Bug 161603

Summary: page crashes with segmentation fault stack overflow (with javascript enabled) [site specific?]
Product: [Applications] konqueror Reporter: Wolfgang Walter <wolfgang.walter>
Component: khtmlAssignee: Konqueror Developers <konq-bugs>
Status: RESOLVED WORKSFORME    
Severity: normal CC: christophe, lemma, maksim, nareshov, zahl
Priority: NOR    
Version: 3.5   
Target Milestone: ---   
Platform: Debian testing   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:

Description Wolfgang Walter 2008-05-04 12:58:36 UTC
Version:            (using KDE 3.5.9)
Installed from:    Debian testing/unstable Packages
OS:                Linux

When visiting

http://www.derwesten.de/nachrichten/nachrichten/wirtschaft-und-finanzen/ratgeber/2008/3/30/news-34008691/detail.html

konqueror immediately crashes (without further hints).

Starting konqueror from konsole gives:

bla@bomm:~$ konqueror
Segmentation fault
bla@bomm:~$

With javascript disabled the page gets displayed.
Comment 1 A. Spehr 2008-05-05 06:24:13 UTC
I'm using svn 4.0 branch r802754. flash 9.0.119, also 3.5.8 debian sid.

Yep, crashes hard in both. I can't get a bt in gdb or valgrind. See below for what I did get.

Oh super annoying: some people got it to work:
nareshov: openSUSE 10.3 with KDE3 backport repo => 3.5.9, flash 9.0.124.0-0.1
foureyes779: Slackware 12.0, KDE3.5.7, flash 9.0 r115

And some not:
azuriel: crashed on kubuntu and gentoo for 3.5.9, flash 9.0 r64

Lots of these (from valgrind):
==12440== Conditional jump or move depends on uninitialised value(s)
...

And at the end:
konqueror(12440)/khtml (part) KHTMLPart::slotChildCompleted: KHTMLPart(0x78a1c50)  slotChildCompleted child= khtml::ChildFrame(0x65d70a0,name = "khtml_child_frame")  m_partContainerElement= QObject(0xdf5de00)
konqueror(12440)/kio (KIOJob) KIO::SlaveInterface::dispatch: incoming metadata now QMap(("HTTP-Headers", "HTTP/1.1 200 OK
Date: Mon, 05 May 2008 03:29:30 GMT
...(what seems to be headers)
==12440== Stack overflow in thread 1: can't grow stack to 0xBE7FFD3C
==12440== Can't extend stack to 0xBE7FF700 during signal delivery for thread 1:
==12440==   no stack segment
==12440==
==12440== Process terminating with default action of signal 11 (SIGSEGV)
==12440==  Access not within mapped region at address 0xBE7FF700
==12440==    at 0x5C062A7: (within /usr/lib/libpcre.so.3.12.1)
==12440== Stack overflow in thread 1: can't grow stack to 0xBE7FFC6C
==12440==
==12440== Process terminating with default action of signal 11 (SIGSEGV)
==12440==  Access not within mapped region at address 0xBE7FFC6C
==12440==    at 0x4020200: _vgnU_freeres (vg_preloaded.c:56)
==12440==
==12440== ERROR SUMMARY: 832 errors from 80 contexts (suppressed: 529 from 2)
==12440== malloc/free: in use at exit: 13,485,227 bytes in 194,114 blocks.
==12440== malloc/free: 1,625,403 allocs, 1,431,289 frees, 284,034,253 bytes allocated.
==12440== For counts of detected errors, rerun with: -v
==12440== searching for pointers to 194,114 not-freed blocks.
==12440== checked 79,843,044 bytes.
==12440==
==12440== LEAK SUMMARY:
==12440==    definitely lost: 37,260 bytes in 1,593 blocks.
==12440==      possibly lost: 148,529 bytes in 4,987 blocks.
==12440==    still reachable: 13,299,438 bytes in 187,534 blocks.
==12440==         suppressed: 0 bytes in 0 blocks.
==12440== Rerun with --leak-check=full to see details of leaked memory.
Segmentation fault
Comment 2 Sami Cokar 2008-05-05 06:42:44 UTC
kubuntu 8.04
KDE 3.5.9
32 bit

this link works if you disable javascript, with OR without adobe flashplugin
Comment 3 Sami Cokar 2008-05-05 07:02:21 UTC
konqueror bug day 3
kubuntu 8.04
KDE 3.5.9
32 bit

enable javascript and have flash plugin installed.  when konqeuror crashes, the following appeared if you do 

tail -f ~/.xession-errors  when you visit web site:

(process:5953): Gtk-CRITICAL **: gtk_clipboard_get_for_display: assertion `display != NULL' failed
Adobe FlashPlayer: gtk_clipboard_get(GDK_SELECTION_PRIMARY); failed. Trying to call gtk_init(0,0);

Comment 4 Wolfgang Walter 2008-05-05 08:23:51 UTC
I don't have flash.
Comment 5 A. Spehr 2008-05-05 09:31:37 UTC
Wolfgang Walter: I lie. There is no flash. :)
Can you tell me what the following commands give you on your system? (This is what I get.)

$ dpkg -L libpcre3
/usr/lib/libpcre.so.3.12.1
etc

$ aptitude show libpcre3
Version: 7.6-2
Depends: libc6 (>= 2.7-1)
Conflicts: libpcre3-dev (<= 4.3-3)

$ ldd `which konqueror` |grep pcr
        libpcre.so.3 => /usr/lib/libpcre.so.3 (0xb632a000)
Comment 6 Michael Leupold 2008-05-05 09:41:55 UTC
For me the page works in both 3.5.9 (debian sid) and trunk r804042. Doesn't matter if js is on or off.

Konqueror 3.5.9 doesn't link against pcre for me, but libkjs in 3.5.9 links against libpcre.so.3 (7.6-2). Konqueror in trunk directly links against libpcre (as does libkjs).

BTW: the flash is just one of those ads in top you might hit randomly
Comment 7 Wolfgang Walter 2008-05-05 10:05:59 UTC
dpkg -L libpcre3:

/.
/usr
/usr/bin
/usr/bin/pcretest
/usr/lib
/usr/lib/libpcreposix.so.3.12.1
/usr/lib/libpcre.so.3.12.1
/usr/sbin
/usr/share
/usr/share/doc
/usr/share/doc/libpcre3
/usr/share/doc/libpcre3/README.gz
/usr/share/doc/libpcre3/NEWS.gz
/usr/share/doc/libpcre3/README.Debian
/usr/share/doc/libpcre3/AUTHORS
/usr/share/doc/libpcre3/copyright
/usr/share/doc/libpcre3/changelog.gz
/usr/share/doc/libpcre3/changelog.Debian.gz
/usr/share/man
/usr/share/man/man1
/usr/share/man/man1/pcretest.1.gz
/usr/share/man/man3
/usr/share/man/man3/pcrepattern.3.gz
/usr/lib/libpcre.so.3
/usr/lib/libpcreposix.so.3

=============================

aptitude show libpcre3:

Package: libpcre3
State: installed
Automatically installed: no
Version: 7.6-2
Priority: standard
Section: libs
Maintainer: Mark Baker <mark@mnb.org.uk>
Uncompressed Size: 356k
Depends: libc6 (>= 2.7-1)
Conflicts: libpcre3-dev (<= 4.3-3)
Description: Perl 5 Compatible Regular Expression Library - runtime files
 This is a library of functions to support regular expressions whose syntax and
 semantics are as close as possible to those of the Perl 5 language.

 This package contains the runtime libraries.

Tags: devel::library, role::shared-lib, use::scanning, use::searching

=========================

ldd /usr/bin/konqueror|grep pcr

gives nothing

==========================

ldd /usr/lib/libkjs.so.1.2.0:

        linux-gate.so.1 =>  (0xffffe000)
        libpcreposix.so.3 => /usr/lib/libpcreposix.so.3 (0xb7e8c000)
        libpcre.so.3 => /usr/lib/libpcre.so.3 (0xb7e65000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0xb7d77000)
        libm.so.6 => /lib/i686/cmov/libm.so.6 (0xb7d52000)
        libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb7c04000)
        libgcc_s.so.1 => /lib/libgcc_s.so.1 (0xb7bf7000)
        /lib/ld-linux.so.2 (0x80000000)
Comment 8 Michael Leupold 2008-05-05 10:38:52 UTC
That's amazing. It might actually be the same package version I have. Could you please check?

My version of konqueror, libkonq4 and kdelibs4c2a is:
4:3.5.9.dfsg.1-2
.. as returned by dpkg -l
Comment 9 Wolfgang Walter 2008-05-05 11:25:46 UTC
These are the version of konqueror, libkonq4, kdelibs4c2a:

konqueror                     4:3.5.9.dfsg.1-2+b1
libkonq4                      4:3.5.9.dfsg.1-2+b1
kdelibs4c2a                   4:3.5.9.dfsg.1-4
Comment 10 Michael Leupold 2008-05-05 14:22:14 UTC
I just upgraded my packages to the exact same version you are using and I still can't reproduce the bug. Do you happen to have gdb installed to produce a bugtrace? If so, please do:

$ gdb /usr/bin/konqueror
(...)
(gdb) run

then enter the above site that crashes. upon crash recheck the konsole running gdb and do a

(gdb) bt

Hope that will shed light onto that bug.
Comment 11 Wolfgang Walter 2008-05-05 14:33:53 UTC
$ gdb /usr/bin/konqueror
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(no debugging symbols found)
(gdb) run
Starting program: /usr/bin/konqueror
...
...
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb67d76c0 (LWP 6621)]
0xb5b512a7 in ?? () from /usr/lib/libpcre.so.3
(gdb) bt
#0  0xb5b512a7 in ?? () from /usr/lib/libpcre.so.3
Cannot access memory at address 0xbf6f3cc0
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xb5b512a7 in ?? () from /usr/lib/libpcre.so.3
(gdb) bt
#0  0xb5b512a7 in ?? () from /usr/lib/libpcre.so.3
Cannot access memory at address 0xbf6f3cc0
(gdb) cont
Continuing.

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
(gdb) quit
Comment 12 Maksim Orlovich 2008-06-14 16:44:27 UTC
Please re-test on post-r814950 in trunk.