Bug 264403

Summary: [testcase] race condition: node's deletion (via .innerHTML = '') when changing focus into it always make crash
Product: [Applications] konqueror Reporter: Sergey Burladyan <eshkinkot>
Component: khtmlAssignee: Konqueror Developers <konq-bugs>
Status: RESOLVED UNMAINTAINED    
Severity: crash CC: aiacovitti, gatoso, joanluc.laborda, justin.zobel, markpatton, piratepenguin, shydoow
Priority: NOR Keywords: testcase
Version: 4.11.97   
Target Milestone: ---   
Platform: Debian stable   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:
Attachments: online testcase

Description Sergey Burladyan 2011-01-27 03:02:53 UTC 
Application: konqueror (4.4.5 (KDE 4.4.5))
KDE Platform Version: 4.4.5 (KDE 4.4.5)
Qt Version: 4.6.3
Operating System: Linux 2.6.32-5-amd64 x86_64
Distribution: Debian GNU/Linux 6.0 (squeeze)

-- Information about the crash:
Set focus into f1 field, then press Tab

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title></title>
  <script src="https://ajax.googleapis.com/ajax/libs/prototype/1.7.0.0/prototype.js" type="text/javascript"></script>
<script type="text/javascript" charset="utf-8">
//<![CDATA[
document.observe("dom:loaded", function() {
    Event.observe('f1', 'blur', function() {
	$('clean').innerHTML = '';
    });
});
//]]>
</script>
</head>
<body>
<form id="crash" action="">
<input type="text" id="f1"></input>
<div id="clean"><a href="link">focus link</a></div>
<input type="text" id="f2"></input>
<input type="submit"></input>
</form>
</body>
</html>


The crash can be reproduced every time.

 -- Backtrace:
Application: Konqueror (konqueror), signal: Segmentation fault
[KCrash Handler]
#5  DOM::DocumentImpl::view (this=0x3ff0000000000000) at ../../khtml/xml/dom_docimpl.cpp:2908
#6  0x00007f5502e2ddad in DOM::NodeImpl::dispatchEvent (this=0x22b7d20, evt=0x21aa860, exceptioncode=@0x7fff17fb28bc, tempEvent=true) at ../../khtml/xml/dom_nodeimpl.cpp:451
#7  0x00007f5502e2f64a in DOM::NodeImpl::dispatchHTMLEvent (this=0x22b7d20, _id=24, canBubbleArg=<value optimized out>, cancelableArg=<value optimized out>) at ../../khtml/xml/dom_nodeimpl.cpp:552
#8  0x00007f5502e199a1 in DOM::DocumentImpl::setFocusNode (this=0x3285a70, newFocusNode=0x22b7d20) at ../../khtml/xml/dom_docimpl.cpp:2492
#9  0x00007f5502d9dc94 in KHTMLView::focusNextPrevNode (this=0x18f0fc0, next=true) at ../../khtml/khtmlview.cpp:2623
#10 0x00007f5502d9e159 in KHTMLView::focusNextPrevChild (this=0x18f0fc0, next=<value optimized out>) at ../../khtml/khtmlview.cpp:2014
#11 0x00007f5502e94687 in focusNextPrev (this=0x3319960, evt=0x29b4880) at ../../khtml/html/html_formimpl.cpp:1029
#12 DOM::HTMLGenericFormElementImpl::defaultEventHandler (this=0x3319960, evt=0x29b4880) at ../../khtml/html/html_formimpl.cpp:1093
#13 0x00007f5502ea43c2 in DOM::HTMLInputElementImpl::defaultEventHandler (this=0x3319960, evt=0x29b4880) at ../../khtml/html/html_formimpl.cpp:1954
#14 0x00007f5502e2dbc4 in DOM::NodeImpl::dispatchGenericEvent (this=0x3319960, evt=0x29b4880) at ../../khtml/xml/dom_nodeimpl.cpp:526
#15 0x00007f5502e2ddbe in DOM::NodeImpl::dispatchEvent (this=0x3319960, evt=0x29b4880, exceptioncode=@0x7fff17fb2c5c, tempEvent=true) at ../../khtml/xml/dom_nodeimpl.cpp:453
#16 0x00007f5502e2e6c2 in DOM::NodeImpl::dispatchKeyEvent (this=<value optimized out>, key=0x7fff17fb3430, keypress=<value optimized out>) at ../../khtml/xml/dom_nodeimpl.cpp:694
#17 0x00007f5502d9e4ed in KHTMLView::dispatchKeyEvent (this=0x18f0fc0, _ke=0x7fff17fb3430) at ../../khtml/khtmlview.cpp:1638
#18 0x00007f5502da9cb9 in KHTMLView::keyPressEvent (this=0x18f0fc0, _ke=0x7fff17fb3430) at ../../khtml/khtmlview.cpp:1762
#19 0x00007f5502da72c7 in KHTMLView::eventFilter (this=0x18f0fc0, o=0x34cd3a0, e=0x7fff17fb3430) at ../../khtml/khtmlview.cpp:2303
#20 0x00007f5510c794b7 in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=<value optimized out>, receiver=0x34cd3a0, event=0x7fff17fb3430) at kernel/qcoreapplication.cpp:841
#21 0x00007f550fda12fc in QApplicationPrivate::notify_helper (this=0x1107ce0, receiver=0x34cd3a0, e=0x7fff17fb3430) at kernel/qapplication.cpp:4298
#22 0x00007f550fda8fc5 in QApplication::notify (this=<value optimized out>, receiver=0x34cd3a0, e=0x7fff17fb3430) at kernel/qapplication.cpp:3765
#23 0x00007f55116627a6 in KApplication::notify (this=0x7fff17fb4510, receiver=0x34cd3a0, event=0x7fff17fb3430) at ../../kdeui/kernel/kapplication.cpp:302
#24 0x00007f5510c7a09c in QCoreApplication::notifyInternal (this=0x7fff17fb4510, receiver=0x34cd3a0, event=0x7fff17fb3430) at kernel/qcoreapplication.cpp:726
#25 0x00007f550fe4bd6a in QKeyMapper::sendKeyEvent (keyWidget=0x34cd3a0, grab=<value optimized out>, type=QEvent::KeyPress, code=16777217, modifiers=<value optimized out>, text=..., autorepeat=false, count=1, nativeScanCode=23, nativeVirtualKey=65289, nativeModifiers=0) at kernel/qkeymapper_x11.cpp:1875
#26 0x00007f550fe4e2e1 in QKeyMapperPrivate::translateKeyEvent (this=0x1140630, keyWidget=0x34cd3a0, event=<value optimized out>, grab=32) at kernel/qkeymapper_x11.cpp:1845
#27 0x00007f550fe25a34 in QApplication::x11ProcessEvent (this=<value optimized out>, event=0x7fff17fb3fe0) at kernel/qapplication_x11.cpp:3406
#28 0x00007f550fe515a2 in x11EventSourceDispatch (s=0x110bb10, callback=<value optimized out>, user_data=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:146
#29 0x00007f550bfc86f2 in g_main_dispatch (context=0x110a920) at /scratch/build-area/glib2.0-2.24.2/glib/gmain.c:1960
#30 IA__g_main_context_dispatch (context=0x110a920) at /scratch/build-area/glib2.0-2.24.2/glib/gmain.c:2513
#31 0x00007f550bfcc568 in g_main_context_iterate (context=0x110a920, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at /scratch/build-area/glib2.0-2.24.2/glib/gmain.c:2591
#32 0x00007f550bfcc71c in IA__g_main_context_iteration (context=0x110a920, may_block=1) at /scratch/build-area/glib2.0-2.24.2/glib/gmain.c:2654
#33 0x00007f5510ca36b3 in QEventDispatcherGlib::processEvents (this=0x10eaf80, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:412
#34 0x00007f550fe5119e in QGuiEventDispatcherGlib::processEvents (this=0x3ff0000000000000, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:204
#35 0x00007f5510c789c2 in QEventLoop::processEvents (this=<value optimized out>, flags=) at kernel/qeventloop.cpp:149
#36 0x00007f5510c78d9c in QEventLoop::exec (this=0x7fff17fb4300, flags=) at kernel/qeventloop.cpp:201
#37 0x00007f5510c7da2b in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1003
#38 0x00007f55131f076b in kdemain (argc=<value optimized out>, argv=<value optimized out>) at ../../../../apps/konqueror/src/konqmain.cpp:257
#39 0x00007f5512deac4d in __libc_start_main (main=<value optimized out>, argc=<value optimized out>, ubp_av=<value optimized out>, init=<value optimized out>, fini=<value optimized out>, rtld_fini=<value optimized out>, stack_end=0x7fff17fb4ee8) at libc-start.c:228
#40 0x0000000000400699 in _start ()

Possible duplicates by query: bug 171909.

Reported using DrKonqi
Comment 1 Andrea Iacovitti 2011-05-28 10:39:11 UTC 
Confirmed on kde 4.6.3
Comment 2 Andrea Iacovitti 2011-08-08 21:51:01 UTC 
Created attachment 62687 [details]
online testcase
Comment 3 Andrea Iacovitti 2013-11-01 18:04:54 UTC 
*** Bug 134345 has been marked as a duplicate of this bug. ***
Comment 4 Andrea Iacovitti 2013-12-15 08:13:53 UTC 
*** Bug 328814 has been marked as a duplicate of this bug. ***
Comment 5 Andrea Iacovitti 2013-12-15 08:17:31 UTC 
*** Bug 315874 has been marked as a duplicate of this bug. ***
Comment 6 Jekyll Wu 2014-03-11 00:39:00 UTC 
*** Bug 331949 has been marked as a duplicate of this bug. ***
Comment 7 Jekyll Wu 2014-04-16 00:30:44 UTC 
*** Bug 333443 has been marked as a duplicate of this bug. ***
Comment 8 Jekyll Wu 2014-05-13 01:31:04 UTC 
*** Bug 334682 has been marked as a duplicate of this bug. ***
Comment 9 Justin Zobel 2020-12-14 01:31:44 UTC 
Thank you for the crash reports.

As it has been a while since this was reported, can you please test and confirm if this issue is still occurring or if this bug report can be marked as resolved.

I have set the bug status to "needsinfo" pending your response, please change back to "reported" or "resolved/worksforme" when you respond, thank you.
Comment 10 Sergey Burladyan 2020-12-14 16:14:15 UTC 
You can check it by youself, use you mouse, click on attachment link and follow the instructions.

I am with Slackware now and Konqueror still crashing with this test case from attachment.

Konqueror
 4.14.13
 KDE 4.14.38

Anyway, thank you for answer after nine years of waiting! :-)
Comment 11 Justin Zobel 2020-12-15 04:07:13 UTC 
Thanks Sergey, setting status back to Confirmed, test case in attachment.
Comment 12 Christoph Cullmann 2024-05-06 18:39:03 UTC 
Dear user,

KHTML (and KJS) was a long time more or less unmaintained and got removed in KF6.

Please migrate to use a QWebEngine based HTML component.

We will do no further fixes or improvements to the KF5 branches of these components beside important security fixes.

For security issues, please see:

https://kde.org/info/security/

Sorry that we did not fix this issue during the life-time of KHTML.

Greetings
Christoph Cullmann