| Summary: | KJS related crash on www.starnberger-fuenf-seen-land.de | ||
|---|---|---|---|
| Product: | [Applications] konqueror | Reporter: | Ralf Holzer <kdebugs> |
| Component: | kjs | Assignee: | Konqueror Developers <konq-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | ||
| Priority: | NOR | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Platform: | Compiled Sources | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
|
Description
Ralf Holzer
2003-07-20 19:19:16 UTC
Subject: Re: New: KJS related crash on www.starnberger-fuenf-seen-land.de On Sunday 20 July 2003 13:19, Ralf Holzer wrote: > 1) Go to http://www.starnberger-fuenf-seen-land.de/index.html (Who comes up > with these domain names? :) 2) Click on the image in the upper left-hand > corner (Starnberger 5-Seen Land) 3) Click on the "Back" button > 4) Crash > > Here's the backtrace: > > #0 0x41c2dc25 in KJS::ValueImp::dispatchToBoolean(KJS::ExecState*) const > (this=0x0, exec=0xbfffc2a0) at value.cpp:165 #1 0x41bff512 in > KJS::Node::toBoolean(KJS::ExecState*) const (this=0xbfffbfe0, exec=0x0) at > value.h:218 #2 0x41c06405 in KJS::IfNode::execute(KJS::ExecState*) > (this=0x83637b8, exec=0xbfffc2a0) at nodes.cpp:1975 #3 0x41c0bb6b in > KJS::SourceElementsNode::execute(KJS::ExecState*) (this=0xbfffc0b0, > exec=0xbfffc2a0) at nodes.cpp:3088 #4 0x41c05f63 in This bt is misleading. At least for me I dont' get exec=0x0, but KJS::ValueImp::dispatchToBoolean has this=0x0, indicating that rep=0x0 in toBoolean(). Seems to indicate that the expression for the if() statement is Null. The problem is in menu8_com.js:13... if(!MacExp4&&Trigger.onload)Dummy=Trigger.onload; Works with current cvs. Hermann Jansen reported a very similar crash that still exists in ~7 days old CVS sources. Go to http://www.heimatverein-boerger.de/1024x768/default.htm (1st bug: menu doesn't appear). Invoke "Reload Frame" and enjoy the crash: #5 0x4179c6b8 in sigaction () from /lib/libc.so.6 #6 0x41fd189b in KJS::Node::toBoolean () from /home/porten/kde/lib/libkjs.so.1 #7 0x41fd8e89 in KJS::IfNode::execute () from /home/porten/kde/lib/libkjs.so.1 #8 0x41fdf614 in KJS::SourceElementsNode::execute () from /home/porten/kde/lib/libkjs.so.1 #9 0x41fd897a in KJS::BlockNode::execute () from /home/porten/kde/lib/libkjs.so.1 #10 0x41fdea2c in KJS::FunctionBodyNode::execute () from /home/porten/kde/lib/libkjs.so.1 #11 0x41fcfd8b in KJS::InterpreterImp::evaluate () from /home/porten/kde/lib/libkjs.so.1 #12 0x42004e44 in KJS::Interpreter::evaluate () from /home/porten/kde/lib/libkjs.so.1 #13 0x41e79f51 in KJSProxyImpl::evaluate () from /home/porten/kde/lib/libkhtml.so.4 #14 0x41d1c15d in KHTMLPart::executeScript () from /home/porten/kde/lib/libkhtml.so.4 Heimat verein crash (click "Reload Frame" in frame with counter):
==3893== Invalid read of size 4
==3893== at 0x49B65D72: KJS::ValueImp::dispatchToBoolean(KJS::ExecState*) const (value.cpp:174)
==3893== by 0x49B35FE1: KJS::Node::toBoolean(KJS::ExecState*) const (value.h:218)
==3893== by 0x49B3D184: KJS::IfNode::execute(KJS::ExecState*) (nodes.cpp:1951)
==3893== by 0x49B42FCA: KJS::SourceElementsNode::execute(KJS::ExecState*) (nodes.cpp:3035)
[snip]
==3893== Address 0x0 is not stack'd, malloc'd or free'd
The problem seems to be in:
bool Node::toBoolean(ExecState *exec) const
{
// fprintf(stderr, "Node(%s)::toBoolean()\n", typeid(*this).name());
return evaluate(exec).toBoolean(exec);
}
Where evaluate(exec) returns an invalid value.
Dunno if it matters, but exec->hadException() is false in this case.
It seems to me that Node::toBoolean(), Node::toNumber() and Noder::toString() should all check whether evaluate() returns a valid value before processing it further.
There is something else wrong as well.. sometimes "rep" seems to have a value of 0x1 in dispatchToBoolean()
Something like this:
bool Node::toBoolean(ExecState *exec) const
{
Value v = evaluate(exec);
if (!v.isValid())
{
throwError(exec, GeneralError, "Condition could not be evaluated.");
return false;
}
return v.toBoolean(exec);
}
Solves the crash for me....
cma/kjs_events.h (clear): set listener object to Null(), not to an invalid Object(), which will crash when the listener is stored in another frame (#61467). Maybe it would be better to really remove the event listener in this case, but this is hard to do efficiently. CCMAIL: 61467-done@bugs.kde.org M +4 -0 ChangeLog 1.162.2.11 M +6 -14 ecma/kjs_events.cpp 1.80.2.1 M +6 -8 ecma/kjs_events.h 1.30.2.1 |