Bug 116846

Version:            (using KDE KDE 3.5.0)
Installed from:    Gentoo Packages
Compiler:          gcc version 3.3.6 (Gentoo 3.3.6, ssp-3.3.6-1.0, pie-8.7.8) 
OS:                Linux

I'm using KDE3.5_rc1

How to Reproduce:
 1-(Load url) http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memory/base/virtualalloc.asp
 (Other similar MSDN article should also have the same effects)
 2- (Navigate to other page) Bottom of the main frame, "See Also"->"Virtual Memory Functions"
 3- (Go back) Press the toolbar back button

Other page within same site (step 2) should also result in the same behaviour.

Expected Behaviour:
 Konqueror Crashes

Notes:
This bug MIGHT be related to, although I don't think it's a dupe (not same type of backtrace)
Bug 112905: Crash on http://www.uni-kl.de/HSSP/
(There are however many other bug reports about crashing on back button, but most are CLOSED-FIXED and for older versions on konqueror.)

Backtrace:

Using host libthread_db library "/lib/libthread_db.so.1".
`system-supplied DSO at 0xffffe000' has disappeared; keeping its symbols.
[Thread debugging using libthread_db enabled]
[New Thread -1227966800 (LWP 17748)]
[KCrash handler]
#4  0xffffe410 in __kernel_vsyscall ()
#5  0x4f10c2b1 in raise () from /lib/libc.so.6
#6  0x4f10da57 in abort () from /lib/libc.so.6
#7  0x4f105b48 in __assert_fail () from /lib/libc.so.6
#8  0xb655119d in khtml::HTMLTokenizer::reset (this=0x87d4d10)
    at htmltokenizer.cpp:167
#9  0xb6555b17 in ~HTMLTokenizer (this=0x87d4d10) at htmltokenizer.cpp:1686
#10 0xb65269d8 in DOM::DocumentImpl::detach (this=0x8555958)
    at dom_docimpl.cpp:1181
#11 0xb64aeb50 in ~KHTMLView (this=0x8574e10) at khtmlview.cpp:515
#12 0xb713e3cd in QWidget::~QWidget () from /usr/qt/3/lib/libqt-mt.so.3
#13 0xb7226e6b in QClipperWidget::~QClipperWidget ()
   from /usr/qt/3/lib/libqt-mt.so.3
#14 0xb713e3cd in QWidget::~QWidget () from /usr/qt/3/lib/libqt-mt.so.3
#15 0xb7226d7b in QViewportWidget::~QViewportWidget ()
   from /usr/qt/3/lib/libqt-mt.so.3
#16 0xb7221be8 in QScrollView::~QScrollView ()
   from /usr/qt/3/lib/libqt-mt.so.3
#17 0xb64aeb10 in ~KHTMLView (this=0x8855bc8) at khtmlview.cpp:517
#18 0xb7f557bc in ~Part (this=0x8782978, __vtt_parm=0xb676adc8)
    at part.cpp:159
#19 0xb7f5620f in ~ReadOnlyPart (this=0x8782978, __vtt_parm=0xb676adc4)
    at part.cpp:312
#20 0xb64d24a1 in ~KHTMLPart (this=0x8782978) at khtml_part.cpp:522
#21 0xb64d71f1 in KHTMLPart::clear (this=0x841a0e0) at khtml_part.cpp:1445
#22 0xb64d92bf in KHTMLPart::begin (this=0x841a0e0, url=@0xbfa799b0, 
    xOffset=0, yOffset=0) at khtml_part.cpp:1879
#23 0xb666a58a in KJS::Window::get (this=0x8553630, exec=0xbfa79fa0, 
    p=@0xbfa79b80) at kjs_window.cpp:574
#24 0xb6317c8a in KJS::Reference::getValue (this=0xbfa79b70, exec=0xbfa79fa0)
    at reference.cpp:143
#25 0xb62d2572 in KJS::Node::evaluate (this=0x0, exec=0xbfa79fa0)
    at nodes.cpp:130
#26 0xb62d4732 in KJS::AccessorNode2::evaluateReference (this=0x8665018, 
    exec=0xbfa79fa0) at nodes.cpp:668
#27 0xb62d8362 in KJS::AssignNode::evaluate (this=0x8598bf8, exec=0xbfa79fa0)
    at nodes.cpp:1558
#28 0xb62da2c2 in KJS::ExprStatementNode::execute (this=0x8678e90, 
    exec=0xbfa79fa0) at nodes.cpp:1980
#29 0xb62e07e2 in KJS::SourceElementsNode::execute (this=0x8678ec0, 
    exec=0xbfa79fa0) at nodes.cpp:3091
#30 0xb62da0f5 in KJS::BlockNode::execute (this=0x8679030, exec=0xbfa79fa0)
    at nodes.cpp:1942
#31 0xb62fd1cd in KJS::InterpreterImp::evaluate (this=0x8670458, 
    code=@0x867045c, thisV=@0xbfa7a190) at internal.cpp:904
#32 0xb6311e1a in KJS::Interpreter::evaluate (this=0x0, code=@0x0, thisV=@0x0)
    at interpreter.cpp:166
#33 0xb6682610 in KJS::KJSProxyImpl::evaluate (this=0x8752830, filename=
      {static null = {static null = <same as static member of an already seen type>, d = 0x80570c0, static shared_null = 0x80570c0}, d = 0x0, static shared_null = 0x80570c0}, baseLine=6, str=@0x0, n=@0xbfa7a320, completion=0xbfa7a2b0)
    at kjs_proxy.cpp:154
#34 0xb64d5ae4 in KHTMLPart::executeScript (this=0x855e470, 
    filename=@0xbfa7a390, baseLine=0, n=@0x0, script=@0x0)
    at khtml_part.cpp:1154
#35 0xb6551fd7 in khtml::HTMLTokenizer::scriptExecution (this=0x87d4d10, 
    str=@0x6, scriptURL=@0xbfa7a320, baseLine=26) at htmltokenizer.cpp:441
#36 0xb6551de2 in khtml::HTMLTokenizer::scriptHandler (this=0x87d4d10)
    at htmltokenizer.cpp:413
#37 0xb6551a08 in khtml::HTMLTokenizer::parseSpecial (this=0x87d4d10, 
    src=@0x87d4e40) at htmltokenizer.cpp:333
#38 0xb6553d61 in khtml::HTMLTokenizer::parseTag (this=0x87d4d10, 
    src=@0x87d4e40) at htmltokenizer.cpp:1201
#39 0xb6554e71 in khtml::HTMLTokenizer::write (this=0x87d4d10, str=@0x73, 
    appendData=false) at htmltokenizer.cpp:1430
#40 0xb64d9a5a in KHTMLPart::write (this=0x855e470, 
    str=0xbfa7aa70 "\r\n\r\n<HTML>\r\n<head>\r\n<META NAME=\"Robots\" CONTENT=\"noindex\">\r\n  <META NAME=\"Robots\" CONTENT=\"noindex\">\r\n  <META content=\"text/html;charset=utf-8\" http-equiv=\"Content-Type\">\r\n  <TITLE>Table of Contents</"..., len=-1079531616) at khtml_part.cpp:1975
#41 0xb64d8738 in KHTMLPart::slotRestoreData (this=0x855e470, 
    data=@0xbfa7aa60) at khtml_part.cpp:1677
#42 0xb64f48b2 in KHTMLPart::qt_invoke (this=0x855e470, _id=18, _o=0xbfa7a9f0)
    at khtml_part.moc:503
#43 0xb710d8cc in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#44 0xb6516959 in KHTMLPageCacheDelivery::emitData (this=0x86968e8, t0=@0x0)
    at khtml_pagecache.moc:177
#45 0xb651624e in KHTMLPageCache::sendData (this=0x853c7d8)
    at khtml_pagecache.cpp:264
#46 0xb65166dc in KHTMLPageCache::qt_invoke (this=0x853c7d8, _id=2, _o=0x0)
    at khtml_pagecache.moc:82
#47 0xb710d8cc in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#48 0xb745190a in QSignal::signal () from /usr/qt/3/lib/libqt-mt.so.3
#49 0xb7127c0d in QSignal::activate () from /usr/qt/3/lib/libqt-mt.so.3
#50 0xb712f523 in QSingleShotTimer::event () from /usr/qt/3/lib/libqt-mt.so.3
#51 0xb70b0c1f in QApplication::internalNotify ()
   from /usr/qt/3/lib/libqt-mt.so.3
#52 0xb70aff55 in QApplication::notify () from /usr/qt/3/lib/libqt-mt.so.3
#53 0xb76fbf7c in KApplication::notify (this=0xbfa7d510, receiver=0x8334320, 
    event=0xbfa7cfc0) at kapplication.cpp:550
#54 0xb70a0165 in QEventLoop::activateTimers ()
   from /usr/qt/3/lib/libqt-mt.so.3
#55 0xb705a9f5 in QEventLoop::processEvents ()
   from /usr/qt/3/lib/libqt-mt.so.3
#56 0xb70c32c8 in QEventLoop::enterLoop () from /usr/qt/3/lib/libqt-mt.so.3
#57 0xb70c3178 in QEventLoop::exec () from /usr/qt/3/lib/libqt-mt.so.3
#58 0xb70b0e71 in QApplication::exec () from /usr/qt/3/lib/libqt-mt.so.3
#59 0xb6b2e562 in kdemain (argc=0, argv=0x0) at konq_main.cc:206
#60 0xb6bc9816 in kdeinitmain (argc=0, argv=0x0) at konqueror_dummy.cc:3
#61 0x0804dcd8 in launch (argc=2, _name=0x81c0a1c "konqueror", 
    args=0x81c0a30 "", cwd=0x0, envc=0, envs=0x81c0a34 "", reset_env=false, 
    tty=0x0, avoid_loops=false, startup_id_str=0x0) at kinit.cpp:637
#62 0x0804f385 in handle_launcher_request (sock=8) at kinit.cpp:1201
#63 0x0804f90d in handle_requests (waitForPid=0) at kinit.cpp:1404
#64 0x080509d5 in main (argc=2, argv=0xbfa7dc44, envp=0x0) at kinit.cpp:1848

 Sorry I didn't had time to investigate more (I'm on a tight schedule) but feel free to contact me should any other info be required.