Bug 327478

Application: rekonq (2.3.2)
KDE Platform Version: 4.10.5 (Compiled from sources)
Qt Version: 4.8.4
Operating System: Linux 3.10.7-gentoo-r1 i686
Distribution (Platform): Gentoo Packages

-- Information about the crash:
- What I was doing when the application crashed:

While navigating a forum thread (links below), rekonq crashes with a segmentation fault. The links in question are the hyperlinks labeled "1" and "2" at the bottom of the pages, which take you to page 1, or page 2, respectively. 

http://us.generation-nt.com/answer/gentoo-user-emerge-problems-help-210729502.html
http://us.generation-nt.com/answer/gentoo-user-emerge-problems-help-210729502.html?page=2

The crash happens 100% reliably when navigating to one of the pages from the other, even if that navigation does not actually involve clicking a link, i.e., pasting the URL into the URL bar. It happens much less reliably, but often, when navigating away from one of the given URLs to any other arbitrary URL.

The crash can be reproduced every time.

-- Backtrace:
Application: rekonq (kdeinit4), signal: Segmentation fault
Using host libthread_db library "/lib/libthread_db.so.1".
[Current thread is 1 (Thread 0xb557e740 (LWP 26481))]

Thread 4 (Thread 0xb09cab40 (LWP 26482)):
#0  0xb77b8424 in __kernel_vsyscall ()
#1  0xb6c21a3c in pthread_cond_wait () at ../nptl/sysdeps/unix/sysv/linux/i386/i686/../i486/pthread_cond_wait.S:169
#2  0xb4044181 in WTF::TCMalloc_PageHeap::scavengerThread (this=this@entry=0xb479f400 <WTF::pageheap_memory>) at wtf/FastMalloc.cpp:2495
#3  0xb404427f in WTF::TCMalloc_PageHeap::runScavengerThread (context=0xb479f400 <WTF::pageheap_memory>) at wtf/FastMalloc.cpp:1618
#4  0xb6c1de05 in start_thread (arg=0xb09cab40) at pthread_create.c:305
#5  0xb5fc394e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:133

Thread 3 (Thread 0xb00a9b40 (LWP 26483)):
#0  0xb5a85897 in __GI_clock_gettime (clock_id=1, tp=0xb00a8fe8) at ../sysdeps/unix/clock_gettime.c:100
#1  0xb6cfeaf5 in do_gettime (frac=0xb00a8fe0, sec=0xb00a8fd8) at tools/qelapsedtimer_unix.cpp:123
#2  qt_gettime () at tools/qelapsedtimer_unix.cpp:140
#3  0xb6de6e6e in QTimerInfoList::updateCurrentTime (this=0xaf702074) at kernel/qeventdispatcher_unix.cpp:354
#4  0xaf7004e0 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Thread 2 (Thread 0xaf086b40 (LWP 26488)):
#0  0xb77b8424 in __kernel_vsyscall ()
#1  0xb6c21a3c in pthread_cond_wait () at ../nptl/sysdeps/unix/sysv/linux/i386/i686/../i486/pthread_cond_wait.S:169
#2  0xb6ca0440 in wait (time=4294967295, this=0x8a7f548) at thread/qwaitcondition_unix.cpp:86
#3  QWaitCondition::wait (this=0x8a7fcf0, mutex=0x8a81630, time=4294967295) at thread/qwaitcondition_unix.cpp:158
#4  0xb405057f in WTF::ThreadCondition::wait (this=0xb0149054, mutex=...) at wtf/qt/ThreadingQt.cpp:253
#5  0xb3d62a54 in WebCore::IconDatabase::syncThreadMainLoop (this=0xb0149000) at loader/icon/IconDatabase.cpp:1436
#6  0xb3d62bd1 in WebCore::IconDatabase::iconDatabaseSyncThread (this=0xb0149000) at loader/icon/IconDatabase.cpp:1052
#7  0xb4051af2 in WTF::threadEntryPoint (contextData=0xb017adc0) at wtf/Threading.cpp:67
#8  0xb40500b1 in WTF::ThreadPrivate::run (this=0x8a83108) at wtf/qt/ThreadingQt.cpp:66
#9  0xb6c9fe58 in QThreadPrivate::start (arg=0x8a83108) at thread/qthread_unix.cpp:338
#10 0xb6c1de05 in start_thread (arg=0xaf086b40) at pthread_create.c:305
#11 0xb5fc394e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:133

Thread 1 (Thread 0xb557e740 (LWP 26481)):
[KCrash Handler]
#7  operator QtSharedPointer::ExternalRefCountData* (this=0x48) at ../../include/QtCore/../../src/corelib/thread/qbasicatomic.h:169
#8  QtSharedPointer::ExternalRefCountData::getAndRef (obj=0x8e70390) at tools/qsharedpointer.cpp:1255
#9  0xb5cd21bd in QWeakPointer<QObject> (ptr=0x8e70390, this=<optimized out>) at ../../include/QtCore/../../src/corelib/tools/qsharedpointer_impl.h:595
#10 operator=<QObject> (ptr=0x8e70390, this=0x8e7b4a8) at ../../include/QtCore/../../src/corelib/tools/qsharedpointer_impl.h:600
#11 QNetworkRequest::setOriginatingObject (this=0xbfad203c, object=0x8e70390) at access/qnetworkrequest.cpp:565
#12 0xb3d00d14 in WebCore::ResourceRequest::toNetworkRequest (this=0xbfad207c, originatingFrame=0x8e70390) at platform/network/qt/ResourceRequestQt.cpp:50
#13 0xb3d05c85 in WebCore::QNetworkReplyHandler::redirect (this=0x9162060, response=..., redirection=...) at platform/network/qt/QNetworkReplyHandler.cpp:569
#14 0xbfad2308 in ?? ()

This bug may be a duplicate of or related to bug 321076.

Possible duplicates by query: bug 326326, bug 324576, bug 324097, bug 321076, bug 316566.

Reported using DrKonqi