Bug 136120

Summary: Crash when resolving ns in a stylesheet @imported from external one [http://piro.sakura.ne.jp/appendix/archives.html]
Product: [Applications] konqueror Reporter: S. Burmeister <sven.burmeister>
Component: khtmlAssignee: Konqueror Developers <konq-bugs>
Status: RESOLVED FIXED    
Severity: crash CC: fredrik, kde, kde, maarten, maksim, pafcu
Priority: NOR    
Version: unspecified   
Target Milestone: ---   
Platform: openSUSE   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:

Description S. Burmeister 2006-10-22 10:13:03 UTC
Version:            (using KDE KDE 3.5.5)
Installed from:    SuSE RPMs
OS:                Linux

If you search for winamp and change to the image-search, you get the following link on the first page. If you click on it, google opens its two frames preview and konqueror crashes.

http://images.google.de/imgres?imgurl=http://hp.vector.co.jp/authors/VA016061/archives/winamp.jpg&imgrefurl=http://piro.sakura.ne.jp/appendix/archives.html&h=479&w=703&sz=28&hl=de&start=16&tbnid=Rl2JhKxUlUL1zM:&tbnh=95&tbnw=140&prev=/images%3Fq%3Dwinamp%26svnum%3D10%26hl%3Dde%26lr%3D%26ie%3DUTF-8%26oe%3DUTF-8%26sa%3DN

Überprüfung der Systemkonfiguration beim Start deaktiviert.

Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread -1230805328 (LWP 8868)]
[KCrash handler]
#6  0xb5f0ad21 in DOM::DocumentImpl::getId () from /opt/kde3/lib/libkhtml.so.4
#7  0xb5fca940 in DOM::CSSStyleSheetImpl::determineNamespace ()
   from /opt/kde3/lib/libkhtml.so.4
#8  0xb5fe29f6 in cssyyparse () from /opt/kde3/lib/libkhtml.so.4
#9  0xb5fe4644 in DOM::CSSParser::runParser () from /opt/kde3/lib/libkhtml.so.4
#10 0xb5fe4f74 in DOM::CSSParser::parseSheet ()
   from /opt/kde3/lib/libkhtml.so.4
#11 0xb5fe4ff9 in DOM::CSSStyleSheetImpl::parseString ()
   from /opt/kde3/lib/libkhtml.so.4
#12 0xb5fcd135 in DOM::CSSImportRuleImpl::setStyleSheet ()
   from /opt/kde3/lib/libkhtml.so.4
#13 0xb6002507 in khtml::CachedCSSStyleSheet::checkNotify ()
   from /opt/kde3/lib/libkhtml.so.4
#14 0xb6002702 in khtml::CachedCSSStyleSheet::data ()
   from /opt/kde3/lib/libkhtml.so.4
#15 0xb600507e in khtml::Loader::slotFinished ()
   from /opt/kde3/lib/libkhtml.so.4
#16 0xb600583a in khtml::Loader::qt_invoke () from /opt/kde3/lib/libkhtml.so.4
#17 0xb7547f1d in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#18 0xb7d1dd91 in KIO::Job::result () from /opt/kde3/lib/libkio.so.4
#19 0xb7d66f1d in KIO::Job::emitResult () from /opt/kde3/lib/libkio.so.4
#20 0xb7d74bae in KIO::SimpleJob::slotFinished ()
   from /opt/kde3/lib/libkio.so.4
#21 0xb7d752cd in KIO::TransferJob::slotFinished ()
   from /opt/kde3/lib/libkio.so.4
#22 0xb7d66b4a in KIO::TransferJob::qt_invoke () from /opt/kde3/lib/libkio.so.4
#23 0xb7547f1d in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#24 0xb7548b7d in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#25 0xb7d19b3c in KIO::SlaveInterface::finished ()
   from /opt/kde3/lib/libkio.so.4
#26 0xb7d73555 in KIO::SlaveInterface::dispatch ()
   from /opt/kde3/lib/libkio.so.4
#27 0xb7d872da in KIO::SlaveInterface::dispatch ()
   from /opt/kde3/lib/libkio.so.4
#28 0xb7d2dfec in KIO::Slave::gotInput () from /opt/kde3/lib/libkio.so.4
#29 0xb7d6c3c0 in KIO::Slave::qt_invoke () from /opt/kde3/lib/libkio.so.4
#30 0xb7547f1d in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#31 0xb7548a82 in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#32 0xb78818f0 in QSocketNotifier::activated ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#33 0xb7566120 in QSocketNotifier::event () from /usr/lib/qt3/lib/libqt-mt.so.3
#34 0xb74e8f07 in QApplication::internalNotify ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#35 0xb74e9cd1 in QApplication::notify () from /usr/lib/qt3/lib/libqt-mt.so.3
#36 0xb7b6fbd3 in KApplication::notify () from /opt/kde3/lib/libkdecore.so.4
#37 0xb74ddb44 in QEventLoop::activateSocketNotifiers ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#38 0xb7498814 in QEventLoop::processEvents ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#39 0xb74ffd28 in QEventLoop::enterLoop () from /usr/lib/qt3/lib/libqt-mt.so.3
#40 0xb74ffbbe in QEventLoop::exec () from /usr/lib/qt3/lib/libqt-mt.so.3
#41 0xb74e8abf in QApplication::exec () from /usr/lib/qt3/lib/libqt-mt.so.3
#42 0xb67ff565 in kdemain () from /opt/kde3/lib/libkdeinit_konqueror.so
#43 0xb72c3534 in kdeinitmain () from /opt/kde3/lib/kde3/konqueror.so
#44 0x0804e2ff in launch ()
#45 0x0804eb8a in handle_launcher_request ()
#46 0x0804ef0f in handle_requests ()
#47 0x0805010c in main ()
Comment 1 Bram Schoenmakers 2006-10-22 13:27:26 UTC
Can confirm, here's a more detailed backtrace.

Using host libthread_db library "/lib/libthread_db.so.1".
`system-supplied DSO at 0xffffe000' has disappeared; keeping its symbols.
[Thread debugging using libthread_db enabled]
[New Thread -1234151232 (LWP 30327)]
[KCrash handler]
#5  0xb62f54d0 in DOM::DocumentImpl::getId (this=0x0, 
    _type=DOM::NodeImpl::NamespaceId, _nsURI=0x0, _prefix=0x0, 
    _name=0x8472bd0, readonly=false, pExceptioncode=0xbfb8e4f8)
    at /home/bram/KDE/kde3/kdelibs/khtml/xml/dom_docimpl.cpp:1838
#6  0xb63f0349 in DOM::CSSStyleSheetImpl::determineNamespace (this=0x83dacc8, 
    id=@0x847edf4, prefix=@0xbfb8f754)
    at /home/bram/KDE/kde3/kdelibs/khtml/css/css_stylesheetimpl.cpp:253
#7  0xb641c179 in cssyyparse (parser=0xbfb8f92c)
    at /home/bram/KDE/kde3/kdelibs/khtml/css/parser.cpp:1986
#8  0xb6403cfc in DOM::CSSParser::runParser (this=0xbfb8f92c, length=8780)
    at /home/bram/KDE/kde3/kdelibs/khtml/css/cssparser.cpp:159
#9  0xb6404350 in DOM::CSSParser::parseSheet (this=0xbfb8f92c, 
    sheet=0x83dacc8, string=@0x83c2ae4)
    at /home/bram/KDE/kde3/kdelibs/khtml/css/cssparser.cpp:174
#10 0xb63f01dd in DOM::CSSStyleSheetImpl::parseString (this=0x83dacc8, 
    string=@0x83c2ae4, strict=true)
    at /home/bram/KDE/kde3/kdelibs/khtml/css/css_stylesheetimpl.cpp:267
#11 0xb63f3fc6 in DOM::CSSImportRuleImpl::setStyleSheet (this=0x8396550, 
    url=@0x83c2ab0, sheet=@0x83c2ae4, charset=@0xbfb8fa04)
    at /home/bram/KDE/kde3/kdelibs/khtml/css/css_ruleimpl.cpp:144
#12 0xb6428b5c in khtml::CachedCSSStyleSheet::checkNotify (this=0x83c2a90)
    at /home/bram/KDE/kde3/kdelibs/khtml/misc/loader.cpp:283
#13 0xb642bf74 in khtml::CachedCSSStyleSheet::data (this=0x83c2a90, 
    buffer=@0x83ac5fc, eof=true)
    at /home/bram/KDE/kde3/kdelibs/khtml/misc/loader.cpp:271
#14 0xb642837c in khtml::Loader::slotFinished (this=0x823d370, job=0x83d91b8)
    at /home/bram/KDE/kde3/kdelibs/khtml/misc/loader.cpp:1171
#15 0xb64285b6 in khtml::Loader::qt_invoke (this=0x823d370, _id=2, 
    _o=0xbfb8fb98) at loader.moc:260
#16 0xb6e8f559 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#17 0xb7b3291f in KIO::Job::result (this=0x83d91b8, t0=0x83d91b8)
    at jobclasses.moc:162
#18 0xb7b3940f in KIO::Job::emitResult (this=0x83d91b8)
    at /home/bram/KDE/kde3/kdelibs/kio/kio/job.cpp:227
#19 0xb7b39b48 in KIO::SimpleJob::slotFinished (this=0x83d91b8)
    at /home/bram/KDE/kde3/kdelibs/kio/kio/job.cpp:575
#20 0xb7b39f11 in KIO::TransferJob::slotFinished (this=0x83d91b8)
    at /home/bram/KDE/kde3/kdelibs/kio/kio/job.cpp:945
#21 0xb7b37deb in KIO::TransferJob::qt_invoke (this=0x83d91b8, _id=17, 
    _o=0xbfb8fe88) at jobclasses.moc:1071
#22 0xb6e8f559 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#23 0xb6e901ad in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#24 0xb7b1ef1f in KIO::SlaveInterface::finished (this=0x82b4650)
    at slaveinterface.moc:226
#25 0xb7b20597 in KIO::SlaveInterface::dispatch (this=0x82b4650, _cmd=104, 
    rawdata=@0xbfb900a8)
    at /home/bram/KDE/kde3/kdelibs/kio/kio/slaveinterface.cpp:243
#26 0xb7b212d0 in KIO::SlaveInterface::dispatch (this=0x82b4650)
    at /home/bram/KDE/kde3/kdelibs/kio/kio/slaveinterface.cpp:173
#27 0xb7b1bc04 in KIO::Slave::gotInput (this=0x82b4650)
    at /home/bram/KDE/kde3/kdelibs/kio/kio/slave.cpp:300
#28 0xb7b1dd01 in KIO::Slave::qt_invoke (this=0x82b4650, _id=4, _o=0xbfb901b4)
    at slave.moc:113
#29 0xb6e8f559 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#30 0xb6e900a2 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#31 0xb71c8d00 in QSocketNotifier::activated ()
   from /usr/qt/3/lib/libqt-mt.so.3
#32 0xb6ead4b0 in QSocketNotifier::event () from /usr/qt/3/lib/libqt-mt.so.3
#33 0xb6e30517 in QApplication::internalNotify ()
   from /usr/qt/3/lib/libqt-mt.so.3
#34 0xb6e310e1 in QApplication::notify () from /usr/qt/3/lib/libqt-mt.so.3
#35 0xb74e68b6 in KApplication::notify (this=0xbfb90768, receiver=0x82db238, 
    event=0xbfb90478)
    at /home/bram/KDE/kde3/kdelibs/kdecore/kapplication.cpp:550
#36 0xb6e25151 in QEventLoop::activateSocketNotifiers ()
   from /usr/qt/3/lib/libqt-mt.so.3
#37 0xb6de07ce in QEventLoop::processEvents () from /usr/qt/3/lib/libqt-mt.so.3
#38 0xb6e470a1 in QEventLoop::enterLoop () from /usr/qt/3/lib/libqt-mt.so.3
#39 0xb6e46f26 in QEventLoop::exec () from /usr/qt/3/lib/libqt-mt.so.3
#40 0xb6e2ff9f in QApplication::exec () from /usr/qt/3/lib/libqt-mt.so.3
#41 0xb7f3f9bc in kdemain () from /usr/kde/branch/lib/libkdeinit_konqueror.so
#42 0x080486f2 in main ()
Comment 2 Maksim Orlovich 2006-10-22 17:20:41 UTC
Don't need the wrapper....
Comment 3 Maksim Orlovich 2006-10-22 17:38:24 UTC
Somehow we end up with a stylesheet w/o a document, so trying to lookup namespace IDs crashes.

Testcase:
<link rel="stylesheet" href="style1.css" type="text/css">

style1.css:
@import "style2.css"

style2.css:
@namespace xhtml2 url(http://www.w3.org/2002/06/xhtml2);
.ref xhtml2|l {display: block; }
Comment 4 Maksim Orlovich 2006-10-22 17:52:01 UTC
This fixes this crash but needs more testing:
--- css/css_stylesheetimpl.cpp  (revision 597771)
+++ css/css_stylesheetimpl.cpp  (working copy)
@@ -130,7 +130,7 @@
     : StyleSheetImpl(ownerRule, href)
 {
     m_lstChildren = new QPtrList<StyleBaseImpl>;
-    m_doc = 0;
+    m_doc = ownerRule->parentStyleSheet()->doc();
     m_implicit = false;
     m_namespaces = 0;
     m_defaultNamespace = anyNamespace;
Comment 5 Maksim Orlovich 2006-11-17 01:22:27 UTC
*** Bug 137469 has been marked as a duplicate of this bug. ***
Comment 6 Fredrik Johansson 2006-11-17 06:55:31 UTC
Hi,

Sorry for the duplicate post Bug 137469.

I tried the patch on testcase for bug 137469, but it still crashes.

I'l try to investigate more in the weekend, don't have time now.

/ Fredrik
Comment 7 Maksim Orlovich 2006-11-17 16:23:00 UTC
To Fredrik: your testcase and that webpage both work fine for me with the patch applied.
Comment 8 Fredrik Johansson 2006-11-18 09:21:47 UTC
To Maksim:
You're right, and I was wrong (I mistakenly tested it in my old stable build)
Guess that one should never test things in a hurry.

Sorry for the noise

/ Fredrik

Comment 9 Allan Sandfeld 2006-11-19 22:58:40 UTC
Actually there is a problem here since the namespace translations are supposed to be local to the stylesheet, and not shared with parent stylesheet or document.
Comment 10 Maksim Orlovich 2006-11-19 23:23:52 UTC
Eek, so is the mapping in the wrong place? 
Comment 11 Allan Sandfeld 2006-11-20 00:19:29 UTC
SVN commit 606304 by carewolf:

Always remember the document for new stylesheets
BUG: 136120 


 M  +3 -3      css_stylesheetimpl.cpp  


--- branches/KDE/3.5/kdelibs/khtml/css/css_stylesheetimpl.cpp #606303:606304
@@ -111,7 +111,7 @@
     : StyleSheetImpl(parentSheet, href)
 {
     m_lstChildren = new QPtrList<StyleBaseImpl>;
-    m_doc = 0;
+    m_doc = parentSheet->doc();
     m_implicit = false;
     m_namespaces = 0;
     m_defaultNamespace = anyNamespace;
@@ -131,7 +131,7 @@
     : StyleSheetImpl(ownerRule, href)
 {
     m_lstChildren = new QPtrList<StyleBaseImpl>;
-    m_doc = 0;
+    m_doc = static_cast<CSSStyleSheetImpl*>(ownerRule->stylesheet())->doc();
     m_implicit = false;
     m_namespaces = 0;
     m_defaultNamespace = anyNamespace;
@@ -164,7 +164,7 @@
         m_lstChildren->append(rule);
         rule->setParent(this);
     }
-    m_doc  = 0;
+    m_doc = static_cast<CSSStyleSheetImpl*>(ownerRule->stylesheet())->doc();
     m_implicit = false;
     m_namespaces = 0;
     m_defaultNamespace = anyNamespace;
Comment 12 Allan Sandfeld 2006-11-20 00:19:46 UTC
No it was done correctly. I was just confused for a while on the difference between mapping prefix->uri which is done per stylesheet and uri->id which is done per document.
Comment 13 Maksim Orlovich 2006-12-06 23:07:56 UTC
*** Bug 138472 has been marked as a duplicate of this bug. ***
Comment 14 Maksim Orlovich 2006-12-28 17:48:05 UTC
*** Bug 139312 has been marked as a duplicate of this bug. ***
Comment 15 Tommi Tervo 2007-01-31 14:47:52 UTC
*** Bug 140063 has been marked as a duplicate of this bug. ***