| Summary: | [testcase] konqueror crashes every time visiting http://it.wasalive.com/it/asus+eeepc | ||
|---|---|---|---|
| Product: | [Applications] konqueror | Reporter: | Andrea Diamantini <adjam7> |
| Component: | khtml | Assignee: | Konqueror Developers <konq-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | andresbajotierra, fabien.skraber, finex, fizista, frank78ac, ivaylo.kabakov, jajaxor, L.Plant.98, maksim, michaelperik, michiduta07, zahl |
| Priority: | NOR | ||
| Version: | SVN | ||
| Target Milestone: | --- | ||
| Platform: | Compiled Sources | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | 4.5.1 | |
| Sentry Crash Report: | |||
| Attachments: | Reduced test case | ||
|
Description
Andrea Diamantini
2008-05-12 09:11:49 UTC
I can reprodocue this bug in Debian Stable (eka kde 3.5.5 Her is the gdb (no debugging symbols found) Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1". (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread -1232721696 (LWP 4690)] (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) [KCrash handler] #9 0xb5f1acad in non-virtual thunk to DOM::HTMLEmbedElementImpl::~HTMLEmbedElementImpl() () from /usr/lib/libkhtml.so.4 #10 0xb5f2e580 in non-virtual thunk to DOM::HTMLEmbedElementImpl::~HTMLEmbedElementImpl() () from /usr/lib/libkhtml.so.4 #11 0x0af3a964 in ?? () #12 0x083c6718 in ?? () #13 0x00000001 in ?? () #14 0xb61043e4 in ?? () from /usr/lib/libkhtml.so.4 #15 0x0af3a964 in ?? () #16 0x00000000 in ?? () Are those actual bidi calls in there? I don't see anything that looks like it would use bidi in the page (looking at it under iceweasel).
And in 4.0 branch svn r802901 (~4.0.4?) it crashes:
#6 0xb45aa792 in WTF::SharedPtr<khtml::RenderArena>::get (this=0x130)
at /home/kde-devel/kde/src/KDE/kdelibs/kjs/wtf/SharedPtr.h:47
#7 0xb45baf36 in DOM::DocumentImpl::renderArena (this=0x8)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_docimpl.h:306
#8 0xb4668384 in khtml::RenderObject::renderArena (this=0x863d784)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_object.cpp:1698
#9 0xb4643916 in appendRunsForObject (start=0, end=1, obj=0x863d784,
bidi=@0xbff3a288)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/bidi.cpp:518
#10 0xb4643b41 in appendRun (bidi=@0xbff3a288)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/bidi.cpp:551
#11 0xb464739a in khtml::RenderBlock::bidiReorderLine (this=0x863d5b4,
start=@0xbff3a300, end=@0xbff3a2d4, bidi=@0xbff3a288)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/bidi.cpp:1283
#12 0xb4648032 in khtml::RenderBlock::layoutInlineChildren (this=0x863d5b4,
relayoutChildren=false, breakBeforeLine=0)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/bidi.cpp:1547
#13 0xb4655a7e in khtml::RenderBlock::layoutBlock (this=0x863d5b4,
relayoutChildren=false)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:779
#14 0xb46561d7 in khtml::RenderBlock::layout (this=0x863d5b4)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:682
#15 0xb4522841 in khtml::RenderObject::layoutIfNeeded (this=0x863d5b4)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_object.h:441
#16 0xb46534f7 in khtml::RenderBlock::layoutPositionedObjects (this=0x863d4cc,
relayoutChildren=false)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:1667
#17 0xb46556e1 in khtml::RenderBlock::layoutBlock (this=0x863d4cc,
relayoutChildren=false)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:706
#18 0xb46561d7 in khtml::RenderBlock::layout (this=0x863d4cc)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:682
#19 0xb4522841 in khtml::RenderObject::layoutIfNeeded (this=0x863d4cc)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_object.h:441
#20 0xb465501d in khtml::RenderBlock::layoutBlockChildren (this=0x863d448,
relayoutChildren=false)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:1502
#21 0xb4655a93 in khtml::RenderBlock::layoutBlock (this=0x863d448,
relayoutChildren=false)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:781
#22 0xb46561d7 in khtml::RenderBlock::layout (this=0x863d448)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:682
#23 0xb4522841 in khtml::RenderObject::layoutIfNeeded (this=0x863d448)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_object.h:441
#24 0xb465501d in khtml::RenderBlock::layoutBlockChildren (this=0x863d3c4,
relayoutChildren=false)
at /home/kde-devel/kde/src/KDE/kdelibs/khtml/rendering/render_block.cpp:1502
#25 0xb4655a93 in khtml::RenderBlock::layoutBlock (this=0x863d3c4,
relayoutChildren=false)
at /home/kde
.....
Created attachment 27136 [details]
Reduced test case
This test case still crashes 4.1, SVN trunk 854508, and 3.5.10 for me. The backtrace is not always the same, but always similar to the ones posted here earlier. It's a bit strange that the "new Effect();" command in the script section is needed for the crash although I was able to remove the link to the JS file defining the "Effect".
Same here, with Konqueror 4.1.4, and another URL on the same site: http://en.wasalive.com/en/dell The first link makes my current trunk version of Konqueror (KDE 4) crash (r1017738) Bug 210326 got another testcase site: http://ijustmadelove.com/ I could still reproduce both crashes on 4.4.. Thanks *** Bug 210326 has been marked as a duplicate of this bug. *** *** Bug 214057 has been marked as a duplicate of this bug. *** Crash reproduced on KDE 4.4.5 using the testcase on comment #3. Moreover the backtrace is very similar to bug #145635 ==12274== Invalid read of size 4 ==12274== at 0xCA29FB7: khtml::DocPtr<DOM::DocumentImpl>::get() const (shared.h:104) ==12274== by 0xCB91EBF: khtml::RenderObject::renderArena() const (render_object.cpp:2371) ==12274== by 0xCB70164: khtml::appendRunsForObject(int, int, khtml::RenderObject*, khtml::BidiState&) (bidi.cpp:554) ==12274== by 0xCB70263: khtml::appendRun(khtml::BidiState&) (bidi.cpp:568) ==12274== by 0xCB732A6: khtml::RenderBlock::bidiReorderLine(khtml::BidiIterator const&, khtml::BidiIterator const&, khtml::BidiState&) (bidi.cpp:1297) ==12274== by 0xCB73DDE: khtml::RenderBlock::layoutInlineChildren(bool, int) (bidi.cpp:1512) ==12274== by 0xCB7FB12: khtml::RenderBlock::layoutBlock(bool) (render_block.cpp:833) ==12274== by 0xCB80014: khtml::RenderBlock::layout() (render_block.cpp:736) ==12274== by 0xCA29B40: khtml::RenderObject::layoutIfNeeded() (render_object.h:480) ==12274== by 0xCB7F2DF: khtml::RenderBlock::layoutBlockChildren(bool) (render_block.cpp:1556) ==12274== by 0xCB7FB23: khtml::RenderBlock::layoutBlock(bool) (render_block.cpp:835) ==12274== by 0xCB80014: khtml::RenderBlock::layout() (render_block.cpp:736) ==12274== by 0xCBF79A3: khtml::RenderBody::layout() (render_body.cpp:91) ==12274== by 0xCA29B40: khtml::RenderObject::layoutIfNeeded() (render_object.h:480) ==12274== by 0xCB7F2DF: khtml::RenderBlock::layoutBlockChildren(bool) (render_block.cpp:1556) ==12274== by 0xCB7FB23: khtml::RenderBlock::layoutBlock(bool) (render_block.cpp:835) ==12274== by 0xCB80014: khtml::RenderBlock::layout() (render_block.cpp:736) ==12274== by 0xCA29B40: khtml::RenderObject::layoutIfNeeded() (render_object.h:480) ==12274== by 0xCB7F2DF: khtml::RenderBlock::layoutBlockChildren(bool) (render_block.cpp:1556) ==12274== by 0xCB7FB23: khtml::RenderBlock::layoutBlock(bool) (render_block.cpp:835) ==12274== by 0xCBF2C20: khtml::RenderCanvas::layout() (render_canvas.cpp:191) ==12274== by 0xCA265F2: KHTMLView::layout() (khtmlview.cpp:1019) ==12274== by 0xCA26CB4: KHTMLView::timerEvent(QTimerEvent*) (khtmlview.cpp:4166) ==12274== by 0x543FE49: QObject::event(QEvent*) (qobject.cpp:1212) ==12274== by 0x59A9216: QWidget::event(QEvent*) (qwidget.cpp:8501) ==12274== by 0x5DD8F89: QFrame::event(QEvent*) (qframe.cpp:557) ==12274== by 0x5E78E3F: QAbstractScrollArea::event(QEvent*) (qabstractscrollarea.cpp:989) ==12274== by 0x5E7DEBE: QScrollArea::event(QEvent*) (qscrollarea.cpp:314) ==12274== by 0xCA24B64: KHTMLView::event(QEvent*) (khtmlview.cpp:551) ==12274== by 0x5944D65: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4306) ==12274== by 0x5944BCB: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4271) ==12274== by 0x4CC9E02: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:309) ==12274== by 0x542AA71: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:726) ==12274== by 0x40A4FDD: QCoreApplication::sendEvent(QObject*, QEvent*) (qcoreapplication.h:215) ==12274== by 0x54608BC: QTimerInfoList::activateTimers() (qeventdispatcher_unix.cpp:603) ==12274== by 0x545CCDE: timerSourceDispatch(_GSource*, int (*)(void*), void*) (qeventdispatcher_glib.cpp:184) ==12274== by 0x6A536DD: g_main_context_dispatch (gmain.c:2119) ==12274== by 0x6A57567: g_main_context_iterate (gmain.c:2750) ==12274== by 0x6A5770D: g_main_context_iteration (gmain.c:2813) ==12274== by 0x545DCB7: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:412) ==12274== by 0x5A0B18F: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204) ==12274== by 0x5428412: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149) ==12274== by 0x5428556: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:197) ==12274== by 0x542B117: QCoreApplication::exec() (qcoreapplication.cpp:1003) ==12274== by 0x5942233: QApplication::exec() (qapplication.cpp:3585) ==12274== by 0x412A3CC: kdemain (konqmain.cpp:220) ==12274== by 0x804872A: main (konqueror_dummy.cpp:3) ==12274== Address 0x7b3f6b0 is 16 bytes inside a block of size 40 free'd ==12274== at 0x40236AD: operator delete(void*) (vg_replace_malloc.c:346) ==12274== by 0xCADAB74: DOM::TextImpl::~TextImpl() (dom_textimpl.h:111) ==12274== by 0xCACE35C: DOM::NodeBaseImpl::removeChildren() (dom_nodeimpl.cpp:1722) ==12274== by 0xCB2CC6B: DOM::HTMLElementImpl::setInnerHTML(DOM::DOMString const&, int&) (html_elementimpl.cpp:526) ==12274== by 0xCCCA5E8: KJS::HTMLElement::putValueProperty(KJS::ExecState*, int, KJS::JSValue*, int) (kjs_html.cpp:2620) ==12274== by 0xCCDEF95: bool KJS::lookupPut<KJS::HTMLElement>(KJS::ExecState*, KJS::Identifier const&, KJS::JSValue*, int, KJS::HashTable const*, KJS::HTMLElement*) (lookup.h:249) ==12274== by 0xCCDEFF7: void KJS::lookupPut<KJS::HTMLElement, KJS::DOMElement>(KJS::ExecState*, KJS::Identifier const&, KJS::JSValue*, int, KJS::HashTable const*, KJS::HTMLElement*) (lookup.h:265) ==12274== by 0xCCCCAE5: KJS::HTMLElement::put(KJS::ExecState*, KJS::Identifier const&, KJS::JSValue*, int) (kjs_html.cpp:2393) ==12274== by 0xD6372CF: KJS::Machine::runBlock(KJS::ExecState*, WTF::Vector<unsigned char, 0u> const&, KJS::ExecState*) (codes.def:672) ==12274== by 0xD5DD3FE: KJS::FunctionBodyNode::execute(KJS::ExecState*) (nodes.cpp:927) ==12274== by 0xD61E575: KJS::Interpreter::evaluate(KJS::UString const&, int, KJS::UChar const*, int, KJS::JSValue*) (interpreter.cpp:556) ==12274== by 0xD61E621: KJS::Interpreter::evaluate(KJS::UString const&, int, KJS::UString const&, KJS::JSValue*) (interpreter.cpp:496) ==12274== by 0xCCF7FD8: KJSProxy::evaluate(QString, int, QString const&, DOM::Node const&, KJS::Completion*) (kjs_proxy.cpp:126) ==12274== by 0xCA57D62: KHTMLPart::executeScript(QString const&, int, DOM::Node const&, QString const&) (khtml_part.cpp:1282) ==12274== by 0xCB19677: khtml::HTMLTokenizer::scriptExecution(QString const&, QString const&, int) (htmltokenizer.cpp:517) ==12274== by 0xCB19FB0: khtml::HTMLTokenizer::scriptHandler() (htmltokenizer.cpp:470) ==12274== by 0xCB1A626: khtml::HTMLTokenizer::parseRawContent(khtml::TokenizerString&) (htmltokenizer.cpp:379) ==12274== by 0xCB1C021: khtml::HTMLTokenizer::parseTag(khtml::TokenizerString&) (htmltokenizer.cpp:1527) ==12274== by 0xCB1C735: khtml::HTMLTokenizer::write(khtml::TokenizerString const&, bool) (htmltokenizer.cpp:1798) ==12274== by 0xCA4A723: KHTMLPart::write(char const*, int) (khtml_part.cpp:2088) ==12274== by 0xCA4D26D: KHTMLPart::slotData(KIO::Job*, QByteArray const&) (khtml_part.cpp:1740) ==12274== by 0xCA56236: KHTMLPart::qt_metacall(QMetaObject::Call, int, void**) (khtml_part.moc:277) ==12274== by 0x5431781: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237) ==12274== by 0x544385B: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3292) ==12274== by 0x44B5638: KIO::TransferJob::data(KIO::Job*, QByteArray const&) (jobclasses.moc:388) ==12274== by 0x44B8F5A: KIO::TransferJob::slotData(QByteArray const&) (job.cpp:1003) ==12274== by 0x44C15FF: KIO::TransferJob::qt_metacall(QMetaObject::Call, int, void**) (jobclasses.moc:368) ==12274== by 0x5431781: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237) ==12274== by 0x544385B: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3292) ==12274== by 0x45694A2: KIO::SlaveInterface::data(QByteArray const&) (slaveinterface.moc:146) ==12274== by 0x456AFFE: KIO::SlaveInterface::dispatch(int, QByteArray const&) (slaveinterface.cpp:163) ==12274== by 0x456BC29: KIO::SlaveInterface::dispatch() (slaveinterface.cpp:91) ==12274== by 0x455EAA3: KIO::Slave::gotInput() (slave.cpp:344) ==12274== by 0x455FFDA: KIO::Slave::qt_metacall(QMetaObject::Call, int, void**) (slave.moc:82) ==12274== by 0x5431781: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237) ==12274== by 0x544385B: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3292) ==12274== by 0x4484E16: KIO::Connection::readyRead() (connection.moc:92) ==12274== by 0x4485E35: KIO::ConnectionPrivate::dequeue() (connection.cpp:82) ==12274== by 0x4486CB5: KIO::Connection::qt_metacall(QMetaObject::Call, int, void**) (connection.moc:79) ==12274== by 0x5431781: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237) ==12274== by 0x543E25E: QMetaCallEvent::placeMetaCall(QObject*) (qobject.cpp:561) ==12274== by 0x543FF0C: QObject::event(QEvent*) (qobject.cpp:1245) ==12274== by 0x5944D65: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4306) ==12274== by 0x5942625: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3710) ==12274== by 0x4CC9E02: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:309) ==12274== by 0x542AA71: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:726) ==12274== by 0x40A4FDD: QCoreApplication::sendEvent(QObject*, QEvent*) (qcoreapplication.h:215) ==12274== by 0x542BAA5: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1364) ==12274== by 0x542B75E: QCoreApplication::sendPostedEvents(QObject*, int) (qcoreapplication.cpp:1260) ==12274== by 0x4D91235: QCoreApplication::sendPostedEvents() (qcoreapplication.h:220) Urk. The way first-letter works is pretty bad --- if the comments don't lie it relies on a detach(!) of the parent to blow away the pseudo's renderer. That works when restyling the element itself, but blowing away kids doesn't handle it. (Also, the "new Effect()" thing doesn't matter, I think --- the problem is still visible in valgrind w/o it) *** Bug 209342 has been marked as a duplicate of this bug. *** *** Bug 210646 has been marked as a duplicate of this bug. *** *** Bug 223079 has been marked as a duplicate of this bug. *** SVN commit 1164385 by orlovich: Fix problems with ghost first-letter RenderTextFragments staying around (and keeping dangling pointers w/them) when the inline containing their text has changed by keeping a link from the main text's RenderTextFragment to the letter's, to permit invalidating it (Stolen from WebCore). This fixes the crashes, but on change first-letter isn't reapplied properly as still keeps a useless anonymous inline wrapper and RenderBlock::updateFirstLetter isn't smart enough to walk past it or reuse it. BUG: 161989 M +2 -0 render_block.cpp M +24 -3 render_text.cpp M +12 -2 render_text.h WebSVN link: http://websvn.kde.org/?view=rev&revision=1164385 SVN commit 1164387 by orlovich: Merged revision:r1164385 | orlovich | 2010-08-16 12:47:57 -0400 (Mon, 16 Aug 2010) | 11 lines Fix problems with ghost first-letter RenderTextFragments staying around (and keeping dangling pointers w/them) when the inline containing their text has changed by keeping a link from the main text's RenderTextFragment to the letter's, to permit invalidating it (Stolen from WebCore). This fixes the crashes, but on change first-letter isn't reapplied properly as still keeps a useless anonymous inline wrapper and RenderBlock::updateFirstLetter isn't smart enough to walk past it or reuse it. BUG: 161989 M +2 -0 render_block.cpp M +24 -3 render_text.cpp M +12 -2 render_text.h WebSVN link: http://websvn.kde.org/?view=rev&revision=1164387 *** Bug 145635 has been marked as a duplicate of this bug. *** |