Bug 158532

Summary: [testcase] assertion failure in khtml::RenderInline::paintOutlinePath
Product: [Applications] konqueror Reporter: Marcus Better <marcus>
Component: khtmlAssignee: Konqueror Bugs <konqueror-bugs-null>
Status: RESOLVED FIXED    
Severity: major CC: agoeb, ajv-viaccismic, cwblumre, finex, frank78ac, germano.massullo, jolly121, jpetso, kde-bugs, loacoon, maksim, porten, skunk
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: unspecified   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:
Attachments: Reduced testcase

Description Marcus Better 2008-02-28 11:36:33 UTC 
Version:           4.0.1 (KDE 4.0.1) (using 4.0.1 (KDE 4.0.1), Debian packages)
Compiler:          cc
OS:                Linux (i686) release 2.6.24-lg

Konqueror crashes reproducibly when visiting the URL
http://www.mylucy.net/packages.aspx and clicking or right-clicking on
the link "Compare the myLucy.net packages" at the bottom of that page.

Using host libthread_db library "/lib/i686/cmov/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 0xb63e76c0 (LWP 8656)]
[New Thread 0xb2fe0b90 (LWP 15129)]
[KCrash handler]
#6  0xb7fc2410 in __kernel_vsyscall ()
#7  0xb7db2f15 in raise () from /lib/i686/cmov/libc.so.6
#8  0xb7db4891 in abort () from /lib/i686/cmov/libc.so.6
#9  0xb7bfea35 in qt_message_output (msgType=QtFatalMsg, 
    buf=0xbf9c822c "ASSERT: \"bsOrientation(bs) != bsOrientation(nextBS)\" in file /build/buildd/kde4libs-4.0.1/khtml/rendering/render_inline.cpp, line 753")
    at global/qglobal.cpp:2160
#10 0xb7bfeae9 in qFatal (msg=0xb7cebb64 "ASSERT: \"%s\" in file %s, line %d")
    at global/qglobal.cpp:2392
#11 0xb7bfec75 in qt_assert (
    assertion=0xb48fdb48 "bsOrientation(bs) != bsOrientation(nextBS)", 
    file=0xb48fdb08 "/build/buildd/kde4libs-4.0.1/khtml/rendering/render_inline.cpp", line=753) at global/qglobal.cpp:1917
#12 0xb474b9d0 in khtml::RenderInline::paintOutlinePath (this=0x8bb1a3c, 
    p=0xbf9cae54, tx=87, ty=666, begin=0x9474b50, end=0x9474b78, 
    bs=khtml::RenderObject::BSTop, direction=-1, 
    endingBS=khtml::RenderObject::BSTop)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_inline.cpp:753
#13 0xb474cc9e in khtml::RenderInline::paintOutlines (this=0x8bb1a3c, 
    p=0xbf9cae54, _tx=87, _ty=666)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_inline.cpp:592
#14 0xb4768852 in khtml::RenderFlow::paintLines (this=0x8bb19b8, 
    i=@0xbf9cab80, _tx=87, _ty=666)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_flow.cpp:395
#15 0xb4747f65 in khtml::RenderBlock::paintObject (this=0x8bb19b8, 
    pI=@0xbf9cab80, _tx=87, _ty=666, shouldPaintOutline=true)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1678
#16 0xb474816d in khtml::RenderBlock::paint (this=0x8bb19b8, pI=@0xbf9cab80, 
    _tx=77, _ty=666)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1648
#17 0xb474803d in khtml::RenderBlock::paintObject (this=0x8bab554, 
    pI=@0xbf9cab80, _tx=77, _ty=198, shouldPaintOutline=false)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1682
#18 0xb4781609 in khtml::RenderTableCell::paint (this=0x8bab554, 
    pI=@0xbf9cab80, _tx=77, _ty=198)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:2865
#19 0xb477c3c9 in khtml::RenderTableSection::paint (this=0x8bab49c, 
    pI=@0xbf9cab80, tx=77, ty=198)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:1799
#20 0xb4778bd2 in khtml::RenderTable::paint (this=0x8bab3f0, pI=@0xbf9cab80, 
    _tx=77, _ty=198)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:489
#21 0xb474803d in khtml::RenderBlock::paintObject (this=0x8bab358, 
    pI=@0xbf9cab80, _tx=77, _ty=198, shouldPaintOutline=false)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1682
#22 0xb4781609 in khtml::RenderTableCell::paint (this=0x8bab358, 
    pI=@0xbf9cab80, _tx=77, _ty=198)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:2865
#23 0xb477c3c9 in khtml::RenderTableSection::paint (this=0x8baabec, 
    pI=@0xbf9cab80, tx=77, ty=160)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:1799
#24 0xb4778bd2 in khtml::RenderTable::paint (this=0x8baaabc, pI=@0xbf9cab80, 
    _tx=77, _ty=160)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:489
#25 0xb474803d in khtml::RenderBlock::paintObject (this=0x8baa948, 
    pI=@0xbf9cab80, _tx=75, _ty=160, shouldPaintOutline=false)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1682
#26 0xb4781609 in khtml::RenderTableCell::paint (this=0x8baa948, 
    pI=@0xbf9cab80, _tx=75, _ty=160)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:2865
#27 0xb477c3c9 in khtml::RenderTableSection::paint (this=0x8ba9bbc, 
    pI=@0xbf9cab80, tx=75, ty=0)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:1799
#28 0xb4778bd2 in khtml::RenderTable::paint (this=0x8ba9b10, pI=@0xbf9cab80, 
    _tx=75, _ty=0)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_table.cpp:489
#29 0xb474803d in khtml::RenderBlock::paintObject (this=0x8ba9a8c, 
    pI=@0xbf9cab80, _tx=0, _ty=0, shouldPaintOutline=true)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1682
#30 0xb474816d in khtml::RenderBlock::paint (this=0x8ba9a8c, pI=@0xbf9cab80, 
    _tx=0, _ty=0)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1648
#31 0xb474803d in khtml::RenderBlock::paintObject (this=0x8ba99a4, 
    pI=@0xbf9cab80, _tx=0, _ty=0, shouldPaintOutline=true)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1682
#32 0xb474816d in khtml::RenderBlock::paint (this=0x8ba99a4, pI=@0xbf9cab80, 
    _tx=0, _ty=0)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_block.cpp:1648
#33 0xb4771f8b in khtml::RenderLayer::paintLayer (this=0x8ba9a28, 
    rootLayer=0x8ba9940, p=0xbf9cae54, paintDirtyRect=@0xbf9cae08, 
    selectionOnly=false)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_layer.cpp:1032
#34 0xb4771aeb in khtml::RenderLayer::paintLayer (this=0x8ba9940, 
    rootLayer=0x8ba9940, p=0xbf9cae54, paintDirtyRect=@0xbf9cae08, 
    selectionOnly=false)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_layer.cpp:1054
#35 0xb4772107 in khtml::RenderLayer::paint (this=0x8ba9940, p=0xbf9cae54, 
    damageRect=@0xbf9cae08, selectionOnly=<value optimized out>)
    at /build/buildd/kde4libs-4.0.1/khtml/rendering/render_layer.cpp:919
#36 0xb461e506 in KHTMLView::paintEvent (this=0x8afd1b8, e=0xbf9cb3a4)
    at /build/buildd/kde4libs-4.0.1/khtml/khtmlview.cpp:863
#37 0xb6c64e3d in QWidget::event (this=0x8afd1b8, event=0xbf9cb3a4)
    at kernel/qwidget.cpp:6487
#38 0xb6f5d163 in QFrame::event (this=0x8afd1b8, e=0xbf9cb3a4)
    at widgets/qframe.cpp:655
#39 0xb4607a50 in KHTMLView::widgetEvent (this=0x8afd1b8, e=0x6)
    at /build/buildd/kde4libs-4.0.1/khtml/khtmlview.cpp:2241
#40 0xb4607e4c in KHTMLView::eventFilter (this=0x8afd1b8, o=0x8b62de0, 
    e=0xbf9cb3a4) at /build/buildd/kde4libs-4.0.1/khtml/khtmlview.cpp:2109
#41 0xb6c1b1d2 in QApplicationPrivate::notify_helper (this=0x8058178, 
    receiver=0x8b62de0, e=0xbf9cb3a4) at kernel/qapplication.cpp:3548
#42 0xb6c1ebdc in QApplication::notify (this=0xbf9cd05c, receiver=0x8b62de0, 
    e=0xbf9cb3a4) at kernel/qapplication.cpp:3497
#43 0xb782c6cd in KApplication::notify (this=0xbf9cd05c, receiver=0x8b62de0, 
    event=0xbf9cb3a4)
    at /build/buildd/kde4libs-4.0.1/kdeui/kernel/kapplication.cpp:314
#44 0xb7cb9ffb in QCoreApplication::notifyInternal (this=0xbf9cd05c, 
    receiver=0x8b62de0, event=0xbf9cb3a4) at kernel/qcoreapplication.cpp:530
#45 0xb6c6c52e in qt_sendSpontaneousEvent (receiver=0x8b62de0, 
    event=0xbf9cb3a4)
    at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:203
#46 0xb6d937cb in QWidgetPrivate::drawWidget (this=0x8b90508, pdev=0x8131414, 
    rgn=@0xbf9cb55c, offset=@0xbf9cb530, flags=<value optimized out>)
    at painting/qbackingstore.cpp:1210
#47 0xb6d93271 in QWidgetBackingStore::paintSiblingsRecursive (
    pdev=0x8131414, siblings=@0xbf9cb6d4, index=0, rgn=@0xbf9cb79c, 
    offset=@0xbf9cb770, flags=4) at painting/qbackingstore.cpp:1113
#48 0xb6d93409 in QWidgetPrivate::drawWidget (this=0x8687cd0, pdev=0x8131414, 
    rgn=@0xbf9cb79c, offset=@0xbf9cb770, flags=4)
    at painting/qbackingstore.cpp:1246
#49 0xb6d93271 in QWidgetBackingStore::paintSiblingsRecursive (
    pdev=0x8131414, siblings=@0xbf9cb914, index=2, rgn=@0xbf9cb9dc, 
    offset=@0xbf9cb9b0, flags=4) at painting/qbackingstore.cpp:1113
#50 0xb6d93409 in QWidgetPrivate::drawWidget (this=0x8c981d8, pdev=0x8131414, 
    rgn=@0xbf9cb9dc, offset=@0xbf9cb9b0, flags=4)
    at painting/qbackingstore.cpp:1246
#51 0xb6d93271 in QWidgetBackingStore::paintSiblingsRecursive (
    pdev=0x8131414, siblings=@0xbf9cbb54, index=2, rgn=@0xbf9cbc1c, 
    offset=@0xbf9cbbf0, flags=4) at painting/qbackingstore.cpp:1113
#52 0xb6d93409 in QWidgetPrivate::drawWidget (this=0x8cb0d78, pdev=0x8131414, 
    rgn=@0xbf9cbc1c, offset=@0xbf9cbbf0, flags=4)
    at painting/qbackingstore.cpp:1246
#53 0xb6d93271 in QWidgetBackingStore::paintSiblingsRecursive (
    pdev=0x8131414, siblings=@0xbf9cbd94, index=3, rgn=@0xbf9cbe5c, 
    offset=@0xbf9cbe30, flags=4) at painting/qbackingstore.cpp:1113
#54 0xb6d93409 in QWidgetPrivate::drawWidget (this=0x838c938, pdev=0x8131414, 
    rgn=@0xbf9cbe5c, offset=@0xbf9cbe30, flags=4)
    at painting/qbackingstore.cpp:1246
#55 0xb6d93271 in QWidgetBackingStore::paintSiblingsRecursive (
    pdev=0x8131414, siblings=@0xbf9cbfd4, index=5, rgn=@0xbf9cc09c, 
    offset=@0xbf9cc070, flags=4) at painting/qbackingstore.cpp:1113
#56 0xb6d93409 in QWidgetPrivate::drawWidget (this=0x838c7c0, pdev=0x8131414, 
    rgn=@0xbf9cc09c, offset=@0xbf9cc070, flags=4)
    at painting/qbackingstore.cpp:1246
#57 0xb6d93271 in QWidgetBackingStore::paintSiblingsRecursive (
    pdev=0x8131414, siblings=@0xbf9cc214, index=57, rgn=@0xbf9cc304, 
    offset=@0x806410c, flags=4) at painting/qbackingstore.cpp:1113
#58 0xb6d93409 in QWidgetPrivate::drawWidget (this=0x81243a0, pdev=0x8131414, 
    rgn=@0xbf9cc304, offset=@0x806410c, flags=4)
    at painting/qbackingstore.cpp:1246
#59 0xb6d940f1 in QWidgetBackingStore::cleanRegion (this=0x8064100, 
    rgn=@0xbf9cc394, widget=0x8b62de0, recursiveCopyToScreen=true)
    at painting/qbackingstore.cpp:1012
#60 0xb6d942d7 in QWidget::repaint (this=0x8b62de0, rgn=@0xbf9cc3e8)
    at painting/qbackingstore.cpp:1280
#61 0xb6c65f11 in QWidget::repaint (this=0x8b62de0, r=@0xbf9cc41c)
    at kernel/qwidget.cpp:7844
#62 0xb6c65fde in QWidget::repaint (this=0x8b62de0, x=308, y=665, w=292, h=48)
    at kernel/qwidget.cpp:7834
#63 0xb460607b in KHTMLView::repaintContents (this=0x8afd1b8, x=308, y=665, 
    w=292, h=48) at /build/buildd/kde4libs-4.0.1/khtml/khtmlview.cpp:748
#64 0xb46064aa in KHTMLView::repaintContents (this=0x8afd1b8, r=@0xbf9cc53c)
    at /build/buildd/kde4libs-4.0.1/khtml/khtmlview.cpp:753
#65 0xb461d482 in KHTMLView::timerEvent (this=0x8afd1b8, e=0xbf9cccb8)
    at /build/buildd/kde4libs-4.0.1/khtml/khtmlview.cpp:3890
#66 0xb7ccba64 in QObject::event (this=0x8afd1b8, e=0x21d0)
    at kernel/qobject.cpp:1095
#67 0xb6c64be5 in QWidget::event (this=0x8afd1b8, event=0xbf9cccb8)
    at kernel/qwidget.cpp:6510
#68 0xb6f5d163 in QFrame::event (this=0x8afd1b8, e=0xbf9cccb8)
    at widgets/qframe.cpp:655
#69 0xb6fe3861 in QAbstractScrollArea::event (this=0x8afd1b8, e=0xbf9cccb8)
    at widgets/qabstractscrollarea.cpp:880
#70 0xb6fe70ff in QScrollArea::event (this=0x8afd1b8, e=0xbf9cccb8)
    at widgets/qscrollarea.cpp:285
#71 0xb460eb42 in KHTMLView::event (this=0x8afd1b8, e=0xbf9cccb8)
    at /build/buildd/kde4libs-4.0.1/khtml/khtmlview.cpp:489
#72 0xb6c1b21d in QApplicationPrivate::notify_helper (this=0x8058178, 
    receiver=0x8afd1b8, e=0xbf9cccb8) at kernel/qapplication.cpp:3556
#73 0xb6c1ebdc in QApplication::notify (this=0xbf9cd05c, receiver=0x8afd1b8, 
    e=0xbf9cccb8) at kernel/qapplication.cpp:3497
#74 0xb782c6cd in KApplication::notify (this=0xbf9cd05c, receiver=0x8afd1b8, 
    event=0xbf9cccb8)
    at /build/buildd/kde4libs-4.0.1/kdeui/kernel/kapplication.cpp:314
#75 0xb7cb9ffb in QCoreApplication::notifyInternal (this=0xbf9cd05c, 
    receiver=0x8afd1b8, event=0xbf9cccb8) at kernel/qcoreapplication.cpp:530
#76 0xb7ce0f79 in QTimerInfoList::activateTimers (this=0x805b52c)
    at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:200
#77 0xb7cddaa0 in timerSourceDispatch (source=0x805b4f8)
    at kernel/qeventdispatcher_glib.cpp:155
#78 0xb692a2b6 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#79 0xb692d643 in ?? () from /usr/lib/libglib-2.0.so.0
#80 0x0805a898 in ?? ()
#81 0x00000000 in ?? ()
#0  0xb7fc2410 in __kernel_vsyscall ()
Comment 1 FiNeX 2008-02-28 13:24:32 UTC 
Crash confirmed on revision 780185.
Comment 2 Marcus Better 2008-05-05 14:34:31 UTC 
Confirmed in KDE 4.0.72 (Debian experimental).
Comment 3 Frank Reininghaus 2008-07-17 22:20:53 UTC 
Created attachment 26223 [details]
Reduced testcase

This reduced testcase still crashes today's SVN trunk for me. I can't remove
anything else - 'align="center"' in the <p> tag and the <br> tag inside the
link are needed.
Comment 4 Christophe Marin 2008-07-20 15:27:31 UTC 
*** Bug 167061 has been marked as a duplicate of this bug. ***
Comment 5 Maksim Orlovich 2008-07-29 19:11:52 UTC 
*** Bug 163035 has been marked as a duplicate of this bug. ***
Comment 6 Maksim Orlovich 2008-08-01 18:01:13 UTC 
*** Bug 167939 has been marked as a duplicate of this bug. ***
Comment 7 Frank Reininghaus 2008-10-03 12:57:04 UTC 
*** Bug 172069 has been marked as a duplicate of this bug. ***
Comment 8 Maksim Orlovich 2008-10-20 18:11:11 UTC 
*** Bug 173186 has been marked as a duplicate of this bug. ***
Comment 9 Maksim Orlovich 2008-10-20 18:11:20 UTC 
*** Bug 173182 has been marked as a duplicate of this bug. ***
Comment 10 Maksim Orlovich 2008-10-29 14:43:00 UTC 
*** Bug 173819 has been marked as a duplicate of this bug. ***
Comment 11 Harri Porten 2008-11-05 00:22:37 UTC 
Fixed by r880218 and r880220 for KDE 4.2 and 4.1.4. Note that it was just
a pedantic assertion. I release mode there shouldn't have been any serious
problem except tiny rendering problems maybe.
Comment 12 Frank Reininghaus 2008-12-07 17:26:00 UTC 
*** Bug 177115 has been marked as a duplicate of this bug. ***
Comment 13 Frank Reininghaus 2008-12-10 19:18:10 UTC 
*** Bug 177386 has been marked as a duplicate of this bug. ***