Bug 200181

The backtrace looks related to bug 184604 (which only happens in filebrowsing mode). Can you reproduce the crash at will using that two webpageS?
Thanks

The reporter sent me an email:
---------

Yes, I try reproduce this bug. When I now open this webpages in different tabs
so this bug not find. I dont know where is problem. :(

-------

The other report said that you had to have the mouse cursor over some file, so I'm wondering if in this case you would need to have the mouse cursor over some specific text/link/image/element.

*** Bug 203690 has been marked as a duplicate of this bug. ***

Are you sure this bug didn't happen when you closed one of the tabs? At least that's what the crash report suggests.

*** Bug 206561 has been marked as a duplicate of this bug. ***

Bug 206561 provides a new testcase, can you check it ? Thanks

From the bt: yes the mouse needs to be over a link at the time the tab is closed.

I initially thought I saw the problem, but there are in fact two KHTMLParts involved in this backtrace - the one is being deleted, and the one which gets the "mouse over url" event. I don't know if the mouse has to be over a url in the first or in the second khtml part.

If someone can reproduceably get the crash, a valgrind log would be very useful.

Additional information:
--------------

** (attempt of) Testcase steps:

Run directly on Valgrind as the slowdown will help us to reproduce the crash

- Start Konqueror
(it opens an empty/home/intro tab)  (I have the introduction page as default)
- Create a new blank tab
The new tab is focused/active
- Start loading the URL: http://www.pcinpact.com/affichage/52354-kde-43-nouveautes-version-finale/74209.htm
DO NOT WAIT FOR IT TO BE LOADED, CONTINUE INMEDIATLY
- Open the Terminal emulator (Settings/Show terminal panel)
- Write "exit" in the terminal, DO NOT press enter yet
- Wait until the page loads 50% (the first texts starts appearing, but the image in the middle is not there yet)
- Hover one of the links in the bottom of the page, DO NOT CLICK IT ( I used the "Personnaliser Windows", the second link in the middle line of the footer)
(The terminal panel still has keyboard focus)
- Press enter
- Konqueror should crash (if not, repeat or restart Konqueror)

If you wait until the page is completely loaded it may not work. 
Valgrind should help us with this as it slowdowns everything.

** Valgrind log:

==12906==                                                                                                                     
==12906== Invalid read of size 4                                                                                              
==12906==    at 0x4DD5930: QObject::d_func() (qobject.h:118)                                                                  
==12906==    by 0x4EE6185: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:593)                     
==12906==    by 0x40BF29D: KonqMainWindow::event(QEvent*) (qcoreapplication.h:213)                                            
==12906==    by 0x51BD2DA: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4056)                      
==12906==    by 0x51BD135: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4021)                                    
==12906==    by 0x47F4CB9: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)                                     
==12906==    by 0x4EE61C0: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:610)                     
==12906==    by 0x405CCE6: KonqView::slotMouseOverInfo(KFileItem const&) (qcoreapplication.h:213)                             
==12906==    by 0x40621D8: KonqView::qt_metacall(QMetaObject::Call, int, void**) (konqview.moc:127)                           
==12906==    by 0x4EFF9C9: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3112)                               
==12906==    by 0x4EFFD41: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3186)                
==12906==    by 0x41D2B02: KParts::BrowserExtension::mouseOverInfo(KFileItem const&) (browserextension.moc:377)               
==12906==    by 0x9D8991E: KHTMLPart::resetHoverText() (khtml_part.cpp:3506)                                                  
==12906==    by 0x9D7011D: KHTMLView::eventFilter(QObject*, QEvent*) (khtmlview.cpp:2186)                                     
==12906==    by 0x4EE649E: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:726)                                                                                                                             
==12906==    by 0x51BD2B6: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4052)                      
==12906==    by 0x51BD135: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4021)                                    
==12906==    by 0x47F4CB9: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)                                     
==12906==    by 0x4EE61C0: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:610)                     
==12906==    by 0x4EE9B86: QCoreApplication::sendEvent(QObject*, QEvent*) (qcoreapplication.h:213)                            
==12906==    by 0x51B94E3: QApplicationPrivate::dispatchEnterLeave(QWidget*, QWidget*) (qapplication.cpp:2584)                
==12906==    by 0x51BA72A: QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&) (qapplication.cpp:2908)                                                                                           
==12906==    by 0x51BACD4: QApplicationPrivate::sendSyntheticEnterLeave(QWidget*) (qapplication.cpp:3006)                     
==12906==    by 0x521C92A: QWidgetPrivate::hideChildren(bool) (qwidget.cpp:7093)                                              
==12906==    by 0x521C88E: QWidgetPrivate::hideChildren(bool) (qwidget.cpp:7079)                                              
==12906==    by 0x521C88E: QWidgetPrivate::hideChildren(bool) (qwidget.cpp:7079)                                              
==12906==    by 0x521C88E: QWidgetPrivate::hideChildren(bool) (qwidget.cpp:7079)                                              
==12906==    by 0x521C88E: QWidgetPrivate::hideChildren(bool) (qwidget.cpp:7079)                                              
==12906==    by 0x521C88E: QWidgetPrivate::hideChildren(bool) (qwidget.cpp:7079)                                              
==12906==    by 0x521C88E: QWidgetPrivate::hideChildren(bool) (qwidget.cpp:7079)                                              
==12906==    by 0x521BCA6: QWidgetPrivate::hide_helper() (qwidget.cpp:6843)                                                   
==12906==    by 0x521C450: QWidget::setVisible(bool) (qwidget.cpp:7012)                                                       
==12906==    by 0x51FDCAD: QWidget::hide() (qwidget.h:477)                                                                    
==12906==    by 0x521FD79: QWidget::setParent(QWidget*, QFlags<Qt::WindowType>) (qwidget.cpp:9204)                            
==12906==    by 0x521FBB5: QWidget::setParent(QWidget*) (qwidget.cpp:9172)                                                    
==12906==    by 0x409790A: KonqMainWindow::insertChildFrame(KonqFrameBase*, int) (konqmainwindow.cpp:5498)                    
==12906==    by 0x407736F: KonqFrameContainerBase::replaceChildFrame(KonqFrameBase*, KonqFrameBase*) (konqframecontainer.cpp:32)                                                                                                                            
==12906==    by 0x4069746: KonqViewManager::removeView(KonqView*) (konqviewmanager.cpp:562)                                   
==12906==    by 0x4069C62: KonqViewManager::slotPassiveModePartDeleted() (konqviewmanager.cpp:644)                            
==12906==    by 0x4070672: KonqViewManager::qt_metacall(QMetaObject::Call, int, void**) (konqviewmanager.moc:93)              
==12906==    by 0x4EFF9C9: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3112)                               
==12906==    by 0x4EFFE0C: QMetaObject::activate(QObject*, QMetaObject const*, int, int, void**) (qobject.cpp:3206)           
==12906==    by 0x4F012E7: QObject::destroyed(QObject*) (moc_qobject.cpp:143)                                                 
==12906==    by 0x4EFA8A9: QObject::~QObject() (qobject.cpp:757)                                                              
==12906==    by 0x41C887E: KParts::Part::~Part() (part.cpp:212)                                                               
==12906==    by 0x41C8F59: KParts::ReadOnlyPart::~ReadOnlyPart() (part.cpp:459)                                               
==12906==    by 0xE28041F: Konsole::Part::~Part() (Part.cpp:114)                                                              
==12906==    by 0x4F00F9D: qDeleteInEventHandler(QObject*) (qobject.cpp:3814)                                                 
==12906==    by 0x4EFBC27: QObject::event(QEvent*) (qobject.cpp:1093)                                                         
==12906==    by 0x51BD2DA: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4056)
==12906==  Address 0x4 is not stack'd, malloc'd or (recently) free'd
KCrash: Application 'konqueror' crashing...
sock_file=/home/kde-devel/.kde4/socket-emiDell/kdeinit4__0

[1]+  Detenido                valgrind --num-callers=50 konqueror
bash-4.0$ ==12906==
==12906== ERROR SUMMARY: 36 errors from 3 contexts (suppressed: 407 from 3)
==12906== malloc/free: in use at exit: 26,308,419 bytes in 160,425 blocks.
==12906== malloc/free: 1,047,686 allocs, 887,261 frees, 218,676,312 bytes allocated.
==12906== For counts of detected errors, rerun with: -v
==12906== searching for pointers to 160,425 not-freed blocks.
==12906== checked 66,205,304 bytes.
==12906==
==12906== LEAK SUMMARY:
==12906==    definitely lost: 49,536 bytes in 2,049 blocks.
==12906==      possibly lost: 218,062 bytes in 5,217 blocks.
==12906==    still reachable: 26,040,821 bytes in 153,159 blocks.
==12906==         suppressed: 0 bytes in 0 blocks.
==12906== Rerun with --leak-check=full to see details of leaked memory.

The patch proposed at http://pastebin.com/d4f11121a seems to be fix the testcase I added (only tested once, valgrind is slow. I'm going to recheck later). It also seems to fix the DolphinPart crash

--- apps/konqueror/src/konqmainwindow.cpp    (revision 1019778)
+++ apps/konqueror/src/konqmainwindow.cpp    (working copy)
 -5635,8 +5635,11 @@ bool KonqMainWindow::event( QEvent* e )
         // Forward the event to all views
         MapViews::ConstIterator it = m_mapViews.constBegin();
         MapViews::ConstIterator end = m_mapViews.constEnd();
-        for (; it != end; ++it )
-            QApplication::sendEvent( (*it)->part(), e );
+        for (; it != end; ++it ) {
+            if ((*it)->part() != 0L) {
+                QApplication::sendEvent( (*it)->part(), e );
+            }
+        }
         return true;
     }
     if ( KParts::OpenUrlEvent::test( e ) )

SVN commit 1021167 by dfaure:

Remove part from m_mapViews before actually deleting it (which can lead to a
mouse-over-url event which is then sent to all views in the map).
Many thanks to lemma for the analysis of the problem.
BUGS: 200181, 184604


 M  +5 -4      konqviewmanager.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1021167

*** Bug 207724 has been marked as a duplicate of this bug. ***

*** Bug 208987 has been marked as a duplicate of this bug. ***

*** Bug 210634 has been marked as a duplicate of this bug. ***

*** Bug 184604 has been marked as a duplicate of this bug. ***

*** Bug 211349 has been marked as a duplicate of this bug. ***