| Summary: | Akregator crashes when viewing pop-up image from a website | ||
|---|---|---|---|
| Product: | [Applications] konqueror | Reporter: | jimpenn |
| Component: | khtml | Assignee: | Konqueror Developers <konq-bugs> |
| Status: | RESOLVED WORKSFORME | ||
| Severity: | crash | CC: | david.heijkamp, justin.zobel, maksim |
| Priority: | NOR | ||
| Version: | 4.4.2 | ||
| Target Milestone: | --- | ||
| Platform: | Ubuntu | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
|
Description
jimpenn
2010-08-13 18:24:47 UTC
==19117== Invalid read of size 4 ==19117== at 0xED51F5B: khtml::RenderLayer::paintLayer(khtml::RenderLayer*, QPainter*, QRect const&, bool) (render_layer.cpp:1035) ==19117== by 0xED526FD: khtml::RenderLayer::paintLayer(khtml::RenderLayer*, QPainter*, QRect const&, bool) (render_layer.cpp:1134) ==19117== by 0xED526FD: khtml::RenderLayer::paintLayer(khtml::RenderLayer*, QPainter*, QRect const&, bool) (render_layer.cpp:1134) ==19117== by 0xED51C63: khtml::RenderLayer::paint(QPainter*, QRect const&, bool) (render_layer.cpp:1001) ==19117== by 0xEF411B0: KHTMLView::paintEvent(QPaintEvent*) (khtmlview.cpp:930) ==19117== by 0x52ADF59: QWidget::event(QEvent*) (qwidget.cpp:8190) ==19117== by 0x56A7764: QFrame::event(QEvent*) (qframe.cpp:557) ==19117== by 0xEF482B4: KHTMLView::widgetEvent(QEvent*) (khtmlview.cpp:2363) ==19117== by 0xEF47CAD: KHTMLView::eventFilter(QObject*, QEvent*) (khtmlview.cpp:2208) ==19117== by 0x4F6AFA5: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:841) ==19117== by 0x5254C33: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4298) ==19117== by 0x525CCA3: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4267) ==19117== by 0x498414B: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302) ==19117== by 0x4F6AE0D: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:726) ==19117== by 0x52A8C81: QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) (qcoreapplication.h:218) ==19117== by 0x54869F6: QWidgetBackingStore::sync() (qbackingstore.cpp:1292) ==19117== by 0x529E6FA: QWidgetPrivate::syncBackingStore() (qwidget.cpp:1688) ==19117== by 0x52AEA15: QWidget::event(QEvent*) (qwidget.cpp:8337) ==19117== by 0x56C420B: QMainWindow::event(QEvent*) (qmainwindow.cpp:1414) ==19117== by 0x4A6805D: KMainWindow::event(QEvent*) (kmainwindow.cpp:1100) ==19117== by 0x4AA575C: KXmlGuiWindow::event(QEvent*) (kxmlguiwindow.cpp:130) ==19117== by 0x40B7278: KonqMainWindow::event(QEvent*) (konqmainwindow.cpp:5583) ==19117== by 0x5254C63: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4302) ==19117== by 0x525CCA3: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4267) ==19117== by 0x498414B: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302) ==19117== by 0x4F6AE0D: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:726) ==19117== by 0x5483321: QWidgetBackingStore::markDirty(QRect const&, QWidget*, bool, bool) (qcoreapplication.h:215) ==19117== by 0x529FEC1: QWidget::repaint(QRect const&) (qwidget.cpp:10080) ==19117== by 0x529FF6F: QWidget::repaint(int, int, int, int) (qwidget.cpp:10057) ==19117== by 0xEF4072F: KHTMLView::repaintContents(int, int, int, int) (khtmlview.cpp:812) ==19117== by 0xEF40791: KHTMLView::repaintContents(QRect const&) (khtmlview.cpp:817) ==19117== by 0xEF5257A: KHTMLView::timerEvent(QTimerEvent*) (khtmlview.cpp:4214) ==19117== by 0x4F7D773: QObject::event(QEvent*) (qobject.cpp:1212) ==19117== by 0x52ADACB: QWidget::event(QEvent*) (qwidget.cpp:8501) ==19117== by 0x56A7764: QFrame::event(QEvent*) (qframe.cpp:557) ==19117== by 0x5737C0B: QAbstractScrollArea::event(QEvent*) (qabstractscrollarea.cpp:989) ==19117== by 0x573B41E: QScrollArea::event(QEvent*) (qscrollarea.cpp:314) ==19117== by 0xEF3F723: KHTMLView::event(QEvent*) (khtmlview.cpp:551) ==19117== by 0x5254C63: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4302) ==19117== by 0x525CCA3: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4267) ==19117== by 0x498414B: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302) ==19117== by 0x4F6AE0D: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:726) ==19117== by 0x4F9970D: QTimerInfoList::activateTimers() (qcoreapplication.h:215) ==19117== by 0x4F96641: timerSourceDispatch(_GSource*, int (*)(void*), void*) (qeventdispatcher_glib.cpp:184) ==19117== by 0x636AB48: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.2400.1) ==19117== by 0x636B34F: ??? (in /usr/lib/libglib-2.0.so.0.2400.1) ==19117== by 0x636B60D: g_main_context_iteration (in /usr/lib/libglib-2.0.so.0.2400.1) ==19117== by 0x4F96D4A: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:412) ==19117== by 0x5305199: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204) ==19117== by 0x4F6A11C: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149) ==19117== Address 0x14d0abf8 is 8 bytes inside a block of size 120 free'd ==19117== at 0x4027996: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==19117== by 0xED4E4A1: khtml::RenderArena::free(unsigned int, void*) (render_arena.cpp:122) ==19117== by 0xED502E2: khtml::RenderLayer::detach(khtml::RenderArena*) (render_layer.cpp:512) ==19117== by 0xED3B66E: khtml::RenderBox::detach() (render_box.cpp:226) ==19117== by 0xED46467: khtml::RenderFlow::detach() (render_flow.cpp:361) ==19117== by 0xEC8DE67: DOM::NodeImpl::detach() (dom_nodeimpl.cpp:901) ==19117== by 0xEC909B6: DOM::NodeBaseImpl::detach() (dom_nodeimpl.cpp:1891) ==19117== by 0xEC9B319: DOM::ElementImpl::detach() (dom_elementimpl.cpp:913) ==19117== by 0xEC9B683: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:987) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC9B7C1: DOM::ElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_elementimpl.cpp:1018) ==19117== by 0xECD1143: DOM::HTMLElementImpl::recalcStyle(DOM::NodeImpl::StyleChange) (html_elementimpl.cpp:235) ==19117== by 0xEC7C529: DOM::DocumentImpl::recalcStyle(DOM::NodeImpl::StyleChange) (dom_docimpl.cpp:1439) ==19117== by 0xEC7C694: DOM::DocumentImpl::updateRendering() (dom_docimpl.cpp:1468) ==19117== by 0xEE8F0DB: DOM::Document::updateRendering() (dom_doc.cpp:594) ==19117== by 0xEE3847F: KJS::ScheduledAction::execute(KJS::Window*) (kjs_window.cpp:2205) ==19117== by 0xEE39054: KJS::WindowQObject::timerEvent(QTimerEvent*) (kjs_window.cpp:2376) ==19117== by 0x4F7D773: QObject::event(QEvent*) (qobject.cpp:1212) ==19117== by 0x5254C63: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4302) ==19117== by 0x525CBF6: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3706) ==19117== by 0x498414B: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302) ==19117== by 0x4F6AE0D: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:726) ==19117== by 0x4F9970D: QTimerInfoList::activateTimers() (qcoreapplication.h:215) ==19117== by 0x4F96641: timerSourceDispatch(_GSource*, int (*)(void*), void*) (qeventdispatcher_glib.cpp:184) ==19117== by 0x636AB48: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.2400.1) ==19117== by 0x636B34F: ??? (in /usr/lib/libglib-2.0.so.0.2400.1) ==19117== by 0x636B60D: g_main_context_iteration (in /usr/lib/libglib-2.0.so.0.2400.1) ==19117== by 0x4F96D4A: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:412) ==19117== by 0x5305199: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204) ==19117== by 0x4F6A11C: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149) ==19117== by 0x4F6A318: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:201) ==19117== by 0x4F6EC6F: QCoreApplication::exec() (qcoreapplication.cpp:1003) ==19117== This problem still occurs in Konqueror 4.5.4 / Fedora 14 using KHTML. It doesn't happen when I switch to the Webkit kpart. Seems to be the reverse of what was addressed in r1156769 --- we have an intermediate layer becoming a stacking context, and it needs to mark its parents' zlists dirty so that it will not hold on to references to kids its taken over. I have a fix for that, but a bug still remains, as popovers only show once... I suspect we're not putting stuff back into parents' list properly.. Git commit c03449c379ae904bfb3820bfa793fbc96dae1a6d by Maks Orlovich. Committed on 14/02/2011 at 02:00. Pushed by orlovich into branch 'master'. Properly dirty z-order lists when stacking contextedness changes. When a layer stops being one (z-index property removed or such) make sure we properly dirty the parent z-order list so that who is responsible for child layers gets recomputed. Fixes a crash on sciplus.com, though there is still a bug with hovers there. CCBUG: 247675 M +15 -4 khtml/rendering/render_layer.cpp M +2 -0 khtml/rendering/render_layer.h http://commits.kde.org/kdelibs/c03449c379ae904bfb3820bfa793fbc96dae1a6d Thank you for the report. As it has been a while since this was reported, can you please test and confirm if this issue is still occurring or if this bug report can be marked as resolved. I have set the bug status to "needsinfo" pending your response, please change back to "reported" or "resolved/worksforme" when you respond, thank you. Dear Bug Submitter, This bug has been in NEEDSINFO status with no change for at least 15 days. Please provide the requested information as soon as possible and set the bug status as REPORTED. Due to regular bug tracker maintenance, if the bug is still in NEEDSINFO status with no change in 30 days the bug will be closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging If you have already provided the requested information, please mark the bug as REPORTED so that the KDE team knows that the bug is ready to be confirmed. Thank you for helping us make KDE software even better for everyone! This bug has been in NEEDSINFO status with no change for at least 30 days. The bug is now closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging Thank you for helping us make KDE software even better for everyone! |