Summary: | khtml crash by browsing http://ofono.org | ||
---|---|---|---|
Product: | [Applications] konqueror | Reporter: | Thiago Macieira <thiago> |
Component: | khtml | Assignee: | Konqueror Developers <konq-bugs> |
Status: | RESOLVED FIXED | ||
Severity: | crash | CC: | andresbajotierra, gregor.rosenauer, maksim, paul, Tanktalus |
Priority: | NOR | ||
Version: | unspecified | ||
Target Milestone: | --- | ||
Platform: | Unlisted Binaries | ||
OS: | Linux | ||
Latest Commit: | Version Fixed In: | ||
Sentry Crash Report: | |||
Attachments: | The testcase |
Description
Thiago Macieira
2009-05-12 00:01:56 UTC
More info: this backtrace relates to r965162, but it can be reproduced with current trunk (r966801). The backtrace looks very similar to the one in bug 191027 and related to the one in bug 192105. Here using: Qt: 4.5.1 (qt-copy 960517) KDE: 4.2.71 (KDE 4.2.71 (KDE 4.3 >= 20090428)) kdelibs svn rev. 963904 / kdebase svn rev. 963904 on ArchLinux i686 - Kernel 2.6.29.1 So it may be a regression or there is something else related to this Thanks Arena less VG trace --- I am feeling like I've made the exact same one before, though: ==19417== Invalid read of size 1 ==19417== at 0xBE7EB50: khtml::InlineFlowBox::removeFromLine(khtml::InlineBox*) (render_line.cpp:223) ==19417== by 0xBE7EC27: khtml::InlineBox::remove() (render_line.cpp:76) ==19417== by 0xBE3640F: khtml::RenderText::detach() (render_text.cpp:722) ==19417== by 0xBD57B5B: DOM::NodeImpl::detach() (dom_nodeimpl.cpp:971) ==19417== by 0xBD57BC4: DOM::NodeBaseImpl::detach() (dom_nodeimpl.cpp:1832) ==19417== by 0xBD66F71: DOM::ElementImpl::detach() (dom_elementimpl.cpp:862) ==19417== by 0xBD66BD2: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:936) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD45419: DOM::DocumentImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_docimpl.cpp:1448) ==19417== by 0xBD3ECA8: DOM::DocumentImpl::updateRendering() (dom_docimpl.cpp:1477) ==19417== by 0xBD45005: DOM::DocumentImpl::updateDocumentsRendering() (dom_docimpl.cpp:1490) ==19417== by 0xBF542EB: KJS::Window::afterScriptExecution() (kjs_window.cpp:1292) ==19417== by 0xBF7F5AA: KJS::JSEventListener::handleEvent(DOM::Event&) (kjs_events.cpp:119) ==19417== by 0xBD5BADB: DOM::NodeImpl::handleLocalEvents(DOM::EventImpl*, bool) (dom_nodeimpl.cpp:714) ==19417== by 0xBD5D366: DOM::NodeImpl::dispatchGenericEvent(DOM::EventImpl*, int&) (dom_nodeimpl.cpp:499) ==19417== by 0xBD5D6B6: DOM::NodeImpl::dispatchWindowEvent(int, bool, bool) (dom_nodeimpl.cpp:564) ==19417== by 0xBCF1674: KHTMLPart::slotFinishedParsing() (khtml_part.cpp:2200) ==19417== by 0xBCFBBB6: KHTMLPart::qt_metacall(QMetaObject::Call, int, void**) (khtml_part.moc:267) ==19417== by 0x4FA3C41: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3019) ==19417== by 0x4FA4221: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3092) ==19417== by 0xBD3F6A6: DOM::DocumentImpl::finishedParsing() (dom_docimpl.moc:77) ==19417== by 0xBD3F704: DOM::DocumentImpl::qt_metacall(QMetaObject::Call, int, void**) (dom_docimpl.moc:67) ==19417== by 0xBDB3299: DOM::HTMLDocumentImpl::qt_metacall(QMetaObject::Call, int, void**) (html_documentimpl.moc:62) ==19417== by 0x4FA3C41: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3019) ==19417== by 0x4FA4221: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3092) ==19417== by 0xBD79426: khtml::Tokenizer::finishedParsing() (xml_tokenizer.moc:75) ==19417== Address 0x6cc3630 is 32 bytes inside a block of size 68 free'd ==19417== at 0x4024B4A: free (vg_replace_malloc.c:323) ==19417== by 0xBE38E35: khtml::RenderArena::free(unsigned, void*) (render_arena.cpp:122) ==19417== by 0xBE7EF86: khtml::InlineBox::detach(khtml::RenderArena*, bool) (render_line.cpp:92) ==19417== by 0xBE31F0C: khtml::RenderFlow::deleteInlineBoxes(khtml::RenderArena*) (render_flow.cpp:185) ==19417== by 0xBE31E8A: khtml::RenderFlow::detach() (render_flow.cpp:360) ==19417== by 0xBE02E3A: khtml::RenderBlock::removeChild(khtml::RenderObject*) (render_block.cpp:675) ==19417== by 0xBE21B7B: khtml::RenderObject::remove() (render_object.h:847) ==19417== by 0xBE179D5: khtml::RenderObject::detach() (render_object.cpp:2365) ==19417== by 0xBE2F5CA: khtml::RenderBox::detach() (render_box.cpp:224) ==19417== by 0xBE31E92: khtml::RenderFlow::detach() (render_flow.cpp:362) ==19417== by 0xBD57B5B: DOM::NodeImpl::detach() (dom_nodeimpl.cpp:971) ==19417== by 0xBD57BDA: DOM::NodeBaseImpl::detach() (dom_nodeimpl.cpp:1834) ==19417== by 0xBD66F71: DOM::ElementImpl::detach() (dom_elementimpl.cpp:862) ==19417== by 0xBD57BC4: DOM::NodeBaseImpl::detach() (dom_nodeimpl.cpp:1832) ==19417== by 0xBD66F71: DOM::ElementImpl::detach() (dom_elementimpl.cpp:862) ==19417== by 0xBD66BD2: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:936) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD66CD6: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:967) ==19417== by 0xBDB0018: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:270) ==19417== by 0xBD45419: DOM::DocumentImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_docimpl.cpp:1448) ==19417== by 0xBD3ECA8: DOM::DocumentImpl::updateRendering() (dom_docimpl.cpp:1477) ==19417== by 0xBD45005: DOM::DocumentImpl::updateDocumentsRendering() (dom_docimpl.cpp:1490) ==19417== by 0xBF542EB: KJS::Window::afterScriptExecution() (kjs_window.cpp:1292) ==19417== by 0xBF7F5AA: KJS::JSEventListener::handleEvent(DOM::Event&) (kjs_events.cpp:119) ==19417== by 0xBD5BADB: DOM::NodeImpl::handleLocalEvents(DOM::EventImpl*, bool) (dom_nodeimpl.cpp:714) ==19417== by 0xBD5D366: DOM::NodeImpl::dispatchGenericEvent(DOM::EventImpl*, int&) (dom_nodeimpl.cpp:499) ==19417== by 0xBD5D6B6: DOM::NodeImpl::dispatchWindowEvent(int, bool, bool) (dom_nodeimpl.cpp:564) ==19417== by 0xBCF1674: KHTMLPart::slotFinishedParsing() (khtml_part.cpp:2200) There is a similar one on https://bugs.kde.org/show_bug.cgi?id=191027#c6 Got this almost reduced... Hopefully testcase coming up soon. OK, reading version of the testcase... This needs to be run in VG to trigger the crash; and I am not sure why it wants the two external scripts... But this should be short enough for mental analysis: main.html: ================= <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <style> .container-inline div,.container-inline label{display:inline;} .form-item label {display:block;font-weight:bold;} .compact-form-wrapper{position:relative;} </style> <script type="text/javascript" src="work.js"></script> </head> <body> <form> <div id="search" class="container-inline"> <div class="form-item"> <label for="edit-search-theme-form-1">Search this site:</label> <input type="text"> </div><input type="submit"> </div> </form><script type="text/javascript" src="semicolon.js"> </script> </body> </html> work.js: =============== /* The fragment below is reconstructed from code originally tagged as: $Id: compact_forms.js,v 1.1 2007/07/29 17:20:58 tomsun Exp $ Compact Forms jQuery plugin */ document.onload = compactForm; function compactForm(stars, colons) { var label = document.getElementsByTagName("label")[0]; label.parentNode.className += " compact-form-wrapper"; } semicolon.js: ================= ; Created attachment 33773 [details]
The testcase
All tar'd up.
SVN commit 971542 by vtokarev: Invalidate and delete line box subtree of the flow when taking out inline flow objectf rom the rendering tree. We may insert it somewhere afterwards but still would need to recalculate inline boxes for it. In theory, we should now better support rendering tree modifications which was triggered lately by better continuation merge. Thanks to Maks and Germain for the assistance! BUG:192380 BUG:190350 BUG:191027 BUG:192105 M +31 -0 render_container.cpp WebSVN link: http://websvn.kde.org/?view=rev&revision=971542 *** Bug 195018 has been marked as a duplicate of this bug. *** *** Bug 182524 has been marked as a duplicate of this bug. *** *** Bug 170764 has been marked as a duplicate of this bug. *** |