Bug 326001

Summary:	Akregator crashes when displaying arstechnica.com (in KJS::UString::Rep::computeHash)
Product:	[Applications] konqueror	Reporter:	Jonathan Verner <jonathan.verner>
Component:	kjs	Assignee:	Konqueror Developers <konq-bugs>
Status:	RESOLVED FIXED
Severity:	crash	CC:	rasasi78
Priority:	NOR
Version First Reported In:	4.11.2
Target Milestone:	---
Platform:	Kubuntu
OS:	Linux
URL:	http://arstechnica.com
Latest Commit:		Version Fixed In:
Sentry Crash Report:
Attachments:	Bzipped full backtrace

Description Jonathan Verner 2013-10-14 09:17:56 UTC

Browsing the arstechnica.com website in akregator crashes it relibly. The crash is a segmentation fault in KJS::UString::Rep::computeHash. The backtrace is huge (93Mb),
the top of the backtrace is:

#0  KJS::UString::Rep::computeHash (s=0x7f01a433c0b8 "[[NodeConstructor.constructor]]") at ../../kjs/ustring.cpp:325
#1  0x00007f019da63538 in hash (c=0x7f01a433c0b8 "[[NodeConstructor.constructor]]") at ../../kjs/identifier.cpp:67
#2  hash (key=<optimized out>) at ../../kjs/wtf/HashSet.h:105
#3  fullLookupForWriting<char const*, WTF::HashSetTranslatorAdapter<KJS::UString::Rep*, WTF::HashTraits<KJS::UString::Rep*>, char const*, KJS::CStringTranslator> > (key=<synthetic pointer>, this=0x25cd540) at ../../kjs/wtf/HashTable.h:564
#4  addPassingHashCode<char const*, char const*, WTF::HashSetTranslatorAdapter<KJS::UString::Rep*, WTF::HashTraits<KJS::UString::Rep*>, char const*, KJS::CStringTranslator> > (extra=<synthetic pointer>, key=<synthetic pointer>, this=0x25cd540) at ../../kjs/wtf/HashTable.h:702
#5  add<char const*, KJS::CStringTranslator> (value=<synthetic pointer>, this=<optimized out>) at ../../kjs/wtf/HashSet.h:217
#6  KJS::Identifier::add (c=0x7f01a433c0b8 "[[NodeConstructor.constructor]]") at ../../kjs/identifier.cpp:103
#7  0x00007f01a4174a27 in Identifier (s=0x7f01a433c0b8 "[[NodeConstructor.constructor]]", this=0x7fffaf8c00a0) at ../../kjs/identifier.h:48
#8  KJS::NodeConstructor::NodeConstructor (this=0x7f017550d140, exec=0x7fffb18b66b0) at ../../khtml/ecma/kjs_dom.cpp:1916
#9  0x00007f01a41747d8 in cacheGlobalObject<KJS::NodeConstructor> (propertyName=..., exec=0x7fffb18b66b0) at ../../kjs/lookup.h:331

Reproducible: Always




I filed this bug against akregator (bug 326000) first, before realizing I should probably have filed it against konqueror.

Comment 1 Jonathan Verner 2013-10-14 09:19:47 UTC

Created attachment 82840 [details]
Bzipped full backtrace

Bzipped using the command cat test.txt | bzip2 > t.bz2

Comment 2 Raúl 2013-11-07 19:55:45 UTC

I think I bumped into this, in my case on konqueror 4.10.5.
I think what I got was a stack overflow since DrKonqui didn't appear. Manually attaching gdb before the crash I have tons of frames like this in the backtrace:
[...]
#5024 0x00007ff70ba88b78 in cacheGlobalObject<KJS::NodeConstructor> (propertyName=..., exec=0x7fff92797e50) at ../../kjs/lookup.h:331
#5025 KJS::NodeConstructor::self (exec=exec@entry=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:1872
#5026 0x00007ff70ba88c78 in KJS::DOMNodeProto::DOMNodeProto (this=0x7ff6a7cf2ec0, exec=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:121
#5027 0x00007ff70ba88a3a in cacheGlobalObject<KJS::DOMNodeProto> (propertyName=..., exec=0x7fff92797e50) at ../../kjs/lookup.h:331
#5028 self (exec=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:113
#5029 KJS::NodeConstructor::NodeConstructor (this=0x7ff6a7cf2e40, exec=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:1872
#5030 0x00007ff70ba88b78 in cacheGlobalObject<KJS::NodeConstructor> (propertyName=..., exec=0x7fff92797e50) at ../../kjs/lookup.h:331
#5031 KJS::NodeConstructor::self (exec=exec@entry=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:1872
#5032 0x00007ff70ba88c78 in KJS::DOMNodeProto::DOMNodeProto (this=0x7ff6a7cf2dc0, exec=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:121
#5033 0x00007ff70ba88a3a in cacheGlobalObject<KJS::DOMNodeProto> (propertyName=..., exec=0x7fff92797e50) at ../../kjs/lookup.h:331
#5034 self (exec=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:113
#5035 KJS::NodeConstructor::NodeConstructor (this=0x7ff6a7cf2d40, exec=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:1872
#5036 0x00007ff70ba88b78 in cacheGlobalObject<KJS::NodeConstructor> (propertyName=..., exec=0x7fff92797e50) at ../../kjs/lookup.h:331
#5037 KJS::NodeConstructor::self (exec=exec@entry=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:1872
#5038 0x00007ff70ba88c78 in KJS::DOMNodeProto::DOMNodeProto (this=0x7ff6a7cf2cc0, exec=0x7fff92797e50) at ../../khtml/ecma/kjs_dom.cpp:121

In order to reproduce visit: http://ccaa.elpais.com/ccaa/2013/11/05/album/1383639718_997266.html#1383639718_997266_1383657199 on a new konqueror instance and keep clicking on the right arrow above the picture. Picture gallery will slide till the crash happens.

HTH,

Comment 3 cattynebulart 2014-03-19 16:23:40 UTC

getting the same kind of crash on arstechnica.com.

Comment 4 Christophe Marin 2015-03-01 18:46:31 UTC

*** Bug 326000 has been marked as a duplicate of this bug. ***

Comment 5 Andrew Crouthamel 2018-10-31 04:08:43 UTC

Dear Bug Submitter,

This bug has been stagnant for a long time. Could you help us out and re-test if the bug is valid in the latest version? I am setting the status to NEEDSINFO pending your response, please change the Status back to REPORTED when you respond.

Thank you for helping us make KDE software even better for everyone!

Comment 6 Jonathan Verner 2018-10-31 10:49:54 UTC

The bug doesn't seem to happen anymore with Akregator 5.9.2 or Konqueror 5.0.97, therefore I am marking this bug as fixed (although they currently seem to use webkit instead of khtml...)