Bug 52876 - Konqueror crash with CSS :first-child and :before psuedo-classes (testcase)
Summary: Konqueror crash with CSS :first-child and :before psuedo-classes (testcase)
Status: RESOLVED FIXED
Alias: None
Product: konqueror
Classification: Applications
Component: khtml (show other bugs)
Version: unspecified
Platform: Gentoo Packages Linux
: NOR crash
Target Milestone: ---
Assignee: Konqueror Developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-01-11 14:56 UTC by jakub
Modified: 2003-01-31 02:25 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description jakub 2003-01-11 14:56:11 UTC
Version:            (using KDE KDE 3.0.99)
Installed from:    Gentoo Packages
Compiler:          GCC 3.2.1 Compiled with CFLAGS & CXXFLAGS set to "--march=athlon-xp -O2"
OS:          Linux

Inline menu, marked up as <ul> list. Menu should be rendered inline, seperated with a pipe character ("|").
The li:first-child:before psuedo-class was used to remove the pipe from before the first <li> by setting display:none. Works as expected with a recent Mozilla build, so the code seems fine. Reproducible crash with Konqueror 3.1.0.

Test fragment:

<html>
<head>
<title>Konqueror Crash Fragment</title>
<style>
    li {
        display: inline;
    }

    li:before {
        content: "|";
    }

    li:first-child:before {
        display: none;
    }
</style>
</head>
<body>
<ul>
<li>item 1</li>
<li>item 2</li>
</ul>
</body>
</html>

Backtrace:

0x41175a99 in wait4 () from /lib/libc.so.6
#0  0x41175a99 in wait4 () from /lib/libc.so.6
#1  0x411f220c in __DTOR_END__ () from /lib/libc.so.6
#2  0x40f69ba3 in waitpid () from /lib/libpthread.so.0
#3  0x406b7f9e in KCrash::defaultCrashHandler(int) ()
   from /usr/kde/3.1/lib/libkdecore.so.4
#4  <signal handler called>
#5  0x41cdc1d4 in khtml::RenderFlow::addChild(khtml::RenderObject*, khtml::RenderObject*) () from /usr/kde/3.1/lib/libkhtml.so.4
#6  0x41cdc0f7 in khtml::RenderFlow::addChild(khtml::RenderObject*, khtml::RenderObject*) () from /usr/kde/3.1/lib/libkhtml.so.4
#7  0x41c8b3c0 in DOM::ElementImpl::attach() ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#8  0x41cb45d5 in DOM::HTMLLIElementImpl::attach() ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#9  0x41c9c1c5 in khtml::KHTMLParser::insertNode(DOM::NodeImpl*, bool) ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#10 0x41c9bf40 in khtml::KHTMLParser::parseToken(khtml::Token*) ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#11 0x41ca460c in khtml::HTMLTokenizer::processToken() ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#12 0x41ca2c63 in khtml::HTMLTokenizer::parseTag(khtml::DOMStringIt&) ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#13 0x41ca3a73 in khtml::HTMLTokenizer::write(QString const&, bool) ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#14 0x41c45ec9 in KHTMLPart::write(char const*, int) ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#15 0x41c432be in KHTMLPart::slotData(KIO::Job*, QMemArray<char> const&) ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#16 0x41c5e04b in KHTMLPart::qt_invoke(int, QUObject*) ()
   from /usr/kde/3.1/lib/libkhtml.so.4
#17 0x40a131f9 in QObject::activate_signal(QConnectionList*, QUObject*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#18 0x40168621 in KIO::TransferJob::data(KIO::Job*, QMemArray<char> const&) ()
   from /usr/kde/3.1/lib/libkio.so.4
#19 0x40154024 in KIO::TransferJob::slotData(QMemArray<char> const&) ()
   from /usr/kde/3.1/lib/libkio.so.4
#20 0x40168b12 in KIO::TransferJob::qt_invoke(int, QUObject*) ()
   from /usr/kde/3.1/lib/libkio.so.4
#21 0x40a131f9 in QObject::activate_signal(QConnectionList*, QUObject*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#22 0x4014203f in KIO::SlaveInterface::data(QMemArray<char> const&) ()
   from /usr/kde/3.1/lib/libkio.so.4
#23 0x401405c7 in KIO::SlaveInterface::dispatch(int, QMemArray<char> const&) ()
   from /usr/kde/3.1/lib/libkio.so.4
#24 0x40140339 in KIO::SlaveInterface::dispatch() ()
   from /usr/kde/3.1/lib/libkio.so.4
#25 0x4013dacb in KIO::Slave::gotInput() () from /usr/kde/3.1/lib/libkio.so.4
#26 0x4013f661 in KIO::Slave::qt_invoke(int, QUObject*) ()
   from /usr/kde/3.1/lib/libkio.so.4
#27 0x40a131f9 in QObject::activate_signal(QConnectionList*, QUObject*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#28 0x40a132d5 in QObject::activate_signal(int, int) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#29 0x40cf40c2 in QSocketNotifier::activated(int) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#30 0x40a2f700 in QSocketNotifier::event(QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#31 0x409b54b6 in QApplication::internalNotify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#32 0x409b4a76 in QApplication::notify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#33 0x4062afd9 in KApplication::notify(QObject*, QEvent*) ()
   from /usr/kde/3.1/lib/libkdecore.so.4
#34 0x40990db8 in QEventLoop::activateSocketNotifiers() ()
   from /usr/qt/3/lib/libqt-mt.so.3
#35 0x4096e6c7 in QEventLoop::processEvents(unsigned) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#36 0x409c9106 in QEventLoop::enterLoop() () from /usr/qt/3/lib/libqt-mt.so.3
#37 0x409c8fa8 in QEventLoop::exec() () from /usr/qt/3/lib/libqt-mt.so.3
#38 0x409b5701 in QApplication::exec() () from /usr/qt/3/lib/libqt-mt.so.3
#39 0x418ad0c8 in main () from /usr/kde/3.1/lib/konqueror.so
#40 0x0804d146 in strcpy ()
#41 0x0804eb4e in strcpy ()
#42 0x0804dcfa in strcpy ()
#43 0x0804bed9 in strcpy ()
#44 0x410dee34 in __libc_start_main () from /lib/libc.so.6
Comment 1 Dirk Mueller 2003-01-31 02:25:58 UTC
Subject: kdelibs/khtml/rendering

CVS commit by mueller: 

tststs, some people just want pseudo children with display: none. go figure.
CCMAIL: 52876-done@bugs.kde.org


  M +6 -6      render_container.cpp   1.41


--- kdelibs/khtml/rendering/render_container.cpp  #1.40:1.41
@@ -194,7 +194,7 @@ void RenderContainer::insertPseudoChild(
     RenderStyle* pseudo = child->style()->getPseudoStyle(type);
 
-    if (pseudo)
-    {
-        if (pseudo->contentType()==CONTENT_TEXT)
+    if (pseudo) {
+        pseudo->ref();
+        if (pseudo->display() != NONE && pseudo->contentType()==CONTENT_TEXT)
         {
             RenderObject* po = new (renderArena()) RenderFlow(0 /* anonymous box */);
@@ -216,5 +216,5 @@ void RenderContainer::insertPseudoChild(
             po->close();
         }
-        else if (pseudo->contentType()==CONTENT_OBJECT)
+        else if (pseudo->display() != NONE && pseudo->contentType()==CONTENT_OBJECT)
         {
             RenderObject* po = new (renderArena()) RenderImage(0);
@@ -225,5 +225,5 @@ void RenderContainer::insertPseudoChild(
             po->close();
         }
-
+        pseudo->deref();
     }
 }