Bug 88767

Version:            (using KDE Devel)
Installed from:    Compiled sources
Compiler:          gcc-3.3.4 
OS:                Linux

To reproduce go to http://www.rogavis.no At this page I middle click on the story links to open them in background tabs. On some (I think it may be if I try to open more than one background tab) ocasions Konqueror crash.

What I have been able to find is this backtrace:

Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 8531)]
[KCrash handler]
#5  0x4158d7c1 in kill () from /lib/libc.so.6
#6  0x4141f759 in pthread_kill () from /lib/libpthread.so.0
#7  0x4141faad in raise () from /lib/libpthread.so.0
#8  0x4158d414 in raise () from /lib/libc.so.6
#9  0x4158eb80 in abort () from /lib/libc.so.6
#10 0x41586c8d in __assert_fail () from /lib/libc.so.6
#11 0x41d7c01e in DOM::NodeImpl::attach (this=0x8b69e50)
    at dom_nodeimpl.cpp:818
#12 0x41d7cf63 in DOM::NodeBaseImpl::attach (this=0x8b69e50)
    at dom_nodeimpl.cpp:1298
#13 0x41da5a21 in DOM::HTMLImageElementImpl::attach (this=0x8b69e50)
    at html_imageimpl.cpp:184
#14 0x41d914f4 in khtml::KHTMLParser::insertNode (this=0x95ad6f0, 
    n=0x8b69e50, flat=true) at htmlparser.cpp:328
#15 0x41d911bf in khtml::KHTMLParser::parseToken (this=0x95ad6f0, t=0x95ad6f0)
    at htmlparser.cpp:278
#16 0x41d97da1 in khtml::HTMLTokenizer::processToken (this=0x95ad5b8)
    at htmltokenizer.cpp:1575
#17 0x41d9676c in khtml::HTMLTokenizer::parseTag (this=0x95ad5b8, 
    src=@0x95ad6cc) at htmltokenizer.cpp:1088
#18 0x41d971c7 in khtml::HTMLTokenizer::write (this=0x95ad5b8, str=@0x49, 
    appendData=false) at htmltokenizer.cpp:1343
#19 0x41d98331 in khtml::HTMLTokenizer::notifyFinished (this=0x95ad5b8)
    at htmltokenizer.cpp:1644
#20 0x41e32880 in khtml::CachedScript::checkNotify (this=0x990a728)
    at loader.cpp:322
#21 0x41e327fb in khtml::CachedScript::data (this=0x990a728, buffer=@0x0)
    at loader.cpp:314
#22 0x41e35dd4 in khtml::Loader::slotFinished (this=0x8337fd8, job=0x8d9edf0)
    at loader.cpp:1095
#23 0x41e3760a in khtml::Loader::qt_invoke (this=0x8337fd8, _id=148499952, 
    _o=0xbfffe1d0) at loader.moc:260
#24 0x40cbe0d0 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#25 0x401d952c in KIO::Job::result (this=0x8d9edf0, t0=0x0)
    at jobclasses.moc:156
#26 0x401c67b6 in KIO::Job::emitResult (this=0x8d9edf0) at job.cpp:208
#27 0x401c7adc in KIO::SimpleJob::slotFinished (this=0x8d9edf0) at job.cpp:525
#28 0x401ca040 in KIO::TransferJob::slotFinished (this=0x8d9edf0)
    at job.cpp:885
#29 0x401db8a5 in KIO::TransferJob::qt_invoke (this=0x8d9edf0, 
    _id=1077397480, _o=0xbfffe580) at jobclasses.moc:1050
#30 0x40cbe0d0 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#31 0x40cbdf28 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#32 0x401ba012 in KIO::SlaveInterface::finished (this=0x0)
    at slaveinterface.moc:226
#33 0x401b8dca in KIO::SlaveInterface::dispatch (this=0x928e760, 
    _cmd=153675616, rawdata=@0xbfffe7f0) at slaveinterface.cpp:255
#34 0x401b85b3 in KIO::SlaveInterface::dispatch (this=0x928e760)
    at slaveinterface.cpp:191
#35 0x401b64e1 in KIO::Slave::gotInput (this=0x928e760) at slave.cpp:294
#36 0x401b7c48 in KIO::Slave::qt_invoke (this=0x928e760, _id=4, _o=0xbfffe950)
    at slave.moc:113
#37 0x40cbe0d0 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#38 0x40cbe48a in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
#39 0x4109c8f1 in QSocketNotifier::activated ()
   from /usr/qt/3/lib/libqt-mt.so.3
#40 0x40ce2f45 in QSocketNotifier::event () from /usr/qt/3/lib/libqt-mt.so.3
#41 0x40c4e1ed in QApplication::internalNotify ()
   from /usr/qt/3/lib/libqt-mt.so.3
#42 0x40c4d430 in QApplication::notify () from /usr/qt/3/lib/libqt-mt.so.3
#43 0x4076918d in KApplication::notify (this=0xbffff170, receiver=0x9a86c18, 
    event=0xbfffec40) at kapplication.cpp:497
#44 0x4004b91c in QApplication::sendEvent (receiver=0x0, event=0x6)
    at qapplication.h:491
#45 0x40c399b9 in QEventLoop::activateSocketNotifiers ()
   from /usr/qt/3/lib/libqt-mt.so.3
#46 0x40bea799 in QEventLoop::processEvents ()
   from /usr/qt/3/lib/libqt-mt.so.3
#47 0x40c6554d in QEventLoop::enterLoop () from /usr/qt/3/lib/libqt-mt.so.3
#48 0x40c65466 in QEventLoop::exec () from /usr/qt/3/lib/libqt-mt.so.3
#49 0x40c4e38f in QApplication::exec () from /usr/qt/3/lib/libqt-mt.so.3
#50 0x418e6ecb in kdemain (argc=0, argv=0x0) at konq_main.cc:204
#51 0x41889762 in kdeinitmain (argc=0, argv=0x0) at konqueror_dummy.cc:2
#52 0x0804e2b5 in launch (argc=2, _name=0x80701e4 "konqueror", 
    args=0x805c418 "ä\001\a\b", cwd=0x0, envc=1, envs=0x8070208 "", 
    reset_env=false, tty=0x0, avoid_loops=false, startup_id_str=0x0)
    at kinit.cpp:599
#53 0x08050723 in handle_launcher_request (sock=8) at kinit.cpp:1163
#54 0x0804f4a1 in handle_requests (waitForPid=0) at kinit.cpp:1364
#55 0x0804d619 in main (argc=3, argv=0xbffff864, envp=0x0) at kinit.cpp:1817


And I also observed that when running top it shows one process of nspluginviewer running wild consuming >80% CPU.

Starting Konqueror from CLI gives this (partial) traceback:


konqueror: -> NSPluginLoader::NewInstance( parent=0x8a6e2d8, url=http://ad.se.doubleclick.net/964192/adlink744x95.swf?clickTag=http://ad.no.doubleclick.net/click%3Bh=v3|317b|3|0|%2a|w%3B10059769%3B0-0%3B0%3B7584517%3B8877-744|95%3B6423834|6441730|1%3B%3B%7Esscs%3D%3fhttp%3A//www.skoringen.no/tjek.asp%3Ffromloc%3Dfla_AdLink744x95, mime=application/x-shockwave-flash, ...)
konqueror: Looking up plugin for mimetype application/x-shockwave-flash: /opt/netscape/plugins/libflashplayer.so
nspluginviewer (plugin): NSPluginViewer::NewClass( /opt/netscape/plugins/libflashplayer.so)
nspluginviewer (plugin): -> NSPluginClass::NewInstance
nspluginviewer (plugin): argn=MOVIE argv=http://ad.se.doubleclick.net/964192/adlink744x95.swf?clickTag=http://ad.no.doubleclick.net/click%3Bh=v3|317b|3|0|%2a|w%3B10059769%3B0-0%3B0%3B7584517%3B8877-744|95%3B6423834|6441730|1%3B%3B%7Esscs%3D%3fhttp%3A//www.skoringen.no/tjek.asp%3Ffromloc%3Dfla_AdLink744x95
nspluginviewer (plugin): argn=QUALITY argv=high
nspluginviewer (plugin): argn=WMODE argv=opaque
nspluginviewer (plugin): argn=__KHTML__PLUGINBASEURL argv=http://www.rogavis.no/nyheter/article1235404.ece
nspluginviewer (plugin): argn=__KHTML__CLASSID argv=clsid:D27CDB6E-AE6D-11cf-96B8-444553540000
nspluginviewer (plugin): argn=__KHTML__CODEBASE argv=http://active.macromedia.com/flash/cabs/swflash.cab
nspluginviewer (plugin): argn=WIDTH argv=744
nspluginviewer (plugin): argn=HEIGHT argv=95
nspluginviewer (plugin): NSPluginInstance::NSPluginInstance
nspluginviewer (plugin): pdata = (nil)
nspluginviewer (plugin): ndata = 0x856dce8
nspluginviewer (plugin): g_NPN_UserAgent() = Mozilla/5.0 (compatible; Konqueror/3.3; Linux 2.6.7; X11; i686; en_US) (KHTML, like Gecko)
nspluginviewer (plugin): NPP_New = 0
nspluginviewer (plugin): NSPluginInstance::requestURL url=http://ad.se.doubleclick.net/964192/adlink744x95.swf?clickTag=http://ad.no.doubleclick.net/click%3Bh=v3|317b|3|0|%2a|w%3B10059769%3B0-0%3B0%3B7584517%3B8877-744|95%3B6423834|6441730|1%3B%3B%7Esscs%3D%3fhttp%3A//www.skoringen.no/tjek.asp%3Ffromloc%3Dfla_AdLink744x95 target= notify=(nil)
konqueror: NSPluginLoader::instance -> 17
konqueror: *** Embed 60817471 into 58733417. window=0
konqueror: > before reparent: parent=0x38
konqueror: > Loop 0: > reparent of 0x3a0003f into 0x3803369 successful
nspluginviewer (plugin): -> NSPluginInstance::setWindow
nspluginviewer (plugin): Window ID = 0x3a00040
nspluginviewer: Result of
nspluginviewer (plugin): <- NSPluginInstance::setWindow = 0
nspluginviewer (plugin): <- NSPluginInstance::displayPlugin = 0x856dce8
konqueror: <- NSPluginLoader::NewInstance = 0x8a6e9b8
nspluginviewer (part): <- PluginPart::openURL = true
nspluginviewer (plugin): looking for waiting requests
nspluginviewer (plugin): request found
nspluginviewer (plugin): Starting new stream http://ad.se.doubleclick.net/964192/adlink744x95.swf?clickTag=http://ad.no.doubleclick.net/click%3Bh=v3|317b|3|0|%2a|w%3B10059769%3B0-0%3B0%3B7584517%3B8877-744|95%3B6423834|6441730|1%3B%3B%7Esscs%3D%3fhttp%3A//www.skoringen.no/tjek.asp%3Ffromloc%3Dfla_AdLink744x95
nspluginviewer: getting http://ad.se.doubleclick.net/964192/adlink744x95.swf?clickTag=http://ad.no.doubleclick.net/click%3Bh=v3|317b|3|0|%2a|w%3B10059769%3B0-0%3B0%3B7584517%3B8877-744|95%3B6423834|6441730|1%3B%3B%7Esscs%3D%3fhttp%3A//www.skoringen.no/tjek.asp%3Ffromloc%3Dfla_AdLink744x95
khtml (part): Running new KHTMLRun for 0x8abaa10 and child=0x8dadba8
konqueror: [void KonqView::setLoading(bool, bool)] loading=true hasPending=false
konqueror: dom_nodeimpl.cpp:814: virtual void DOM::NodeImpl::attach(): Assertion `!attached()' failed.
X Error: BadWindow (invalid Window parameter) 3
  Major opcode:  61
  Minor opcode:  0
  Resource id:  0x3a00029
X Error: BadWindow (invalid Window parameter) 3
  Major opcode:  3
  Minor opcode:  0
  Resource id:  0x3a0003b
X Error: BadDrawable (invalid Pixmap or Window parameter) 9
  Major opcode:  143
  Minor opcode:  3
  Resource id:  0x3a0003b
X Error: BadWindow (invalid Window parameter) 3
  Major opcode:  3
  Minor opcode:  0
  Resource id:  0x3a00036
KCrash: crashing... crashRecursionCounter = 2
KCrash: Application Name = konqueror path = <unknown> pid = 13835
X Error: BadDrawable (invalid Pixmap or Window parameter) 9
  Major opcode:  143
  Minor opcode:  3
  Resource id:  0x3a00036
X Error: BadWindow (invalid Window parameter) 3
  Major opcode:  61
  Minor opcode:  0
  Resource id:  0x3a00006


Cheers Jo