Bug 84173

I got always crash.

[New Thread 1024 (LWP 23647)]
[New Thread 2049 (LWP 23648)]
[KCrash handler]
#6  0x4149195c in DOM::HTMLImageElementImpl::width (this=0x840ba18)
    at html_imageimpl.cpp:198
#7  0x41601aa5 in DOM::HTMLImageElement::width (this=0xbfffd960)
    at html_image.cpp:337
#8  0x4155150b in KJS::HTMLElement::getValueProperty (this=0x8597f48, 
    exec=0xbfffe170, token=178) at kjs_html.cpp:1653
#9  0x4154b6fb in KJS::HTMLElement::tryGet (this=0x8597f48, exec=0xbfffe170, 
    propertyName=@0xbfffde20) at kjs_html.cpp:1229
#10 0x4152980a in KJS::DOMObject::get (this=0x8597f48, exec=0xbfffe170, 
    p=@0xbfffde20) at kjs_binding.cpp:48
#11 0x4170bd64 in KJS::Reference::getValue (this=0xbfffde10, exec=0xbfffe170)
    at reference.cpp:143
#12 0x416dd528 in KJS::ResolveNode::evaluate (this=0x84cf678, exec=0xbfffe170)
    at nodes.cpp:368
#13 0x416e1144 in KJS::RelationalNode::evaluate (this=0x84cf6a8, 
    exec=0xbfffe170) at nodes.cpp:1317
#14 0x416dcb68 in KJS::Node::toBoolean (this=0x84cf6a8, exec=0xbfffe170)
    at value.h:218
#15 0x416e3c1d in KJS::IfNode::execute (this=0x84ca528, exec=0xbfffe170)
    at nodes.cpp:1989
#16 0x416e9f87 in KJS::SourceElementsNode::execute (this=0x838ffc0, 
    exec=0xbfffe170) at nodes.cpp:3073
#17 0x416e37aa in KJS::BlockNode::execute (this=0x84ca598, exec=0xbfffe170)
    at nodes.cpp:1915
#18 0x416e9469 in KJS::FunctionBodyNode::execute (this=0x84ca598, 
    exec=0xbfffe170) at nodes.cpp:2919
#19 0x41702bd1 in KJS::DeclaredFunctionImp::execute (this=0x837e3b0, 
    exec=0xbfffe170) at function.cpp:579
#20 0x417022a9 in KJS::FunctionImp::call (this=0x837e3b0, exec=0x84de9c0, 
    thisObj=@0xbfffe2b0, args=@0xbfffe2d0) at function.cpp:354
#21 0x41705ffa in KJS::Object::call (this=0x85fc534, exec=0x84de9c0, 
    thisObj=@0xbfffe2b0, args=@0xbfffe2d0) at object.cpp:70
#22 0x415b2922 in KJS::JSEventListener::handleEvent (this=0x85fc528, 
    evt=@0xbfffe340) at kjs_events.cpp:108
#23 0x41467d95 in DOM::NodeImpl::handleLocalEvents (this=0x840ba18, 
    evt=0x83ed900, useCapture=false) at dom_nodeimpl.cpp:621
#24 0x4146759a in DOM::NodeImpl::dispatchGenericEvent (this=0x840ba18, 
    evt=0x83ed900) at /opt/qt332p2/include/qptrlist.h:174
#25 0x414673fa in DOM::NodeImpl::dispatchEvent (this=0x840ba18, evt=0x83ed900, 
    exceptioncode=@0xbfffe448, tempEvent=true) at dom_nodeimpl.cpp:396
#26 0x4146779b in DOM::NodeImpl::dispatchHTMLEvent (this=0x840ba18, _id=17, 
    canBubbleArg=false, cancelableArg=false) at dom_nodeimpl.cpp:477
#27 0x414d1235 in khtml::RenderImage::notifyFinished (this=0x85a1e90, 
    finishedObj=0x85dcbc8) at ../../khtml/rendering/render_object.h:257
#28 0x4152265c in khtml::CachedImage::movieStatus (this=0x85dcba0, status=2)
    at /opt/qt332p2/include/qptrdict.h:110
#29 0x41526348 in khtml::CachedImage::qt_invoke (this=0x85dcba0, _id=3, 
    _o=0xbfffe580) at /opt/qt332p2/include/private/qucom_p.h:388
#30 0x40a6b402 in QObject::activate_signal ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#31 0x40a6b621 in QObject::activate_signal ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#32 0x40a654b3 in QMoviePrivate::dataStatus ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#33 0x40a643df in QMoviePrivate::frameDone ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#34 0x40a23587 in QGIFFormat::decode () from /opt/qt332p2/lib/libqt-mt.so.3
#35 0x40a22383 in QImageDecoder::decode () from /opt/qt332p2/lib/libqt-mt.so.3
#36 0x40a64775 in QMoviePrivate::receive () from /opt/qt332p2/lib/libqt-mt.so.3
#37 0x41528ff0 in khtml::ImageSource::sendTo (this=0x83a63c0, sink=0x84e61d4, 
    n=43) at /opt/qt332p2/include/qmemarray.h:102
#38 0x40a24b79 in QDataPump::tryToPump () from /opt/qt332p2/lib/libqt-mt.so.3
#39 0x40d0b579 in QDataPump::qt_invoke () from /opt/qt332p2/lib/libqt-mt.so.3
#40 0x40a6b402 in QObject::activate_signal ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#41 0x40a6b334 in QObject::activate_signal ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#42 0x40d13541 in QTimer::timeout () from /opt/qt332p2/lib/libqt-mt.so.3
#43 0x40a85b23 in QTimer::event () from /opt/qt332p2/lib/libqt-mt.so.3
#44 0x40a1f9ca in QApplication::internalNotify ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#45 0x40a1f62f in QApplication::notify () from /opt/qt332p2/lib/libqt-mt.so.3
#46 0x40633767 in KApplication::notify (this=0xbffff0c0, receiver=0x8347f2c, 
    event=0xbfffeaf0) at kapplication.cpp:512
#47 0x40a124b1 in QEventLoop::activateTimers ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#48 0x409d83f1 in QEventLoop::processEvents ()
   from /opt/qt332p2/lib/libqt-mt.so.3
#49 0x40a2d884 in QEventLoop::enterLoop () from /opt/qt332p2/lib/libqt-mt.so.3
#50 0x40a2d7d9 in QEventLoop::exec () from /opt/qt332p2/lib/libqt-mt.so.3
#51 0x40a1fb1e in QApplication::exec () from /opt/qt332p2/lib/libqt-mt.so.3
#52 0x411184a3 in kdemain (argc=2, argv=0x805cc48) at konq_main.cc:204
#53 0x407da8a1 in kdeinitmain (argc=2, argv=0x805cc48) at konqueror_dummy.cc:2
#54 0x0804cbd4 in launch (argc=2, _name=0x805bb74 "konqueror", 
    args=0x805bb87 "\001", cwd=0x0, envc=1, envs=0x805bb98 "", 
    reset_env=false, tty=0x0, avoid_loops=false, 
    startup_id_str=0x805bb9c "v10-dhcp-76-190.ntc.nokia.com;1088435979;892640;16855_TIME89523435") at kinit.cpp:591
#55 0x0804db9f in handle_launcher_request (sock=8) at kinit.cpp:1157
#56 0x0804e0fa in handle_requests (waitForPid=0) at kinit.cpp:1348
#57 0x0804f37b in main (argc=3, argv=0xbffff7a4, envp=0xbffff7b4)
    at kinit.cpp:1785
#58 0x42017589 in __libc_start_main () from /lib/i686/libc.so.6

Created attachment 9824 [details]
patch

must check if we still have a renderer after we forced a relayout.
Fixes the crash, not the actual issue with the script deleting the images on
onLoad.

CVS commit by ggarand: 

fix crashes

BUG: 78205
CCBUG: 84173


  M +7 -5      html_imageimpl.cpp   1.150


--- kdelibs/khtml/html/html_imageimpl.cpp  #1.149:1.150
@@ -182,7 +182,6 @@ void HTMLImageElementImpl::attach()
     {
         m_render = new (getDocument()->renderArena()) RenderImage(this);
-        m_render->setStyle(getDocument()->styleSelector()->styleForElement(this));
+        m_render->setStyle(_style);
         parentNode()->renderer()->addChild(m_render, nextRenderer());
-        m_render->updateFromElement();
     }
     _style->deref();
@@ -187,6 +186,7 @@ void HTMLImageElementImpl::attach()
     }
     _style->deref();
-
     NodeBaseImpl::attach();
+    if (m_render)
+        m_render->updateFromElement();
 }
 
@@ -202,5 +202,6 @@ long HTMLImageElementImpl::width() const
     }
 
-    return m_render->contentWidth();
+    return m_render ? m_render->contentWidth() : 
+                      getAttribute(ATTR_WIDTH).toInt();
 }
 
@@ -216,5 +217,6 @@ long HTMLImageElementImpl::height() cons
     }
 
-    return m_render->contentHeight();
+    return m_render ? m_render->contentHeight() :
+                      getAttribute(ATTR_HEIGHT).toInt();
 }
 

CVS commit by ggarand: 

backport crash fix
CCBUG: 78205, 84173


  M +7 -5      html_imageimpl.cpp   1.149.2.1


--- kdelibs/khtml/html/html_imageimpl.cpp  #1.149:1.149.2.1
@@ -182,7 +182,6 @@ void HTMLImageElementImpl::attach()
     {
         m_render = new (getDocument()->renderArena()) RenderImage(this);
-        m_render->setStyle(getDocument()->styleSelector()->styleForElement(this));
+        m_render->setStyle(_style);
         parentNode()->renderer()->addChild(m_render, nextRenderer());
-        m_render->updateFromElement();
     }
     _style->deref();
@@ -187,6 +186,7 @@ void HTMLImageElementImpl::attach()
     }
     _style->deref();
-
     NodeBaseImpl::attach();
+    if (m_render)
+        m_render->updateFromElement();
 }
 
@@ -202,5 +202,6 @@ long HTMLImageElementImpl::width() const
     }
 
-    return m_render->contentWidth();
+    return m_render ? m_render->contentWidth() : 
+                      getAttribute(ATTR_WIDTH).toInt();
 }
 
@@ -216,5 +217,6 @@ long HTMLImageElementImpl::height() cons
     }
 
-    return m_render->contentHeight();
+    return m_render ? m_render->contentHeight() :
+                      getAttribute(ATTR_HEIGHT).toInt();
 }
 

Not crashing anymore, images still disappear

*** Bug 112329 has been marked as a duplicate of this bug. ***

don't see the disappearing? 

seems to be fixed in 3.5-branch