Bug 161953

Version:            (using KDE 3.5.9)
Installed from:    Ubuntu Packages

This report was reported by AleksanderAdamowski at https://bugs.launchpad.net/ubuntu/+source/kdebase/+bug/214866

On Ubuntu Gutsy, konqueror 4:3.5.8-0ubuntu2.2 crashes when visiting this page:
http://magicgarden.sourceforge.net/?q=node/26
One can navigate to that page from this page by clicking the "render with leaves" image:
http://magicgarden.sourceforge.net/?q=image/tid/2
Crash results in the following stacktrace (only top 14 frames, see the attachment for full stacktrace):
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
 [Thread debugging using libthread_db enabled]
 [New Thread -1233430320 (LWP 8812)]
 [KCrash handler]
 #6 0xb5d56dc7 in khtml::RenderBlock::addChildToFlow (this=0x95487d0,
     newChild=0x955e280, beforeChild=0x9548854)
     at /build/buildd/kdelibs-3.5.8/./khtml/rendering/render_block.cpp:372
 #7 0xb5d052a6 in khtml::RenderFlow::addChild (this=0x95487d0,
     newChild=0x955e280, beforeChild=0x9548854)
     at /build/buildd/kdelibs-3.5.8/./khtml/rendering/render_flow.cpp:128
 #8 0xb5d56c4f in khtml::RenderBlock::addChildToFlow (this=0x95485d4,
     newChild=0x955e280, beforeChild=0x9548854)
     at /build/buildd/kdelibs-3.5.8/./khtml/rendering/render_block.cpp:298
 #9 0xb5d052a6 in khtml::RenderFlow::addChild (this=0x95485d4,
     newChild=0x955e280, beforeChild=0x9548854)
     at /build/buildd/kdelibs-3.5.8/./khtml/rendering/render_flow.cpp:128
 #10 0xb5c9e249 in DOM::NodeImpl::createRendererIfNeeded (this=0xa8f0100)
     at /build/buildd/kdelibs-3.5.8/./khtml/xml/dom_nodeimpl.cpp:938
 #11 0xb5c9e272 in DOM::ElementImpl::attach (this=0xa8f0100)
     at /build/buildd/kdelibs-3.5.8/./khtml/xml/dom_elementimpl.cpp:536
 #12 0xb5ca6859 in DOM::NodeBaseImpl::insertBefore (this=0xa8eea78,
     newChild=0xa8f0100, refChild=0xa8f22e8, exceptioncode=@0xbf949288)
     at /build/buildd/kdelibs-3.5.8/./khtml/xml/dom_nodeimpl.cpp:1086
 #13 0xb5e74121 in DOM::Node::insertBefore (this=0xbf949370,
     newChild=@0xbf9493d8, refChild=@0xbf9493d0)
     at /build/buildd/kdelibs-3.5.8/./khtml/dom/dom_node.cpp:262
 #14 0xb5e0055e in KJS::DOMNodeProtoFunc::tryCall (this=0x93892c0,
     exec=0xbf949964, thisObj=@0xbf949720, args=@0xbf949714)
     at /build/buildd/kdelibs-3.5.8/./khtml/ecma/kjs_dom.cpp:586


Also crashed on 3.5.9 on hardy

Thanks