Bug 222584

Summary: Plasma crashes due to picture frame plasmoid
Product: [Unmaintained] plasma4 Reporter: Ctibor Brančík <ctibor.brancik>
Component: widget-frameAssignee: Anne-Marie Mahfouf <annma>
Status: RESOLVED UPSTREAM    
Severity: crash CC: andresbajotierra, caionnew
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: Compiled Sources   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description Ctibor Brančík 2010-01-13 21:32:04 UTC 
Version:            (using Devel)
Compiler:          GCC 4.3.4 
OS:                Linux
Installed from:    Compiled sources

How to reproduce: Suppose you have a html link like this: <a><img /></a>. When you try to drag it on picture frame plasmoid, plasma crashes and restarts itself. I have tried two different links with the very same result.

Expected result: Picture frame should display image from the src parameter of <img> tag or display warning, that the document is not an image. It should not crash at all.

I use KDE SC 4.3.90.
Comment 1 disabled account 2010-01-14 03:01:19 UTC 
Tried it here, works as expected.
Using KDE SC 4.3.90.
Comment 2 Anne-Marie Mahfouf 2010-01-14 13:56:26 UTC 
Ctibor please paste a backtrace (hopefully you have debug packages installed) from the crash as I cannot reproduce in 4.4 branch. Dragging a picture from a webpage to the widget works here. Maybe you have a specific URL as well to add so I can look closer. Thanks in advance.
Comment 3 Ctibor Brančík 2010-01-14 17:00:42 UTC 
Here it goes:

Application: Pracovní plocha Plasma (plasma-desktop), signal: Segmentation fault
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib64/libgobject-2.0.so.0.2200.2-gdb.py", line 9, in <module>
    from gobject import register
  File "/usr/share/glib-2.0/gdb/gobject.py", line 3, in <module>
    import gdb.backtrace
ImportError: No module named backtrace
The current source language is "auto; currently c".
[Current thread is 1 (Thread 0x7ffff7fa7760 (LWP 14154))]

Thread 7 (Thread 0x7fffd6169910 (LWP 14216)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:261
#1  0x00007ffff4909c19 in QWaitConditionPrivate::wait (this=0xf2d700, mutex=0xf2d6f8, time=18446744073709551615) at thread/qwaitcondition_unix.cpp:87
#2  QWaitCondition::wait (this=0xf2d700, mutex=0xf2d6f8, time=18446744073709551615) at thread/qwaitcondition_unix.cpp:159
#3  0x00007ffff5d2f474 in QHostInfoAgent::run (this=0xf2d6e0) at kernel/qhostinfo.cpp:252
#4  0x00007ffff4908d95 in QThreadPrivate::start (arg=0xf2d6e0) at thread/qthread_unix.cpp:244
#5  0x00007ffff467a2b7 in start_thread (arg=<value optimized out>) at pthread_create.c:297
#6  0x00007ffff18688cd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#7  0x0000000000000000 in ?? ()

Thread 6 (Thread 0x7fffd274e910 (LWP 14263)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:261
#1  0x00007ffff74196e6 in WTF::TCMalloc_PageHeap::scavengerThread (this=0x7ffff76de1c0) at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:2304
#2  0x00007ffff7419709 in WTF::TCMalloc_PageHeap::runScavengerThread (context=0x7ffff76ec28c) at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:1438
#3  0x00007ffff467a2b7 in start_thread (arg=<value optimized out>) at pthread_create.c:297
#4  0x00007ffff18688cd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#5  0x0000000000000000 in ?? ()
The current source language is "auto; currently asm".

Thread 5 (Thread 0x7fffc4dca910 (LWP 14322)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:220
#1  0x00007ffff4909bf7 in QWaitConditionPrivate::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:85
#2  QWaitCondition::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:159
#3  0x00007ffff48fefe9 in QThreadPoolThread::run (this=0x154c4a0) at concurrent/qthreadpool.cpp:140
#4  0x00007ffff4908d95 in QThreadPrivate::start (arg=0x154c4a0) at thread/qthread_unix.cpp:244
#5  0x00007ffff467a2b7 in start_thread (arg=<value optimized out>) at pthread_create.c:297
#6  0x00007ffff18688cd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#7  0x0000000000000000 in ?? ()

Thread 4 (Thread 0x7fffc43c3910 (LWP 14323)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:220
#1  0x00007ffff4909bf7 in QWaitConditionPrivate::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:85
#2  QWaitCondition::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:159
#3  0x00007ffff48fefe9 in QThreadPoolThread::run (this=0x1490d80) at concurrent/qthreadpool.cpp:140
#4  0x00007ffff4908d95 in QThreadPrivate::start (arg=0x1490d80) at thread/qthread_unix.cpp:244
#5  0x00007ffff467a2b7 in start_thread (arg=<value optimized out>) at pthread_create.c:297
#6  0x00007ffff18688cd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#7  0x0000000000000000 in ?? ()

Thread 3 (Thread 0x7fffc3bc2910 (LWP 14324)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:220
#1  0x00007ffff4909bf7 in QWaitConditionPrivate::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:85
#2  QWaitCondition::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:159
#3  0x00007ffff48fefe9 in QThreadPoolThread::run (this=0x13df640) at concurrent/qthreadpool.cpp:140
#4  0x00007ffff4908d95 in QThreadPrivate::start (arg=0x13df640) at thread/qthread_unix.cpp:244
#5  0x00007ffff467a2b7 in start_thread (arg=<value optimized out>) at pthread_create.c:297
#6  0x00007ffff18688cd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#7  0x0000000000000000 in ?? ()

Thread 2 (Thread 0x7fffc33c1910 (LWP 14325)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:220
#1  0x00007ffff4909bf7 in QWaitConditionPrivate::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:85
#2  QWaitCondition::wait (this=0x147cb18, mutex=0x147cb10, time=30000) at thread/qwaitcondition_unix.cpp:159
#3  0x00007ffff48fefe9 in QThreadPoolThread::run (this=0x11072e0) at concurrent/qthreadpool.cpp:140
#4  0x00007ffff4908d95 in QThreadPrivate::start (arg=0x11072e0) at thread/qthread_unix.cpp:244
#5  0x00007ffff467a2b7 in start_thread (arg=<value optimized out>) at pthread_create.c:297
#6  0x00007ffff18688cd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#7  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7ffff7fa7760 (LWP 14154)):
[KCrash Handler]
#5  QImageData::checkForAlphaPixels (this=0x0) at image/qimage.cpp:273
#6  0x00007ffff3b0f0f8 in QX11AlphaDetector::hasAlpha (this=0x1539a90, img=..., flags=...) at image/qpixmap_x11.cpp:385
#7  QX11AlphaDetector::hasXRenderAndAlpha (this=0x1539a90, img=..., flags=...) at image/qpixmap_x11.cpp:392
#8  QX11PixmapData::fromImage (this=0x1539a90, img=..., flags=...) at image/qpixmap_x11.cpp:443
#9  0x00007ffff3b03822 in QPixmapData::fromData (this=0x1539a90, buf=<value optimized out>, len=<value optimized out>, format=<value optimized out>, flags=...) at image/qpixmapdata.cpp:132
#10 0x00007ffff3afd44a in QPixmap::loadFromData (this=0x7fffffffc2a0, buf=
    0x16db068 "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n\n<html>\n<head>\n    <meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-2\">\n  <me"..., len=18478, format=0x0, flags=...) at image/qpixmap.cpp:872
#11 0x00007fffdc748eec in QPixmap::loadFromData (this=0x862390, job=0x1398970) at /usr/include/qt4/QtGui/qpixmap.h:303
#12 Picture::slotFinished (this=0x862390, job=0x1398970) at /var/tmp/portage/kde-base/kdeplasma-addons-4.3.90/work/kdeplasma-addons-4.3.90/applets/frame/picture.cpp:157
#13 0x00007fffdc749447 in Picture::qt_metacall (this=0x862390, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fffffffc5e0)
    at /var/tmp/portage/kde-base/kdeplasma-addons-4.3.90/work/kdeplasma-addons-4.3.90_build/applets/frame/picture.moc:78
#14 0x00007ffff4a0ecb7 in QMetaObject::activate (sender=0x1398970, m=<value optimized out>, local_signal_index=<value optimized out>, argv=0x7ffff44209e0) at kernel/qobject.cpp:3286
#15 0x00007ffff5077c0f in KJob::finished (this=0x0, _t1=0x1398970) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90_build/kdecore/kjob.moc:173
#16 0x00007ffff5077d45 in KJob::emitResult (this=0x1398970) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kdecore/jobs/kjob.cpp:310
#17 0x00007ffff60c85d0 in KIO::SimpleJob::slotFinished (this=0x1398970) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kio/kio/job.cpp:475
#18 0x00007ffff60c8a73 in KIO::TransferJob::slotFinished (this=0x1398970) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kio/kio/job.cpp:975
#19 0x00007ffff60c6075 in KIO::TransferJob::qt_metacall (this=0x1398970, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fffffffca10)
    at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90_build/kio/jobclasses.moc:367
#20 0x00007ffff60c62b8 in KIO::StoredTransferJob::qt_metacall (this=0x0, _c=1329, _id=-16128, _a=0x7ffff44209e0)
    at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90_build/kio/jobclasses.moc:477
#21 0x00007ffff4a0ecb7 in QMetaObject::activate (sender=0x149cef0, m=<value optimized out>, local_signal_index=<value optimized out>, argv=0x7ffff44209e0) at kernel/qobject.cpp:3286
#22 0x00007ffff6185c79 in KIO::SlaveInterface::dispatch (this=0x149cef0, _cmd=104, rawdata=<value optimized out>)
    at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kio/kio/slaveinterface.cpp:175
#23 0x00007ffff6183326 in KIO::SlaveInterface::dispatch (this=0x149cef0) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kio/kio/slaveinterface.cpp:91
#24 0x00007ffff61775b7 in KIO::Slave::gotInput (this=0x149cef0) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kio/kio/slave.cpp:324
#25 0x00007ffff6177760 in KIO::Slave::qt_metacall (this=0x149cef0, _c=QMetaObject::InvokeMetaMethod, _id=6551552, _a=0x7fffffffce30)
    at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90_build/kio/slave.moc:82
#26 0x00007ffff4a0ecb7 in QMetaObject::activate (sender=0x149eb50, m=<value optimized out>, local_signal_index=<value optimized out>, argv=0x7ffff44209e0) at kernel/qobject.cpp:3286
#27 0x00007ffff60965bf in KIO::ConnectionPrivate::dequeue (this=0x149e0a0) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kio/kio/connection.cpp:82
#28 0x00007ffff6096a32 in KIO::Connection::qt_metacall (this=0x149eb50, _c=QMetaObject::InvokeMetaMethod, _id=6551552, _a=0x1550450)
    at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90_build/kio/connection.moc:79
#29 0x00007ffff4a0b460 in QObject::event (this=0x149eb50, e=0xcf6a70) at kernel/qobject.cpp:1252
#30 0x00007ffff3a335d5 in QApplicationPrivate::notify_helper (this=0x63abb0, receiver=0x149eb50, e=0xcf6a70) at kernel/qapplication.cpp:4242
#31 0x00007ffff3a3bbdb in QApplication::notify (this=0x620ab0, receiver=0x149eb50, e=0xcf6a70) at kernel/qapplication.cpp:3661
#32 0x00007ffff564494a in KApplication::notify (this=0x620ab0, receiver=0x149eb50, event=0xcf6a70) at /var/tmp/portage/kde-base/kdelibs-4.3.90/work/kdelibs-4.3.90/kdeui/kernel/kapplication.cpp:302
#33 0x00007ffff49fb32b in QCoreApplication::notifyInternal (this=0x620ab0, receiver=0x149eb50, event=0xcf6a70) at kernel/qcoreapplication.cpp:704
#34 0x00007ffff49fc21b in QCoreApplication::sendEvent (receiver=0x0, event_type=0, data=0x608780) at kernel/qcoreapplication.h:215
#35 QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x608780) at kernel/qcoreapplication.cpp:1345
#36 0x00007ffff4a25253 in QCoreApplication::sendPostedEvents (s=<value optimized out>) at kernel/qcoreapplication.h:220
#37 postEventSourceDispatch (s=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:276
#38 0x00007ffff10deb89 in g_main_dispatch (context=0x63d120) at gmain.c:1960
#39 IA__g_main_context_dispatch (context=0x63d120) at gmain.c:2513
#40 0x00007ffff10e2228 in g_main_context_iterate (context=0x63d120, block=1, dispatch=1, self=<value optimized out>) at gmain.c:2591
#41 0x00007ffff10e23de in IA__g_main_context_iteration (context=0x63d120, may_block=1) at gmain.c:2654
#42 0x00007ffff4a24d9c in QEventDispatcherGlib::processEvents (this=0x607f40, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:407
#43 0x00007ffff3ad00a8 in QGuiEventDispatcherGlib::processEvents (this=0x0, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:202
#44 0x00007ffff49f9c32 in QEventLoop::processEvents (this=<value optimized out>, flags=...) at kernel/qeventloop.cpp:149
#45 0x00007ffff49f9ff4 in QEventLoop::exec (this=0x7fffffffd900, flags=...) at kernel/qeventloop.cpp:201
#46 0x00007ffff49fc486 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:981
#47 0x00007ffff7bb271a in kdemain (argc=1, argv=0x7fffffffdc88) at /var/tmp/portage/kde-base/plasma-workspace-4.3.90/work/plasma-workspace-4.3.90/plasma/desktop/shell/main.cpp:112
#48 0x00007ffff17b6a26 in __libc_start_main (main=0x400a80 <main>, argc=1, ubp_av=0x7fffffffdc88, init=0x400ac0 <__libc_csu_init>, fini=<value optimized out>, rtld_fini=<value optimized out>, 
    stack_end=0x7fffffffdc78) at libc-start.c:220
#49 0x0000000000400989 in _start ()
The current source language is "auto; currently c".
Comment 4 Ctibor Brančík 2010-01-14 17:09:18 UTC 
Tried it with the header on http://forums.gentoo.org. Also with the image of the sun on http://www.astro.cz on the left side of the page. And finaly the header image on http://dot.kde.org makes plasma crash too. I drag it to the widget which is already on  the desktop, but not with any image loaded into it.
Comment 5 Anne-Marie Mahfouf 2010-01-14 19:43:03 UTC 
OK I see the problem now. From the terminal debug messages given by the applet I can see that it does not get the picture itself. For example, on the Dot page, if I drag the multimedia icon which illustrates the Amarok article I get as debug:
[branch@localhost khangman]$ plasma-desktop(23665) Frame::dropEvent: dropped URL "http://dot.kde.org/category/dot-catgories/multimedia" 
plasma-desktop(23665) Frame::dropEvent: Remote URL "http://dot.kde.org/category/dot-catgories/multimedia"                               
plasma-desktop(23665) SlideShow::image: reloading from Picture KUrl("http://dot.kde.org/category/dot-catgories/multimedia")             
plasma-desktop(23665) Picture::setPicture: KUrl("http://dot.kde.org/category/dot-catgories/multimedia")

It tried to load http://dot.kde.org/category/dot-catgories/multimedia while the pic URL is
http://dot.kde.org/sites/dot.kde.org/files/category_pictures/applications-multimedia.png

The bug is therefore not in the Picture Frame but somewhere else as if you drag and drop these same pics in any KDE apps they are not recognized as pics (drag them in Dolphin or GWenView). What do you think?
Comment 6 Anne-Marie Mahfouf 2010-01-14 20:09:00 UTC 
I forgot to add that however the Picture Frame applet should not crash when it's given something that is not a picture and I'll fix that.
Comment 7 Ctibor Brančík 2010-01-14 20:15:55 UTC 
I agree. Wanted to answer with the exact same words :-)
Comment 8 Ctibor Brančík 2010-01-14 20:22:02 UTC 
And as a note. You are dragging the link (<a> tag) actually so there's no wonder, it is not recognized as picture. My proposal to detect the src= parameter of <image> is probably not practical. But I am not sure.
Comment 9 Dario Andres 2010-01-15 02:11:16 UTC 
...
#5  QImageData::checkForAlphaPixels (this=0x0) at image/qimage.cpp:273

This is a Qt4.6.0 bug, crashing when invalid input data(in this case, HTML code) is passed to QPixmap. Fixed in Qt4.6.1:
http://bugreports.qt.nokia.com/browse/QTBUG-5840

@Annma: do you want to keep this bug report opened or I should closed as UPSTREAM ?
Thanks!
Comment 10 Ctibor Brančík 2010-01-15 11:20:49 UTC 
You can close it. I will update to Qt 4.6.1 as soon as it gets to portage. Thanks.
Comment 11 Anne-Marie Mahfouf 2010-01-24 21:04:18 UTC 
Indeed it's fixed with Qt 4.6.1