| Summary: | blogger.com: when adding custom page elements, konqueror crashes | ||
|---|---|---|---|
| Product: | [Applications] konqueror | Reporter: | stubnitz |
| Component: | khtml xml | Assignee: | Konqueror Developers <konq-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | annavoy, bugs, cronopios, darko_kostovski, dbenamy+kde, doyle, francis.lacoste, g4mba5, johan.erlands, kde1844, locket, m.wege, maksim, mihnea_capraru, neilgall, pdedecker, ricardo_0617, shlomif, tilleyrw, yksloll |
| Priority: | NOR | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Platform: | unspecified | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
| Attachments: | patch | ||
|
Description
stubnitz
2006-09-06 23:17:53 UTC
==31273== Invalid read of size 4 ==31273== at 0x6A45A03: DOM::DocumentImpl::importNode(DOM::NodeImpl*, bool, int&) (dom_docimpl.cpp:552) ==31273== by 0x6C3CAA9: DOM::Document::importNode(DOM::Node const&, bool) (dom_doc.cpp:340) ==31273== by 0x6B88855: KJS::DOMDocumentProtoFunc::tryCall(KJS::ExecState*, KJS::Object&, KJS::List const&) (kjs_dom.cpp:1027) ==31273== by 0x6B7B005: KJS::DOMFunction::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (kjs_binding.cpp:114) ==31273== by 0x6D6F147: KJS::Object::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (object.cpp:73) ==31273== by 0x6D3A77F: KJS::FunctionCallNode::evaluate(KJS::ExecState*) const (nodes.cpp:870) ==31273== by 0x6D393DC: KJS::ReturnNode::execute(KJS::ExecState*) (nodes.cpp:2401) ==31273== by 0x6D32D4B: KJS::SourceElementsNode::execute(KJS::ExecState*) (nodes.cpp:3091) ==31273== by 0x6D30D19: KJS::BlockNode::execute(KJS::ExecState*) (nodes.cpp:1942) ==31273== by 0x6D35D3A: KJS::IfNode::execute(KJS::ExecState*) (nodes.cpp:2021) ==31273== by 0x6D32E8D: KJS::SourceElementsNode::execute(KJS::ExecState*) (nodes.cpp:3097) ==31273== by 0x6D30D19: KJS::BlockNode::execute(KJS::ExecState*) (nodes.cpp:1942) ==31273== by 0x6D67763: KJS::DeclaredFunctionImp::execute(KJS::ExecState*) (function.cpp:588) ==31273== by 0x6D67BB1: KJS::FunctionImp::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (function.cpp:363) ==31273== by 0x6D6F147: KJS::Object::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (object.cpp:73) ==31273== by 0x6D3A77F: KJS::FunctionCallNode::evaluate(KJS::ExecState*) const (nodes.cpp:870) ==31273== by 0x6D393DC: KJS::ReturnNode::execute(KJS::ExecState*) (nodes.cpp:2401) ==31273== by 0x6D32E8D: KJS::SourceElementsNode::execute(KJS::ExecState*) (nodes.cpp:3097) ==31273== by 0x6D30D19: KJS::BlockNode::execute(KJS::ExecState*) (nodes.cpp:1942) ==31273== by 0x6D67763: KJS::DeclaredFunctionImp::execute(KJS::ExecState*) (function.cpp:588) ==31273== by 0x6D67BB1: KJS::FunctionImp::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (function.cpp:363) ==31273== by 0x6D6F147: KJS::Object::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (object.cpp:73) ==31273== by 0x6D3A77F: KJS::FunctionCallNode::evaluate(KJS::ExecState*) const (nodes.cpp:870) ==31273== by 0x6D366E0: KJS::AssignNode::evaluate(KJS::ExecState*) const (nodes.cpp:1562) ==31273== by 0x6D35E50: KJS::ExprStatementNode::execute(KJS::ExecState*) (nodes.cpp:1980) ==31273== by 0x6D32D4B: KJS::SourceElementsNode::execute(KJS::ExecState*) (nodes.cpp:3091) ==31273== by 0x6D30D19: KJS::BlockNode::execute(KJS::ExecState*) (nodes.cpp:1942) ==31273== by 0x6D35D3A: KJS::IfNode::execute(KJS::ExecState*) (nodes.cpp:2021) ==31273== by 0x6D35DAC: KJS::IfNode::execute(KJS::ExecState*) (nodes.cpp:2028) ==31273== by 0x6D32D4B: KJS::SourceElementsNode::execute(KJS::ExecState*) (nodes.cpp:3091) ==31273== by 0x6D30D19: KJS::BlockNode::execute(KJS::ExecState*) (nodes.cpp:1942) ==31273== by 0x6D35D3A: KJS::IfNode::execute(KJS::ExecState*) (nodes.cpp:2021) ==31273== by 0x6D32E8D: KJS::SourceElementsNode::execute(KJS::ExecState*) (nodes.cpp:3097) ==31273== by 0x6D30D19: KJS::BlockNode::execute(KJS::ExecState*) (nodes.cpp:1942) ==31273== by 0x6D67763: KJS::DeclaredFunctionImp::execute(KJS::ExecState*) (function.cpp:588) ==31273== by 0x6D67BB1: KJS::FunctionImp::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (function.cpp:363) ==31273== by 0x6D6F147: KJS::Object::call(KJS::ExecState*, KJS::Object&, KJS::List const&) (object.cpp:73) ==31273== by 0x6D3A77F: KJS::FunctionCallNode::evaluate(KJS::ExecState*) const (nodes.cpp:870) ==31273== by 0x6D2E75D: KJS::AssignExprNode::evaluate(KJS::ExecState*) const (nodes.cpp:1760) ==31273== by 0x6D362DF: KJS::VarDeclNode::evaluate(KJS::ExecState*) const (nodes.cpp:1791) ==31273== by 0x6D36175: KJS::VarDeclListNode::evaluate(KJS::ExecState*) const (nodes.cpp:1863) ==31273== by 0x6D35FFE: KJS::VarStatementNode::execute(KJS::ExecState*) (nodes.cpp:1896) ==31273== Address 0x0 is not stack'd, malloc'd or (recently) free'd KCrash: crashing... crashRecursionCounter = 2 KCrash: Application Name = konqueror path = <unknown> pid = 31273 ==31273== *** Bug 133748 has been marked as a duplicate of this bug. *** Easier way to reproduce this crash: http://mundosubliminal.blogspot.com/2006/09/truco-gmail-correos-ilimitados.html The crash happens when doing an importNode on a documentFragment... Created attachment 17667 [details]
patch
This should fix this crash, but there is still something funny on the public
test URL (not sure about blogger...)
that patch didn't fix the crashes, both gave same bactraces:
#6 0xb5fe3a09 in DOM::DocumentImpl::getName (this=0x0,
_type=DOM::NodeImpl::AttributeId, _id=327765) at dom_docimpl.cpp:1871
#7 0xb5ffe177 in DOM::AttrImpl::name (this=0x8b4fca0)
at dom_elementimpl.cpp:134
#8 0xb5fffa8b in DOM::AttrImpl::nodeName (this=0x8b4fca0)
at dom_elementimpl.cpp:84
#9 0xb61d1ebd in DOM::Node::nodeName (this=0x8b36204) at dom_node.cpp:178
#10 0xb6135af2 in KJS::DOMNode::getValueProperty (this=0x8b361d8,
exec=0xbfa9c72c, token=0) at kjs_dom.cpp:229
#11 0xb613e582 in KJS::DOMObjectLookupGetValue<KJS::DOMNode, KJS::DOMObject> (
exec=0xbfa9c72c, propertyName=@0xbfa9c118, table=0xb6273570,
thisObj=0x8b361d8) at ../../khtml/ecma/kjs_binding.h:220
#12 0xb6137a27 in KJS::DOMNode::tryGet (this=0x8b361d8, exec=0xbfa9c72c,
propertyName=@0xbfa9c118) at kjs_dom.cpp:182
#13 0xb613ea5d in KJS::DOMObjectLookupGetValue<KJS::DOMAttr, KJS::DOMNode> (
exec=0xbfa9c72c, propertyName=@0xbfa9c118, table=0xb6273598,
thisObj=0x8b361d8) at ../../khtml/ecma/kjs_binding.h:216
#14 0xb61380c1 in KJS::DOMAttr::tryGet (this=0x8b361d8, exec=0xbfa9c72c,
propertyName=@0xbfa9c118) at kjs_dom.cpp:814
#15 0xb61226d0 in KJS::DOMObject::get (this=0x8b361d8, exec=0xbfa9c72c,
That's probably the same as bug #128015. Working on a fix now (actually merging Apple's semi-fix) OK, with the patch for that (not yet 100% ready to attach, need to cleanup a few things, but if you want to test, please let me know), this doesn't crash, but pops up some JS error... ... And that error is likely because we do not have the auto-adopt quirk IE/Mozilla have, but are actually following the DOM spec... *** Bug 134394 has been marked as a duplicate of this bug. *** *** Bug 134511 has been marked as a duplicate of this bug. *** *** Bug 134546 has been marked as a duplicate of this bug. *** SVN commit 591440 by orlovich:
Don't crash on deep importNode with type we don't support
(or type that the DOM spec says we should not support);
but for now do not add support for missing types such as
DocumentFragment; these acts as a partial workaround for the
blogger widgets crash as we throw an exception on this op then instead of
generally crashing on later op (though it can still crash with
dangling document in other scenarios, at least it seems to be
relatively rare)
CCBUG:133680
M +3 -1 dom_docimpl.cpp
--- branches/KDE/3.5/kdelibs/khtml/xml/dom_docimpl.cpp #591439:591440
@@ -547,8 +547,10 @@
}
else
exceptioncode = DOMException::NOT_SUPPORTED_ERR;
+
+ //### FIXME: This should handle DocumentFragment, Attributes, and a few other things
- if(deep)
+ if(deep && result)
{
for(Node n = importedNode->firstChild(); !n.isNull(); n = n.nextSibling())
result->appendChild(importNode(n.handle(), true, exceptioncode), exceptioncode);
*** Bug 135091 has been marked as a duplicate of this bug. *** *** Bug 135267 has been marked as a duplicate of this bug. *** SVN commit 595496 by orlovich: Improve memory management of documents: they are no longer destroyed way too early when there are out-side referenced nodes hanging around and that need them. However, since we're refcounting, the documents have to disconnect the children in that case to avoid cycles.. Should fix some crashes with some AJAXy stuff (Merged from Apple's tree) BUG:128015 CCBUG:133680 M +1 -1 ecma/kjs_traversal.cpp M +4 -4 html/html_baseimpl.cpp M +6 -6 html/html_baseimpl.h M +2 -2 html/html_blockimpl.cpp M +5 -5 html/html_blockimpl.h M +3 -3 html/html_elementimpl.cpp M +2 -2 html/html_elementimpl.h M +13 -13 html/html_formimpl.cpp M +13 -13 html/html_formimpl.h M +1 -1 html/html_headimpl.cpp M +6 -6 html/html_headimpl.h M +3 -3 html/html_imageimpl.cpp M +3 -3 html/html_imageimpl.h M +3 -3 html/html_inlineimpl.h M +6 -6 html/html_listimpl.h M +1 -1 html/html_miscimpl.cpp M +1 -1 html/html_miscimpl.h M +4 -4 html/html_objectimpl.cpp M +5 -5 html/html_objectimpl.h M +4 -4 html/html_tableimpl.cpp M +7 -7 html/html_tableimpl.h M +11 -15 html/htmlparser.cpp M +6 -6 html/htmlparser.h M +5 -5 html/htmltokenizer.cpp M +3 -3 html/htmltokenizer.h M +115 -1 misc/shared.h M +10 -10 xml/dom2_rangeimpl.cpp M +3 -3 xml/dom2_rangeimpl.h M +66 -10 xml/dom_docimpl.cpp M +19 -2 xml/dom_docimpl.h M +6 -6 xml/dom_elementimpl.cpp M +5 -5 xml/dom_elementimpl.h M +12 -16 xml/dom_nodeimpl.cpp M +6 -18 xml/dom_nodeimpl.h M +1 -1 xml/dom_textimpl.cpp M +8 -8 xml/dom_textimpl.h M +9 -9 xml/dom_xmlimpl.cpp M +9 -9 xml/dom_xmlimpl.h M +22 -26 xml/xml_tokenizer.cpp M +5 -5 xml/xml_tokenizer.h SVN commit 595505 by orlovich:
Fix importNode on DocumentFragment..
Testcase upcoming...
CCBUG:133680
M +3 -1 dom_docimpl.cpp
--- branches/KDE/3.5/kdelibs/khtml/xml/dom_docimpl.cpp #595504:595505
@@ -601,10 +601,12 @@
result = createComment(static_cast<CommentImpl*>(importedNode)->string());
deep = false;
}
+ else if (importedNode->nodeType() == Node::DOCUMENT_FRAGMENT_NODE)
+ result = createDocumentFragment();
else
exceptioncode = DOMException::NOT_SUPPORTED_ERR;
- //### FIXME: This should handle DocumentFragment, Attributes, and a few other things
+ //### FIXME: This should handle Attributes, and a few other things
if(deep && result)
{
OK, with this the crash should be gone. The JS popup doesn't occur any more, either, but it's a change on their end... And since I'll have to do the autoimport quirk regardless, I consider this fixed. *** Bug 135658 has been marked as a duplicate of this bug. *** *** Bug 136270 has been marked as a duplicate of this bug. *** *** Bug 137289 has been marked as a duplicate of this bug. *** *** Bug 138611 has been marked as a duplicate of this bug. *** *** Bug 142184 has been marked as a duplicate of this bug. *** *** Bug 143031 has been marked as a duplicate of this bug. *** *** Bug 143329 has been marked as a duplicate of this bug. *** *** Bug 138858 has been marked as a duplicate of this bug. *** *** Bug 143719 has been marked as a duplicate of this bug. *** *** Bug 143720 has been marked as a duplicate of this bug. *** *** Bug 143815 has been marked as a duplicate of this bug. *** *** Bug 149802 has been marked as a duplicate of this bug. *** *** Bug 140000 has been marked as a duplicate of this bug. *** *** Bug 173988 has been marked as a duplicate of this bug. *** |