Bug 187597

Summary: konqueror crash in KJS::XMLHttpRequest::changeState
Product: [Applications] konqueror Reporter: Marcus Better <marcus>
Component: khtmlAssignee: Konqueror Developers <konq-bugs>
Status: RESOLVED FIXED    
Severity: major CC: andresbajotierra, anselmolsm, arne_bab, cortesa, daniele.cocca, franz.holzinger, henrik, justusranvier, klaus.layer+kde, kovariadam, luke-jr+kdebugs, maksim, mathieu.havel, nowardev, pazderak
Priority: NOR    
Version: 4.2.1   
Target Milestone: ---   
Platform: Debian testing   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:

Description Marcus Better 2009-03-19 14:26:26 UTC
Version:            (using KDE 4.2.1)
OS:                Linux
Installed from:    Debian testing/unstable Packages

Konqueror crashed while clicking around in LinkedIn, just after clicking some "invite" link.

Program: Konqueror (konqueror), signal SIGSEGV
0x00007f9a781718d1 in nanosleep () from /lib/libc.so.6
Current language:  auto; currently c
[Current thread is 0 (LWP 5303)]

Thread 2 (Thread 0x7f9a57fff950 (LWP 6426)):
#0  0x00007f9a7819ab12 in select () from /lib/libc.so.6
#1  0x00007f9a75d94576 in QProcessManager::run (this=0x613f50) at io/qprocess_unix.cpp:305
#2  0x00007f9a75ccd802 in QThreadPrivate::start (arg=0x613f50) at thread/qthread_unix.cpp:189
#3  0x00007f9a71c8dfaa in start_thread (arg=<value optimized out>) at pthread_create.c:297
#4  0x00007f9a781a12bd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#5  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7f9a787f6750 (LWP 5303)):
[KCrash Handler]
#5  DOM::DocumentImpl::view (this=0x0) at ../../khtml/xml/dom_docimpl.cpp:2906
#6  0x00007f9a6934554b in KJS::XMLHttpRequest::changeState (this=0x7f9a65100580, newState=<value optimized out>) at ../../khtml/ecma/xmlhttprequest.cpp:346
#7  0x00007f9a69346d05 in KJS::XMLHttpRequest::slotFinished (this=0x7f9a65100580) at ../../khtml/ecma/xmlhttprequest.cpp:719
#8  0x00007f9a69347af1 in KJS::XMLHttpRequestQObject::qt_metacall (this=0x6368630, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fff8092f270) at ../../khtml/ecma/xmlhttprequest.cpp:93
#9  0x00007f9a75dcb622 in QMetaObject::activate (sender=0x4c7a7f0, from_signal_index=<value optimized out>, to_signal_index=7, argv=0x5c58d70) at kernel/qobject.cpp:3069
#10 0x00007f9a76416cf2 in KJob::result (this=0x0, _t1=0x4c7a7f0) at ./kjob.moc:186
#11 0x00007f9a7641706f in KJob::emitResult (this=0x4c7a7f0) at ../../kdecore/jobs/kjob.cpp:294
#12 0x00007f9a770df6d0 in KIO::SimpleJob::slotFinished (this=0x4c7a7f0) at ../../kio/kio/job.cpp:489
#13 0x00007f9a770e08f3 in KIO::TransferJob::slotFinished (this=0x4c7a7f0) at ../../kio/kio/job.cpp:966
#14 0x00007f9a770e1975 in KIO::TransferJob::qt_metacall (this=0x4c7a7f0, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fff8092f670) at ./jobclasses.moc:336
#15 0x00007f9a75dcb622 in QMetaObject::activate (sender=0x78af6e0, from_signal_index=<value optimized out>, to_signal_index=8, argv=0x5c58d70) at kernel/qobject.cpp:3069
#16 0x00007f9a77196b51 in KIO::SlaveInterface::dispatch (this=0x78af6e0, _cmd=104, rawdata=<value optimized out>) at ../../kio/kio/slaveinterface.cpp:175
#17 0x00007f9a771936a2 in KIO::SlaveInterface::dispatch (this=0x78af6e0) at ../../kio/kio/slaveinterface.cpp:91
#18 0x00007f9a771848d3 in KIO::Slave::gotInput (this=0x78af6e0) at ../../kio/kio/slave.cpp:322
#19 0x00007f9a77186bd8 in KIO::Slave::qt_metacall (this=0x78af6e0, _c=QMetaObject::InvokeMetaMethod, _id=96832880, _a=0x7fff8092fa90) at ./slave.moc:75
#20 0x00007f9a75dcb622 in QMetaObject::activate (sender=0x78adf00, from_signal_index=<value optimized out>, to_signal_index=4, argv=0x5c58d70) at kernel/qobject.cpp:3069
#21 0x00007f9a770ab831 in KIO::ConnectionPrivate::dequeue (this=0x776daf0) at ../../kio/kio/connection.cpp:82
#22 0x00007f9a770abc8a in KIO::Connection::qt_metacall (this=0x78adf00, _c=QMetaObject::InvokeMetaMethod, _id=96832880, _a=0x78fe780) at ./connection.moc:72
#23 0x00007f9a75dc5c78 in QObject::event (this=0x78adf00, e=0x4869600) at kernel/qobject.cpp:1118
#24 0x00007f9a751fb67d in QApplicationPrivate::notify_helper (this=0x610040, receiver=0x78adf00, e=0x4869600) at kernel/qapplication.cpp:4084
#25 0x00007f9a7520386a in QApplication::notify (this=0x7fff809306c0, receiver=0x78adf00, e=0x4869600) at kernel/qapplication.cpp:4049
#26 0x00007f9a769b211b in KApplication::notify (this=0x7fff809306c0, receiver=0x78adf00, event=0x4869600) at ../../kdeui/kernel/kapplication.cpp:307
#27 0x00007f9a75db5c4c in QCoreApplication::notifyInternal (this=0x7fff809306c0, receiver=0x78adf00, event=0x4869600) at kernel/qcoreapplication.cpp:602
#28 0x00007f9a75db68ba in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x603690) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:213
#29 0x00007f9a75ddf613 in postEventSourceDispatch (s=<value optimized out>) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:218
#30 0x00007f9a71edbafb in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#31 0x00007f9a71edf2bd in ?? () from /usr/lib/libglib-2.0.so.0
#32 0x00007f9a71edf47b in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#33 0x00007f9a75ddf29f in QEventDispatcherGlib::processEvents (this=0x60c460, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:323
#34 0x00007f9a7529374f in QGuiEventDispatcherGlib::processEvents (this=0x0, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:202
#35 0x00007f9a75db44f2 in QEventLoop::processEvents (this=<value optimized out>, flags={i = -2137848816}) at kernel/qeventloop.cpp:149
#36 0x00007f9a75db48bd in QEventLoop::exec (this=0x7fff80930450, flags={i = -2137848736}) at kernel/qeventloop.cpp:200
#37 0x00007f9a75db6b84 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:880
#38 0x00007f9a784eaa39 in kdemain (argc=<value optimized out>, argv=<value optimized out>) at ../../../../apps/konqueror/src/konqmain.cpp:257
#39 0x00007f9a780f15a6 in __libc_start_main (main=0x4006f0 <main>, argc=3, ubp_av=0x7fff80931138, init=0x400720 <__libc_csu_init>, fini=<value optimized out>, rtld_fini=<value optimized out>, 
    stack_end=0x7fff80931128) at libc-start.c:222
#40 0x0000000000400629 in _start () at ../sysdeps/x86_64/elf/start.S:113
Comment 1 Tommi Tervo 2009-03-19 14:34:15 UTC
Another linkedin crash report, bt looks totally different.
https://bugs.kde.org/show_bug.cgi?id=187468
Comment 2 Anselmo L. S. Melo (anselmolsm) 2009-06-20 17:55:21 UTC
I did some actions in linkedin (invite, search, edit profile) without crashes.

My setup:
Konqueror Version 4.2.92 (KDE 4.2.92 (KDE 4.3 >= 20090617))
Using KDE 4.2.92 (KDE 4.2.92 (KDE 4.3 >= 20090617)) - svn r984201
qt-copy r978427
Comment 3 Tommi Tervo 2009-08-11 11:42:02 UTC
*** Bug 203406 has been marked as a duplicate of this bug. ***
Comment 4 Mathieu Havel 2009-08-11 12:03:09 UTC
so this bug should be confirmed if it is a duplicate ?
Comment 5 FiNeX 2009-09-13 18:17:38 UTC
*** Bug 206985 has been marked as a duplicate of this bug. ***
Comment 6 Dario Andres 2009-09-16 03:43:15 UTC
*** Bug 206963 has been marked as a duplicate of this bug. ***
Comment 7 Dario Andres 2009-10-25 22:42:20 UTC
Updated backtrace from bug 211715:

 -- Backtrace:
Application: Konqueror (kdeinit4), signal: Segmentation fault
[KCrash Handler]
#5  DOM::DocumentImpl::view (this=0x0) at
/var/tmp/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/xml/dom_docimpl.cpp:2907
#6  0x00007f711ac619fb in KJS::XMLHttpRequest::changeState
(this=0x7f711bba0a80, newState=<value optimized out>)
    at
/var/tmp/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/ecma/xmlhttprequest.cpp:345
#7  0x00007f711ac631b5 in KJS::XMLHttpRequest::slotFinished
(this=0x7f711bba0a80) at
/var/tmp/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/ecma/xmlhttprequest.cpp:720
#8  0x00007f711ac63f91 in KJS::XMLHttpRequestQObject::qt_metacall
(this=0x7cd7320, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fff59c15bf0)
    at
/var/tmp/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/ecma/xmlhttprequest.cpp:93
Comment 8 Dario Andres 2009-10-25 22:42:22 UTC
*** Bug 211715 has been marked as a duplicate of this bug. ***
Comment 9 Maksim Orlovich 2009-10-30 14:32:33 UTC
*** Bug 212382 has been marked as a duplicate of this bug. ***
Comment 10 Maksim Orlovich 2009-10-30 14:33:16 UTC
*** Bug 200691 has been marked as a duplicate of this bug. ***
Comment 11 Maksim Orlovich 2009-10-30 14:49:17 UTC
Likely caused by bug #160087, though I am worried about reports with non-null DocumentImpl. Of course, it could be gdb being wrong on release builds...
Comment 12 Maksim Orlovich 2009-11-05 21:04:54 UTC
*** Bug 213315 has been marked as a duplicate of this bug. ***
Comment 13 Jonathan Thomas 2009-11-10 02:42:12 UTC
*** Bug 213701 has been marked as a duplicate of this bug. ***
Comment 14 Dario Andres 2009-12-11 14:02:09 UTC
From bug 218084:
---
A visit to
http://www.faz.net:80/s/RubA24ECD630CAE40E483841DB7D16F4211Tpl~Ecommon~Sressort~Apge~E2.html

brings a crash if you link to a sub topic.

---
From bug 214356:
---
What I was doing when the application crashed:
I visited a picasa webalbum and wanted to look at a picture. 
The picture wasn't shown (I guess my login had times out). 
Then I closed the window with ctrl-q and Konqueror closed and crashed.
Comment 15 Dario Andres 2009-12-11 14:02:12 UTC
*** Bug 218084 has been marked as a duplicate of this bug. ***
Comment 16 Dario Andres 2009-12-11 14:02:15 UTC
*** Bug 214356 has been marked as a duplicate of this bug. ***
Comment 17 Maksim Orlovich 2010-01-15 19:10:58 UTC
SVN commit 1075245 by orlovich:

- Make sure to cancel non-POST XHR jobs when the related document 
object is destroyed. (#160087)
- Related to this, don't crash trying to emit events when we get 
to changeState w/o a doc (#187597, #214584, #213987, #201053).
Also add some paranoia about that for the methods.
- Handle encoding inside mimetype overrides. (Some demo by Mr. Strigi).

BUG: 160087
BUG: 187597
BUG: 214584
BUG: 213987
BUG: 201053


 M  +32 -6     xmlhttprequest.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1075245
Comment 18 Maksim Orlovich 2010-01-15 19:17:54 UTC
SVN commit 1075253 by orlovich:

automatically merged revision 1075245:
- Make sure to cancel non-POST XHR jobs when the related document 
object is destroyed. (#160087)
- Related to this, don't crash trying to emit events when we get 
to changeState w/o a doc (#187597, #214584, #213987, #201053).
Also add some paranoia about that for the methods.
- Handle encoding inside mimetype overrides. (Some demo by Mr. Strigi).

BUG: 160087
BUG: 187597
BUG: 214584
BUG: 213987
BUG: 201053

 M  +32 -6     xmlhttprequest.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1075253
Comment 19 Tommi Tervo 2010-01-17 13:39:33 UTC
*** Bug 223125 has been marked as a duplicate of this bug. ***
Comment 20 Maksim Orlovich 2010-03-27 16:08:00 UTC
*** Bug 232352 has been marked as a duplicate of this bug. ***