Bug 102975

Created attachment 10460 [details]
Valgrind output of konqueror when visiting www.ebay.com

Valgrind output of konqueror when visiting www.ebay.com

Another additional comment.  Before I recompiled the khtml tree with -g konqueror running in gdb would crash but now it won't.

So, I did a 'set check range on' and 'set check type on' in gdb and re-ran konqueror and visted www.ebay.com

I've added some additional info at the end of the stacktrace:

I hope this helps because konqueror is unusable right now for me.

I'm seeing the same behaviour on me Gentoo Linux box as well.

Mike

Got this stacktrace:
#0  DOM::HTMLDocumentImpl::close (this=0x9602f90) at qstring.h:653
#1  0x017c4027 in KHTMLPart::checkEmitLoadEvent (this=0x95f5e38) at khtml_part.cpp:2287
#2  0x017c33ce in KHTMLPart::slotFinishedParsing (this=0x95f5e38) at khtml_part.cpp:2024
#3  0x017def92 in KHTMLPart::qt_invoke (this=0x95f5e38, _id=20, _o=0xbfff9f00) at khtml_part.moc:491
#4  0x01132a25 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#5  0x01132825 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#6  0x01809e2c in DOM::DocumentImpl::finishedParsing (this=0x9602f90) at qmetaobject.h:261
#7  0x01809ea5 in DOM::DocumentImpl::qt_emit (this=0x9602f90, _id=2, _o=0xbfffa020) at dom_docimpl.moc:97
#8  0x018363e5 in DOM::HTMLDocumentImpl::qt_emit (this=0x9602f90, _id=2, _o=0xbfffa020) at html_documentimpl.moc:91
#9  0x01132a55 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#10 0x01132825 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#11 0x0181d164 in khtml::Tokenizer::finishedParsing (this=0x9608b38) at qmetaobject.h:261
#12 0x0182b403 in khtml::HTMLTokenizer::end (this=0x9608b38) at htmltokenizer.cpp:1521
#13 0x0182b7b8 in khtml::HTMLTokenizer::finish (this=0x9608b38) at htmltokenizer.cpp:1570
#14 0x01804385 in DOM::DocumentImpl::finishParsing (this=0x31002d) at dom_docimpl.cpp:1223
#15 0x017c2fa9 in KHTMLPart::end (this=0x95f5e38) at khtml_part.cpp:1962
#16 0x017d05d6 in KHTMLPart::processObjectRequest (this=0x91d2390, child=0x95ef970, _url=@0xbfffa3e0, mimetype=@0xbfffa314) at khtml_part.cpp:4404
#17 0x017cfd64 in KHTMLPart::requestObject (this=0x91d2390, child=0x95ef970, url=@0xbfffa3e0, _args=@0xbfffa3b0) at khtml_part.cpp:4199
#18 0x017ced60 in KHTMLPart::requestFrame (this=0x91d2390, frame=0x9680248, url=@0xbfffa620, frameName=@0xbfffa3b0, params=@0xbfffa610, isIFrame=true) at qvaluelist.h:110
#19 0x018a74fa in khtml::RenderPartObject::updateWidget (this=0x9680248) at qvaluelist.h:432
#20 0x018398f2 in DOM::HTMLIFrameElementImpl::attach (this=0x95ef390) at html_baseimpl.cpp:628
#21 0x0182360f in khtml::KHTMLParser::insertNode (this=0x933e448, n=0x95ef390, flat=false) at htmlparser.cpp:321
#22 0x018231fe in khtml::KHTMLParser::parseToken (this=0x933e448, t=0x933e31c) at htmlparser.cpp:279
#23 0x0182b8cf in khtml::HTMLTokenizer::processToken (this=0x933e2e8) at htmltokenizer.cpp:1630
#24 0x01829814 in khtml::HTMLTokenizer::parseTag (this=0x933e2e8, src=@0x933e418) at htmltokenizer.cpp:1131
#25 0x0182ae44 in khtml::HTMLTokenizer::write (this=0x933e2e8, str=@0xc7000000, appendData=45) at htmltokenizer.cpp:1385
#26 0x01804244 in DOM::DocumentImpl::write (this=0x93297a8, text=@0xbfffaa90) at stringit.h:115
#27 0x01804177 in DOM::DocumentImpl::write (this=0x93297a8, text=@0xbfffab20) at dom_docimpl.cpp:1199
#28 0x0196c8ef in DOM::HTMLDocument::write (this=0x31002d, text=Internal: global symbol `DOMString' found in dom_string.cpp psymtab but not in symtab.
DOMString may be an inlined function, or may be a template function
(if a template, try specifying an instantiation: DOMString<type>).
) at html_document.cpp:213
#29 0x018fd094 in KJS::HTMLDocFunction::tryCall (this=0x9561888, exec=0xbfffb1e0, thisObj=@0xbfffad00, args=@0xbfffad50) at kjs_html.cpp:108
#30 0x018e6c4d in KJS::DOMFunction::call (this=0x31002d, exec=0xbfffb1e0, thisObj=@0xbfffad00, args=@0xbfffad50) at kjs_binding.cpp:107
#31 0x05bfc915 in KJS::Object::call () from /home/mrp/lib/libkjs.so.1
#32 0x05bcee8b in KJS::FunctionCallNode::evaluate () from /home/mrp/lib/libkjs.so.1
#33 0x05bd2bbe in KJS::ExprStatementNode::execute () from /home/mrp/lib/libkjs.so.1
#34 0x05bd2eb5 in KJS::IfNode::execute () from /home/mrp/lib/libkjs.so.1
#35 0x05bd8190 in KJS::SourceElementsNode::execute () from /home/mrp/lib/libkjs.so.1
#36 0x05bd2a14 in KJS::BlockNode::execute () from /home/mrp/lib/libkjs.so.1
#37 0x05bd5844 in KJS::WithNode::execute () from /home/mrp/lib/libkjs.so.1
#38 0x05bd8190 in KJS::SourceElementsNode::execute () from /home/mrp/lib/libkjs.so.1
#39 0x05bd2a14 in KJS::BlockNode::execute () from /home/mrp/lib/libkjs.so.1
#40 0x05bd7883 in KJS::FunctionBodyNode::execute () from /home/mrp/lib/libkjs.so.1
#41 0x05bf82d2 in KJS::DeclaredFunctionImp::execute () from /home/mrp/lib/libkjs.so.1
#42 0x05bf78d6 in KJS::FunctionImp::call () from /home/mrp/lib/libkjs.so.1
#43 0x05bfc915 in KJS::Object::call () from /home/mrp/lib/libkjs.so.1
#44 0x05bcee8b in KJS::FunctionCallNode::evaluate () from /home/mrp/lib/libkjs.so.1
#45 0x05bd2bbe in KJS::ExprStatementNode::execute () from /home/mrp/lib/libkjs.so.1
#46 0x05bd81fa in KJS::SourceElementsNode::execute () from /home/mrp/lib/libkjs.so.1
---Type <return> to continue, or q <return> to quit---
#47 0x05bd2a14 in KJS::BlockNode::execute () from /home/mrp/lib/libkjs.so.1
#48 0x05bd7883 in KJS::FunctionBodyNode::execute () from /home/mrp/lib/libkjs.so.1
#49 0x05bf82d2 in KJS::DeclaredFunctionImp::execute () from /home/mrp/lib/libkjs.so.1
#50 0x05bf78d6 in KJS::FunctionImp::call () from /home/mrp/lib/libkjs.so.1
#51 0x05bfc915 in KJS::Object::call () from /home/mrp/lib/libkjs.so.1
#52 0x05bcee8b in KJS::FunctionCallNode::evaluate () from /home/mrp/lib/libkjs.so.1
#53 0x05bd2bbe in KJS::ExprStatementNode::execute () from /home/mrp/lib/libkjs.so.1
#54 0x05bd2eb5 in KJS::IfNode::execute () from /home/mrp/lib/libkjs.so.1
#55 0x05bd81fa in KJS::SourceElementsNode::execute () from /home/mrp/lib/libkjs.so.1
#56 0x05bd2a14 in KJS::BlockNode::execute () from /home/mrp/lib/libkjs.so.1
#57 0x05bd7883 in KJS::FunctionBodyNode::execute () from /home/mrp/lib/libkjs.so.1
#58 0x05bf82d2 in KJS::DeclaredFunctionImp::execute () from /home/mrp/lib/libkjs.so.1
#59 0x05bf78d6 in KJS::FunctionImp::call () from /home/mrp/lib/libkjs.so.1
#60 0x05bfc915 in KJS::Object::call () from /home/mrp/lib/libkjs.so.1
#61 0x05bcee8b in KJS::FunctionCallNode::evaluate () from /home/mrp/lib/libkjs.so.1
#62 0x05bd2bbe in KJS::ExprStatementNode::execute () from /home/mrp/lib/libkjs.so.1
#63 0x05bd8190 in KJS::SourceElementsNode::execute () from /home/mrp/lib/libkjs.so.1
#64 0x05bd2a14 in KJS::BlockNode::execute () from /home/mrp/lib/libkjs.so.1
#65 0x05bd7883 in KJS::FunctionBodyNode::execute () from /home/mrp/lib/libkjs.so.1
#66 0x05bee00a in KJS::InterpreterImp::evaluate () from /home/mrp/lib/libkjs.so.1
#67 0x05bfe342 in KJS::Interpreter::evaluate () from /home/mrp/lib/libkjs.so.1
#68 0x01934ae0 in KJS::KJSProxyImpl::evaluate (this=0x93394b0, filename=
      {static null = {static null = <same as static member of an already seen type>, d = 0x8f21388, static shared_null = 0x8f21388}, d = 0x0, static shared_null = 0x8f21388}, baseLine=87,
    str=@0xbfffc2a0, n=Internal: global symbol `Node' found in dom_node.cpp psymtab but not in symtab.
Node may be an inlined function, or may be a template function
(if a template, try specifying an instantiation: Node<type>).
) at kjs_proxy.cpp:154
#69 0x017be431 in KHTMLPart::executeScript (this=0x91d2390, filename=@0xbfffc1f0, baseLine=87, n=@0xbfffc1e0, script=@0xbfffc2a0) at khtml_part.cpp:1129
#70 0x01827607 in khtml::HTMLTokenizer::scriptExecution (this=0x933e2e8, str=@0xbfffc2a0, scriptURL=@0xbfffc1a0, baseLine=86) at khtmlview.h:112
#71 0x01827390 in khtml::HTMLTokenizer::scriptHandler (this=0x933e2e8) at htmltokenizer.cpp:411
#72 0x01826d76 in khtml::HTMLTokenizer::parseSpecial (this=0x933e2e8, src=@0x933e418) at htmltokenizer.cpp:331
#73 0x018298bf in khtml::HTMLTokenizer::parseTag (this=0x933e2e8, src=@0x933e418) at htmltokenizer.cpp:1156
#74 0x0182ae44 in khtml::HTMLTokenizer::write (this=0x933e2e8, str=@0xc7000000, appendData=45) at htmltokenizer.cpp:1385
#75 0x0182c326 in khtml::HTMLTokenizer::notifyFinished (this=0x933e2e8) at htmltokenizer.cpp:1699
#76 0x018dca78 in khtml::CachedScript::checkNotify (this=0x93c73e0) at qptrdict.h:110
#77 0x018dc9c8 in khtml::CachedScript::data (this=0x93c73e0, buffer=@0xbfffc6b0) at loader.cpp:320
#78 0x018e0222 in khtml::Loader::slotFinished (this=0x91d1dc0, job=0x93ff310) at loader.cpp:1104
#79 0x018e242e in khtml::Loader::qt_invoke (this=0x91d1dc0, _id=2, _o=0xbfffc800) at qucom_p.h:312
#80 0x01132a25 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#81 0x005e8e3e in KIO::Job::result () from /home/mrp/lib/libkio.so.4
#82 0x005d03a0 in KIO::Job::emitResult () from /home/mrp/lib/libkio.so.4
#83 0x005d1c49 in KIO::SimpleJob::slotFinished () from /home/mrp/lib/libkio.so.4
#84 0x005d5001 in KIO::TransferJob::slotFinished () from /home/mrp/lib/libkio.so.4
#85 0x005ea7b8 in KIO::TransferJob::qt_invoke () from /home/mrp/lib/libkio.so.4
#86 0x01132a25 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#87 0x01132825 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#88 0x005c4c38 in KIO::SlaveInterface::finished () from /home/mrp/lib/libkio.so.4
#89 0x005c218e in KIO::SlaveInterface::dispatch () from /home/mrp/lib/libkio.so.4
#90 0x005c13ef in KIO::SlaveInterface::dispatch () from /home/mrp/lib/libkio.so.4
#91 0x005be614 in KIO::Slave::gotInput () from /home/mrp/lib/libkio.so.4
---Type <return> to continue, or q <return> to quit---
#92 0x005c0a75 in KIO::Slave::qt_invoke () from /home/mrp/lib/libkio.so.4
#93 0x01132a25 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#94 0x01132b58 in QObject::activate_signal () from /home/mrp/lib/libqt-mt.so.3
#95 0x01479665 in QSocketNotifier::activated () from /home/mrp/lib/libqt-mt.so.3
#96 0x0114db90 in QSocketNotifier::event () from /home/mrp/lib/libqt-mt.so.3
#97 0x010d6f59 in QApplication::internalNotify () from /home/mrp/lib/libqt-mt.so.3
#98 0x010d6640 in QApplication::notify () from /home/mrp/lib/libqt-mt.so.3
#99 0x00a5717c in KApplication::notify () from /home/mrp/lib/libkdecore.so.4
#100 0x010c5e8c in QEventLoop::activateSocketNotifiers () from /home/mrp/lib/libqt-mt.so.3
#101 0x01082503 in QEventLoop::processEvents () from /home/mrp/lib/libqt-mt.so.3
#102 0x010e8beb in QEventLoop::enterLoop () from /home/mrp/lib/libqt-mt.so.3
#103 0x010e8aa8 in QEventLoop::exec () from /home/mrp/lib/libqt-mt.so.3
#104 0x010d71b4 in QApplication::exec () from /home/mrp/lib/libqt-mt.so.3
#105 0x00d5d56d in kdemain () from /home/mrp/lib/libkdeinit_konqueror.so
#106 0x0804868f in main ()

Here is some additional info:
Quit
(gdb) list
107         return tryCall(exec, thisObj, args);
108       }
109       // pity there's no way to distinguish between these in JS code
110       // ### Look into setting prototypes of these & the use of instanceof so the exception
111       // type can be determined. See what other browsers do.
112       catch (DOM::DOMException e) {
113         Object err = Error::create(exec, GeneralError, QString("DOM Exception %1").arg(e.code).local8Bit());
114         err.put(exec, "code", Number(e.code));
115         exec->setException(err);
116         return Undefined();
(gdb) up
#1  0x017c4027 in KHTMLPart::checkEmitLoadEvent (this=0x95f5e38) at khtml_part.cpp:2287
2287        d->m_doc->close();
(gdb) down
#0  DOM::HTMLDocumentImpl::close (this=0x9602f90) at qstring.h:653
653         const QChar* unicode() const { return d->unicode; }

I can't reproduce this. The eBay site works fine for me, Konqueror 3.4.0 branch 20050313.

I can get it to happen under Gentoo with konqueror 3.4 compiled with gcc 3.3.4.

Try running it under gdb with 'set check range on' and 'set check type on'.

Try running it under valgrind to see if there are some memory access problems.

I'm experiencing this under two completely different systems.

I still can't reproduce. Sorry.

I know you can't reproduce it but valgrind is showing an illegal memory access at the same point of the crash.  That is why I attached the stack traces and the valgrind output.  I'm not familiar with the code so I was hoping this info would help someone who was familiar with the code.

*** This bug has been marked as a duplicate of 91004 ***