Bug 138472

Summary:	Reproducible crash on CSS parsing
Product:	[Applications] konqueror	Reporter:	Maarten ter Huurne <maarten>
Component:	khtml	Assignee:	Konqueror Developers <konq-bugs>
Status:	RESOLVED DUPLICATE
Severity:	crash
Priority:	NOR
Version:	unspecified
Target Milestone:	---
Platform:	openSUSE
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:
Attachments:	Minimal testcase that reproduces the problem Minimal testcase that reproduces the problem Minimal testcase that reproduces the problem

Description Maarten ter Huurne 2006-12-06 22:47:38 UTC

Version:            (using KDE KDE 3.5.4)
Installed from:    SuSE RPMs
Compiler:          g++ (GCC) 4.0.2 20050901 (prerelease) (SUSE Linux) I'm assuming the RPMs were built using the default GCC for this release of SUSE.
OS:                Linux

When loading www.grauw.nl, Konqueror crashes. If I start Konqueror from the command line, it prints the following assertion:
> konqueror http://www.grauw.nl/
ASSERT: "m_doc != 0" in ./khtml/css/css_stylesheetimpl.cpp (250)
KCrash: Application 'konqueror' crashing...

I copy-pasted the full backtrace below. It seems to crash when doing something with namespaces in CSS.

I also made a minimal test case to reproduce this. It needs three files: one HTML file and two CSS files.

index.html:
===
<!DOCTYPE html
        PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"
        "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd">
<html>
<head>
<link rel="alternate stylesheet" href="classicgeorgia.css" type="text/css" title="Classic Georgia" />
</head>
<body>
</body>
</html>
===

classicgeorgia.css:
===
@import url('classic.css');
===

classic.css:
===
@namespace g "http://www.grauw.nl/g";

th[g|sort] {
}
===

Even though the first CSS file doesn't contain any style of itself, if the HTML includes the second CSS file directly the crash doesn't happen.

I asked around on IRC and it seems KDE 3.5.5 on Debian has the same problem.

Here is the backtrace:
===
Using host libthread_db library "/lib/tls/libthread_db.so.1".
`system-supplied DSO at 0xffffe000' has disappeared; keeping its symbols.
[Thread debugging using libthread_db enabled]
[New Thread 1096230016 (LWP 27840)]
[KCrash handler]
#6  0x41c7a0f1 in DOM::DocumentImpl::getId () from /opt/kde3/lib/libkhtml.so.4
#7  0x41d48281 in DOM::CSSStyleSheetImpl::determineNamespace ()
   from /opt/kde3/lib/libkhtml.so.4
#8  0x41d7280f in cssyyparse () from /opt/kde3/lib/libkhtml.so.4
#9  0x41d73da4 in DOM::CSSParser::runParser ()
   from /opt/kde3/lib/libkhtml.so.4
#10 0x41d74714 in DOM::CSSParser::parseSheet ()
   from /opt/kde3/lib/libkhtml.so.4
#11 0x41d74798 in DOM::CSSStyleSheetImpl::parseString ()
   from /opt/kde3/lib/libkhtml.so.4
#12 0x41d4ba52 in DOM::CSSImportRuleImpl::setStyleSheet ()
   from /opt/kde3/lib/libkhtml.so.4
#13 0x41d84e2a in khtml::CachedCSSStyleSheet::checkNotify ()
   from /opt/kde3/lib/libkhtml.so.4
#14 0x41d8500f in khtml::CachedCSSStyleSheet::data ()
   from /opt/kde3/lib/libkhtml.so.4
#15 0x41d8602e in khtml::Loader::slotFinished ()
   from /opt/kde3/lib/libkhtml.so.4
#16 0x41d8620c in khtml::Loader::qt_invoke () from /opt/kde3/lib/libkhtml.so.4
#17 0x40858039 in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#18 0x4017e522 in KIO::Job::result () from /opt/kde3/lib/libkio.so.4
#19 0x401d270c in KIO::Job::emitResult () from /opt/kde3/lib/libkio.so.4
#20 0x401d287e in KIO::SimpleJob::slotFinished ()
   from /opt/kde3/lib/libkio.so.4
#21 0x401d2fbd in KIO::TransferJob::slotFinished ()
   from /opt/kde3/lib/libkio.so.4
#22 0x401d45ea in KIO::TransferJob::qt_invoke ()
   from /opt/kde3/lib/libkio.so.4
#23 0x40858039 in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#24 0x408584f0 in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#25 0x4017917c in KIO::SlaveInterface::finished ()
   from /opt/kde3/lib/libkio.so.4
#26 0x401ed08c in KIO::SlaveInterface::dispatch ()
   from /opt/kde3/lib/libkio.so.4
#27 0x40191a07 in KIO::SlaveInterface::dispatch ()
   from /opt/kde3/lib/libkio.so.4
#28 0x4019690b in KIO::Slave::gotInput () from /opt/kde3/lib/libkio.so.4
#29 0x40196abb in KIO::Slave::qt_invoke () from /opt/kde3/lib/libkio.so.4
#30 0x40858039 in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#31 0x40858621 in QObject::activate_signal ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#32 0x40ba6a90 in QSocketNotifier::activated ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#33 0x40877450 in QSocketNotifier::event ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#34 0x407f7351 in QApplication::internalNotify ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#35 0x407f7cd9 in QApplication::notify () from /usr/lib/qt3/lib/libqt-mt.so.3
#36 0x4052f4ee in KApplication::notify () from /opt/kde3/lib/libkdecore.so.4
#37 0x407eaf8d in QEventLoop::activateSocketNotifiers ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#38 0x407a48b2 in QEventLoop::processEvents ()
   from /usr/lib/qt3/lib/libqt-mt.so.3
#39 0x4080e388 in QEventLoop::enterLoop () from /usr/lib/qt3/lib/libqt-mt.so.3
#40 0x4080e286 in QEventLoop::exec () from /usr/lib/qt3/lib/libqt-mt.so.3
#41 0x407f6c9f in QApplication::exec () from /usr/lib/qt3/lib/libqt-mt.so.3
#42 0x4173cbec in kdemain () from /opt/kde3/lib/libkdeinit_konqueror.so
#43 0x40cef544 in kdeinitmain () from /opt/kde3/lib/kde3/konqueror.so
#44 0x0804e180 in launch ()
#45 0x0804e834 in handle_launcher_request ()
#46 0x0804edb7 in handle_requests ()
#47 0x0804fec3 in main ()
===

Comment 1 Maarten ter Huurne 2006-12-06 22:49:15 UTC

Created attachment 18824 [details]
Minimal testcase that reproduces the problem

Comment 2 Maarten ter Huurne 2006-12-06 22:49:48 UTC

Created attachment 18825 [details]
Minimal testcase that reproduces the problem

Comment 3 Maarten ter Huurne 2006-12-06 22:50:08 UTC

Created attachment 18826 [details]
Minimal testcase that reproduces the problem

Comment 4 Maksim Orlovich 2006-12-06 23:07:55 UTC

Thanks for the report --- this got fixed for 3.5.6 after an earlier br, already..

*** This bug has been marked as a duplicate of 136120 ***