Bug 85336 - Konqueror crashes when closing tab of SVG animation on kevlindev.com
Summary: Konqueror crashes when closing tab of SVG animation on kevlindev.com
Status: RESOLVED UNMAINTAINED
Alias: None
Product: ksvg
Classification: Miscellaneous
Component: general (show other bugs)
Version: unspecified
Platform: Debian testing Linux
: NOR crash
Target Milestone: ---
Assignee: Nikolas Zimmermann
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-07-16 15:37 UTC by Luke Plant
Modified: 2011-10-17 21:06 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Luke Plant 2004-07-16 15:37:03 UTC
Version:            (using KDE KDE 3.2.2)
Installed from:    Debian testing/unstable Packages
OS:                Linux

Open a Konqueror tab with the following page, Konqueror crashes on closing the tab.  I'll post a backtrace (no debugging symbols) in a minute.

http://www.kevlindev.com/samples/orbit/orbit_js/orbit_js.svg

The animation is also displayed incorrectly (compare to the thumbnails on http://www.kevlindev.com/samples/index.htm), but that's another issue.
Comment 1 Luke Plant 2004-07-16 15:41:13 UTC
Backtrace:

(no debugging symbols found)...0x40fc5bd8 in waitpid ()
   from /lib/libpthread.so.0
#0  0x40fc5bd8 in waitpid () from /lib/libpthread.so.0
#1  0x40816b78 in lt_dlfree () from /usr/lib/libkdecore.so.4
#2  0x40fc4815 in __pthread_sighandler () from /lib/libpthread.so.0
#3  0x412034a8 in __libc_sigaction () from /lib/libc.so.6
#4  0x445a4525 in KSVG::SVGDOMElementBridgeProtoFunc::call(KJS::ExecState*, KJS::Object&, KJS::List const&) () from /usr/lib/libksvg.so.0
#5  0x44140b10 in KJS::Object::call(KJS::ExecState*, KJS::Object&, KJS::List const&) () from /usr/lib/libkjs.so.1
#6  0x441126cd in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#7  0x44116dca in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#8  0x4411d83c in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#9  0x44116bdf in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#10 0x4411cce3 in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#11 0x4413c1dc in KJS::DeclaredFunctionImp::execute(KJS::ExecState*) ()
   from /usr/lib/libkjs.so.1
#12 0x4413b5ac in KJS::FunctionImp::call(KJS::ExecState*, KJS::Object&, KJS::List const&) () from /usr/lib/libkjs.so.1
#13 0x44140b10 in KJS::Object::call(KJS::ExecState*, KJS::Object&, KJS::List const&) () from /usr/lib/libkjs.so.1
#14 0x441126cd in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#15 0x44116dca in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#16 0x4411d7c6 in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#17 0x44116bdf in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#18 0x4411cce3 in KJS::roundValue(KJS::ExecState*, KJS::Value const&) ()
   from /usr/lib/libkjs.so.1
#19 0x4410eb17 in KJS::SourceCode::cleanup() () from /usr/lib/libkjs.so.1
#20 0x44142aaa in KJS::Interpreter::evaluate(KJS::UString const&, KJS::Value const&) () from /usr/lib/libkjs.so.1
#21 0x4465a50f in KSVG::ScheduledAction::execute(KSVG::Window*) ()
   from /usr/lib/libksvg.so.0
#22 0x4465af93 in KSVG::WindowQObject::timerEvent(QTimerEvent*) ()
   from /usr/lib/libksvg.so.0
#23 0x40b14823 in QObject::event(QEvent*) () from /usr/lib/libqt-mt.so.3
#24 0x40abb47f in QApplication::internalNotify(QObject*, QEvent*) ()
   from /usr/lib/libqt-mt.so.3
#25 0x40abaa8b in QApplication::notify(QObject*, QEvent*) ()
   from /usr/lib/libqt-mt.so.3
#26 0x406c1b29 in KApplication::notify(QObject*, QEvent*) ()
   from /usr/lib/libkdecore.so.4
#27 0x40aaafe5 in QEventLoop::activateTimers() () from /usr/lib/libqt-mt.so.3
#28 0x40a66b6d in QEventLoop::processEvents(unsigned) ()
   from /usr/lib/libqt-mt.so.3
#29 0x40acece8 in QEventLoop::enterLoop() () from /usr/lib/libqt-mt.so.3
#30 0x40aceb98 in QEventLoop::exec() () from /usr/lib/libqt-mt.so.3
#31 0x40abb6d1 in QApplication::exec() () from /usr/lib/libqt-mt.so.3
#32 0x4151dcbc in kdemain () from /usr/lib/libkdeinit_konqueror.so
#33 0x40018866 in kdeinitmain () from /usr/lib/kde3/konqueror.so
#34 0x0804cc36 in strcpy ()
#35 0x0804e12b in strcpy ()
#36 0x0804e64e in strcpy ()
#37 0x0804f64d in strcpy ()
#38 0x411efdc6 in __libc_start_main () from /lib/libc.so.6
Comment 2 Carsten Lohrke 2007-03-20 21:05:28 UTC
Still an issue with KDE 3.5.6.
Comment 3 stanv 2007-06-07 09:05:57 UTC
Still an issue with KDE 3.5.7.

http://www.croczilla.com/svg/samples/svgtetris/svgtetris.svg

try to execute:
$svgdisplay svgtetris.svg

Bug is located something near:
1. kdegraphics-3.5.7/ksvg/impl/generateddata.cpp   2631
 Value SVGDocumentImpl::getInParents(GET_METHOD_ARGS) const
{
    Object proto = SVGDocumentImplProto::self(p1);
    if(proto.hasProperty(p1,p2)) return proto.get(p1,p2);  //XXX: not always return correct value

2. kdegraphics-3.5.7/ksvg/ecma/ksvg_lookup.h 145

template<class FuncImp, class ThisImp>
    inline KJS::Value lookupGet(KJS::ExecState *exec,
                                const KJS::Identifier &propertyName,
                                const KJS::HashTable *table,
                                const ThisImp *thisObj, // the 'impl' object
                                const KJS::ObjectImp *bridge)
    {
        const KJS::HashEntry *entry = KJS::Lookup::findEntry(table, propertyName);

        if(!entry) // not found, forward to parents
            return thisObj->getInParents(exec, propertyName, bridge); //XXX here

3. kdegraphics-3.5.7/ksvg/ecma/ksvg_bridge.h 103
virtual KJS::Value get(KJS::ExecState *exec, const KJS::Identifier &propertyName) cons
t   
    {   
        kdDebug(26004) << "KSVGBridge::get(), " << propertyName.qstring() << " Name: " <<
classInfo()->className << " Object: " << m_impl << endl;
            
        // Look for standard properties (e.g. those in the hashtables)
        KJS::Value val = m_impl->get(exec, propertyName, this);
            
        if(val.type() != KJS::UndefinedType)

====> SIGSEGV when call method type() for val <=====
m_impl->get return incorrect value.
segfault only if m_impl is SVGDocumentImpl
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4. kdelibs/BUILD/kdelibs-3.5.7/kjs/reference.cpp 143
return oimp->get(exec, prop);

5. kdelibs/BUILD/kdelibs-3.5.7/kjs/object.h 483
virtual Value get(ExecState *exec, const Identifier &propertyName) const;


LOG:
KSVG - Ecma: KSVGBridge::get(), childNodes Name: KSVG::SVGGElementImpl Object: 0xac5590
KSVG - Ecma: KSVGBridge::get(), item Name: KSVG::SVGDOMNodeListBridge Object: 0xbf9d00
KSVG - Ecma: KSVGBridge::get(), childNodes Name: KSVG::SVGGElementImpl Object: 0xb64d30
KSVG - Ecma: KSVGBridge::get(), item Name: KSVG::SVGDOMNodeListBridge Object: 0xc10fb0
KSVG - Ecma: KSVGBridge::get(), setAttribute Name: KSVG::SVGRectElementImpl Object: 0xb6c160
KSVG - Ecma: KSVG::Window (0x7f1520)::get unsuspendRedraw
KSVG - Ecma: KSVG::Window (0x7f1520)::get document
KSVG - Ecma: KSVGBridge::get(), documentElement Name: KSVG::SVGDocumentImpl Object: 0x6d94a0

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47391797103152 (LWP 1153)]
KJS::ValueImp::dispatchType (this=0xad5300) at value.cpp:174
174       return type();
(gdb) bt

#0  KJS::ValueImp::dispatchType (this=0xad5300) at value.cpp:174
#1  0x00007fff6f7a3700 in ?? ()
#2  0x00000000006d94a0 in ?? ()
#3  0x000000000060c7c0 in ?? ()
#4  0x0000000000006594 in ?? ()
#5  0x00007fff6f7a3601 in ?? ()
#6  0x00002b1a3dbcfe7d in Reference (this=0x2b1a3b7f69ac, b=@0x7fff6f7a3560, 
    p=@0x7fff6f7a3688) at reference.cpp:37
#7  0x00002b1a3dbf57f9 in KJS::AccessorNode2::evaluateReference (this=0x7fff6f7a3520, 
    exec=0x2b1a3b846fc0) at nodes.cpp:681
#8  0x00002b1a3dbddba4 in KJS::Node::evaluate (this=<value optimized out>, 
    exec=0x7fff6f7a3e50) at nodes.cpp:130
#9  0x00002b1a3dbf5623 in KJS::AccessorNode2::evaluateReference (this=0xabc030, exec=0xa)
    at nodes.cpp:668
#10 0x00002b1a3dbf5094 in KJS::FunctionCallNode::evaluate (this=0xabc0d0, exec=0xa)
    at nodes.cpp:829
...

svgdisplay catch SIGSEGV from time to time, not always.
Comment 4 Christoph Feck 2011-10-17 21:06:34 UTC
This component has been replaced with the QtSvg based "svgpart" in KDE 4. If
this issue still needs to be addressed, please add a comment.