Bug 73311

(gdb) where
#0  0x421dc20d in khtml::RenderBox::calcWidth() (this=0x87e9760) at /coolo/prod/kdelibs/khtml/rendering/render_box.cpp:621
#1  0x421eb89f in khtml::RenderImage::setPixmap(QPixmap const&, QRect const&, khtml::CachedImage*) (this=0x87e9760, p=@0x8aeb0a8,
    r=@0xbfffd9d0, o=0x89880c0) at /coolo/prod/kdelibs/khtml/rendering/render_image.cpp:153
#2  0x4223c0a6 in khtml::CachedImage::ref(khtml::CachedObjectClient*) (this=0x89880c0, c=0x87e9760)
    at /coolo/prod/kdelibs/khtml/misc/loader.cpp:465
#3  0x421ecf53 in khtml::RenderImage::updateImage(khtml::CachedImage*) (this=0x87e9760, new_image=0x89880c0)
    at /coolo/prod/kdelibs/khtml/rendering/render_image.cpp:412
#4  0x421eb45c in khtml::RenderImage::setContentObject(khtml::CachedObject*) (this=0x87e9760, co=0x89880e8)
    at /coolo/prod/kdelibs/khtml/rendering/render_image.cpp:91
#5  0x421d9012 in khtml::RenderContainer::updatePseudoChild(khtml::RenderStyle::PseudoId, khtml::RenderObject*) (this=0x87e9680,
    type=AFTER, child=0x0) at /coolo/prod/kdelibs/khtml/rendering/render_container.cpp:270
#6  0x421c175e in khtml::RenderBlock::setStyle(khtml::RenderStyle*) (this=0x87e9680, _style=0x89caa50)
    at /coolo/prod/kdelibs/khtml/rendering/render_block.cpp:95
#7  0x421d0605 in khtml::RenderObject::createObject(DOM::NodeImpl*, khtml::RenderStyle*) (node=0x89caa10, style=0x89caa50)
    at /coolo/prod/kdelibs/khtml/rendering/render_object.cpp:129
#8  0x4217abbb in DOM::ElementImpl::attach() (this=0x89caa10) at /coolo/prod/kdelibs/khtml/xml/dom_elementimpl.cpp:444
#9  0x4218d356 in khtml::KHTMLParser::insertNode(DOM::NodeImpl*, bool) (this=0x8b54040, n=0x89caa10, flat=false)
    at /coolo/prod/kdelibs/khtml/html/htmlparser.cpp:318
#10 0x4218d255 in khtml::KHTMLParser::parseToken(khtml::Token*) (this=0x8b54040, t=0x8418444)
    at /coolo/prod/kdelibs/khtml/html/htmlparser.cpp:276
#11 0x4219561a in khtml::HTMLTokenizer::processToken() (this=0x8418410) at /coolo/prod/kdelibs/khtml/html/htmltokenizer.cpp:1577
#12 0x42193fe9 in khtml::HTMLTokenizer::parseTag(khtml::DOMStringIt&) (this=0x8418410, src=@0x8418524)
    at /coolo/prod/kdelibs/khtml/html/htmltokenizer.cpp:1090
#13 0x421949c2 in khtml::HTMLTokenizer::write(QString const&, bool) (this=0x8418410, str=@0xbfffde50, appendData=true)
    at /coolo/prod/kdelibs/khtml/html/htmltokenizer.cpp:1345

David and I see the same crash in the domts test suite and tracked it down
to the code 
void HTMLObjectBaseElementImpl::renderAlternative()
{
    // an unbelievable hack. FIXME!!

It detaches the renderer and deletes some cached objects.

BTW: the main page doesn't crash for me, but http://www.mozdev.org/projects/active.html does reproducable

*** Bug 73338 has been marked as a duplicate of this bug. ***

Subject: kdelibs/khtml

CVS commit by mueller: 

* rendering/render_image.cpp (setPixmap): handle cases when
we're not inserted in the tree yet, but the image is already loaded
(this happens when the memory cache actually works) (#73311).
CCMAIL: 73311-done@bugs.kde.org


  M +6 -0      ChangeLog   1.182
  M +11 -6     rendering/render_image.cpp   1.129


--- kdelibs/khtml/rendering/render_image.cpp  #1.128:1.129
@@ -151,6 +151,8 @@ void RenderImage::setPixmap( const QPixm
         int oldwidth = m_width;
         int oldheight = m_height;
+        if ( parent() ) {
         calcWidth();
         calcHeight();
+        }
 
         if(iwchanged || m_width != oldwidth || m_height != oldheight)
@@ -161,4 +163,7 @@ void RenderImage::setPixmap( const QPixm
     }
 
+    // we're not fully integrated in the tree yet.. we'll come back.
+    if ( !parent() )
+        return;
 
     if(needlayout)

--- kdelibs/khtml/ChangeLog  #1.181:1.182
@@ -1,2 +1,8 @@
+2004-01-25  Dirk Mueller  <mueller@kde.org>
+
+        * rendering/render_image.cpp (setPixmap): handle cases when
+        we're not inserted in the tree yet, but the image is already loaded
+        (this happens when the memory cache actually works) (#73311).
+
 2004-01-23  Lubos Lunak  <l.lunak@kde.org>
 

*** Bug 73570 has been marked as a duplicate of this bug. ***

*** Bug 74240 has been marked as a duplicate of this bug. ***

*** Bug 74411 has been marked as a duplicate of this bug. ***

*** Bug 74174 has been marked as a duplicate of this bug. ***

*** Bug 75002 has been marked as a duplicate of this bug. ***

*** Bug 75320 has been marked as a duplicate of this bug. ***

*** Bug 75767 has been marked as a duplicate of this bug. ***

*** Bug 79376 has been marked as a duplicate of this bug. ***