0xb3326a4f in DOM::NodeImpl::dispatchEvent (this=0x88b1160, evt=0x8f42080, exceptioncode=@0xbfdb5e14, tempEvent=true) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:453
#16 0xb3327767 in DOM::NodeImpl::dispatchKeyEvent (this=0x88b1160, key=0xbfdb64b4, keypress=true) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:692
#17 0xb326b93a in KHTMLView::dispatchKeyEventHelper (this=0x8b47880, _ke=0xbfdb64b4, keypress=true) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:1670
#18 0xb326ba31 in KHTMLView::dispatchKeyEvent (this=0x8b47880, _ke=0xbfdb64b4) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:1626
#19 0xb32732c8 in KHTMLView::keyPressEvent (this=0x8b47880, _ke=0xbfdb64b4) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:1747
#20 0xb3271109 in KHTMLView::eventFilter (this=0x8b47880, o=0x87f45e8, e=0xbfdb64b4) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:2285
#21 0xb7304750 in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=0x877ec38, receiver=0x87f45e8, event=0xbfdb64b4) at kernel/qcoreapplication.cpp:726
#22 0xb6735700 in QApplicationPrivate::notify_helper (this=0x877ec38, receiver=0x87f45e8, e=0xbfdb64b4) at kernel/qapplication.cpp:4053
#23 0xb6735df9 in QApplication::notify (this=0xbfdb8098, receiver=0x87f45e8, e=0xbfdb64b4) at kernel/qapplication.cpp:3663
#24 0xb78fe3b1 in KApplication::notify (this=0xbfdb8098, receiver=0x886f008, event=0xbfdb64b4) at /home/kde-devel/kde/src/KDE/kdelibs/kdeui/kernel/kapplication.cpp:307
#25 0xb7306bc4 in QCoreApplication::notifyInternal (this=0xbfdb8098, receiver=0x886f008, event=0xbfdb64b4) at kernel/qcoreapplication.cpp:610
#26 0xb674381f in QCoreApplication::sendSpontaneousEvent (receiver=0x886f008, event=0xbfdb64b4) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:216
#27 0xb6735178 in qt_sendSpontaneousEvent (receiver=0x886f008, event=0xbfdb64b4) at kernel/qapplication.cpp:4959
#28 0xb67fe7b2 in QKeyMapper::sendKeyEvent (keyWidget=0x886f008, grab=false, type=QEvent::KeyPress, code=16777220, modifiers={i = -1076140520}, text=@0xbfdb664c, autorepeat=false, count=1, 
    nativeScanCode=36, nativeVirtualKey=65293, nativeModifiers=16) at kernel/qkeymapper_x11.cpp:1675
#29 0xb67ffce4 in QKeyMapperPrivate::translateKeyEvent (this=0x87a7f40, keyWidget=0x886f008, event=0xbfdb7ccc, grab=false) at kernel/qkeymapper_x11.cpp:1645
#30 0xb67d1d28 in QApplication::x11ProcessEvent (this=0xbfdb8098, event=0xbfdb7ccc) at kernel/qapplication_x11.cpp:3459
#31 0xb68026d2 in x11EventSourceDispatch (s=0x8781d68, callback=0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#32 0xb5f65b88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#33 0xb5f690eb in ?? () from /usr/lib/libglib-2.0.so.0
#34 0xb5f69268 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#35 0xb733de62 in QEventDispatcherGlib::processEvents (this=0x8766bd0, flags={i = -1076134268}) at kernel/qeventdispatcher_glib.cpp:324
#36 0xb6801d44 in QGuiEventDispatcherGlib::processEvents (this=0x8766bd0, flags={i = -1076134220}) at kernel/qguieventdispatcher_glib.cpp:202
#37 0xb73031e0 in QEventLoop::processEvents (this=0xbfdb7f48, flags={i = -1076134148}) at kernel/qeventloop.cpp:149
#38 0xb730343b in QEventLoop::exec (this=0xbfdb7f48, flags={i = -1076134064}) at kernel/qeventloop.cpp:200
#39 0xb7307519 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:888
#40 0xb673543c in QApplication::exec () at kernel/qapplication.cpp:3526
#41 0xb8074d58 in kdemain (argc=1, argv=0xbfdb8404) at /home/kde-devel/kde/src/KDE/kdebase/apps/konqueror/src/konqmain.cpp:257
#42 0x08048766 in main (argc=) at /home/kde-devel/kde/build/KDE/kdebase/apps/konqueror/src/konqueror_dummy.cpp:3
Comment 3 Frank Reininghaus 2009-05-17 22:31:00 UTC
Looks related to bug 74569. The test case in
https://bugs.kde.org/show_bug.cgi?id=74569#c25
seems to be basically the same as the one we have here. The earlier test case
https://bugs.kde.org/show_bug.cgi?id=74569#c1
does not crash trunk for me though.
Comment 4 Andreas Pietzowski 2009-05-17 23:30:51 UTC
Did you try the "new" testcase from my site? Is it also fixed in trunk?
http://www.pietzowski.de/upload.html  <--- testcase (choose file, press return)
Comment 5 Frank Reininghaus 2009-05-18 09:44:43 UTC
(In reply to comment #4)
> Did you try the "new" testcase from my site? Is it also fixed in trunk?
> http://www.pietzowski.de/upload.html  <--- testcase (choose file, press return)

As I've said in comment 2 already: your test case crashes trunk for me.
Comment 6 Andreas Pietzowski 2009-07-24 16:36:52 UTC
It still crashes in KDE 4.3 RC3! It's a show stopper for Konqueror!
Comment 7 Dario Andres 2009-09-04 00:24:39 UTC
*** Bug 192235 has been marked as a duplicate of this bug. ***
Comment 8 Dario Andres 2009-09-04 00:24:48 UTC
*** Bug 206078 has been marked as a duplicate of this bug. ***
Comment 9 Dario Andres 2009-09-09 20:09:57 UTC
*** Bug 206891 has been marked as a duplicate of this bug. ***
Comment 10 Andreas Nordal 2009-09-27 21:20:16 UTC
Here is a minimal testcase:

<html><body>
  <form enctype="multipart/form-data">
    <input name="f" type="file">
  </form>
</body></html>

Note that the following is vital for the crash:
* enctype="multipart/form-data"
* type="file"
* the input with type "file" must have a name.

Note that Konqueror successfully uploads the file when you accept the first confirmation dialog, it just crashes on the second dialog which shouldn't be there.

My tests:
Konqueror 4.3.1 (KDE 4.3.1) "release 163" segfaults.
Konqueror 3.5.10 "release 21.11" does not crash.
Comment 11 Andreas Nordal 2009-09-28 01:29:17 UTC
A compilation of testcases from this bug and #74569, allowing you to
"double dialog segfault" both Konqueror 3 and 4:
http://nerdvar.com/A/konq-crashes/doubledialogsegfault.html

Assuming this bug and #74569 are related, it seems that we have 3 bugs:
1. Common to Konqueror 3 and 4 is the (unwanted) ability to pop up a second
upload confirmation dialog after the user has accepted or closed the first. The
resulting segfault is also in common.
2. In Konqueror 3, form submission by javascript triggers bug 1.
3. In Konqueror 4, form submission by pressing enter triggers bug 1 if that
includes uploading a file.

Dear Konqueror developers: In a chain of bugs leading to a crash, don't just
fix one. This bug looks too much like a reappearance of a 5.5 year old bug. Fix
the root of the problem, not just leaf nodes. Or maybe you should equip
Konqueror with airbags.
Comment 12 Maksim Orlovich 2009-09-30 22:39:32 UTC
SVN commit 1029831 by orlovich:

Prevent double-dispatch of events file upload lineedit does not accept.
(One directly to lineedit, one via DOM on the containing upload widget).

Fixes double-upload-dialogs-on-enter bug. I think in general the bubbling 
behavior of Qt when it comes to events is problematic --- we should 
probably always accept events at original level and route them manually
to avoid issues. (This requires moving top-level shortcut handling 
from KHTMLView to ElementImpl::defaultEventHandler with a check 
for being the documentElement)

BUG: 192755



 M  +11 -0     khtmlview.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1029831
Comment 13 Maksim Orlovich 2009-09-30 22:58:14 UTC
SVN commit 1029833 by orlovich:

Merged revision:r1029831 | orlovich | 2009-09-30 16:39:30 -0400 (Wed, 30 Sep 2009) | 13 lines

Prevent double-dispatch of events file upload lineedit does not accept.
(One directly to lineedit, one via DOM on the containing upload widget).

Fixes double-upload-dialogs-on-enter bug. I think in general the bubbling 
behavior of Qt when it comes to events is problematic --- we should 
probably always accept events at original level and route them manually
to avoid issues. (This requires moving top-level shortcut handling 
from KHTMLView to ElementImpl::defaultEventHandler with a check 
for being the documentElement)

BUG: 192755

 M  +11 -0     khtmlview.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1029833