| Summary: | Konqueror crash after click on a link | ||
|---|---|---|---|
| Product: | [Applications] konqueror | Reporter: | Konrad Twardowski <kdtonline> |
| Component: | khtml renderer | Assignee: | Konqueror Developers <konq-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | benoit.amiaux, enleth, jos |
| Priority: | NOR | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Platform: | Compiled Sources | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
|
Description
Konrad Twardowski
2005-01-15 19:21:03 UTC
Confirmed. My backtrace looks exactly the same. Seems to work fine now with CVS-HEAD. Confirm? For me konqi 3.4.0 crashes, bt looks same. Valgrind log then? ==30947== Invalid read of size 4 ==30947== at 0x1E253685: collectHorizontalBoxCoordinates(khtml::InlineBox*, QValueVector<QPoint>&, bool, int) (render_inline.cpp:497) ==30947== by 0x1E2536F9: collectHorizontalBoxCoordinates(khtml::InlineBox*, QValueVector<QPoint>&, bool, int) (render_inline.cpp:508) ==30947== by 0x1E253F24: khtml::RenderInline::paintOutlines(QPainter*, int, int) (render_inline.cpp:632) ==30947== by 0x1E2543E7: khtml::RenderInline::paint(khtml::RenderObject::PaintInfo&, int, int) (render_inline.cpp:276) ==30947== by 0x1E24DE34: khtml::RenderBlock::paintObject(khtml::RenderObject::PaintInfo&, int, int, bool) (render_block.cpp:1307) ==30947== by 0x1E24E0D3: khtml::RenderBlock::paint(khtml::RenderObject::PaintInfo&, int, int) (render_block.cpp:1263) ==30947== by 0x1E24DE34: khtml::RenderBlock::paintObject(khtml::RenderObject::PaintInfo&, int, int, bool) (render_block.cpp:1307) ==30947== by 0x1E24E0D3: khtml::RenderBlock::paint(khtml::RenderObject::PaintInfo&, int, int) (render_block.cpp:1263) ==30947== by 0x1E24DE34: khtml::RenderBlock::paintObject(khtml::RenderObject::PaintInfo&, int, int, bool) (render_block.cpp:1307) ==30947== by 0x1E24E0D3: khtml::RenderBlock::paint(khtml::RenderObject::PaintInfo&, int, int) (render_block.cpp:1263) ==30947== by 0x1E24A19B: khtml::RenderBlock::paintFloats(khtml::RenderObject::PaintInfo&, int, int, bool) (render_block.cpp:1353) ==30947== by 0x1E24DFEA: khtml::RenderBlock::paintObject(khtml::RenderObject::PaintInfo&, int, int, bool) (render_block.cpp:1321) ==30947== by 0x1E24E0D3: khtml::RenderBlock::paint(khtml::RenderObject::PaintInfo&, int, int) (render_block.cpp:1263) ==30947== by 0x1E24DE34: khtml::RenderBlock::paintObject(khtml::RenderObject::PaintInfo&, int, int, bool) (render_block.cpp:1307) ==30947== by 0x1E24E0D3: khtml::RenderBlock::paint(khtml::RenderObject::PaintInfo&, int, int) (render_block.cpp:1263) ==30947== by 0x1E24DE34: khtml::RenderBlock::paintObject(khtml::RenderObject::PaintInfo&, int, int, bool) (render_block.cpp:1307) ==30947== by 0x1E24E0D3: khtml::RenderBlock::paint(khtml::RenderObject::PaintInfo&, int, int) (render_block.cpp:1263) ==30947== by 0x1E273C49: khtml::RenderLayer::paintLayer(khtml::RenderLayer*, QPainter*, QRect const&, bool) (render_layer.h:137) ==30947== by 0x1E273B51: khtml::RenderLayer::paintLayer(khtml::RenderLayer*, QPainter*, QRect const&, bool) (render_layer.cpp:810) ==30947== by 0x1E273E7A: khtml::RenderLayer::paint(QPainter*, QRect const&, bool) (render_layer.cpp:693) ==30947== by 0x1E19C345: KHTMLView::drawContents(QPainter*, int, int, int, int) (dom_nodeimpl.h:280) ==30947== by 0x1C8BCBCF: QScrollView::drawContentsOffset(QPainter*, int, int, int, int, int, int) (qscrollview.cpp:2334) ==30947== by 0x1C8BB441: QScrollView::viewportPaintEvent(QPaintEvent*) (qscrollview.cpp:1693) ==30947== by 0x1C8BAD18: QScrollView::eventFilter(QObject*, QEvent*) (qscrollview.cpp:1490) ==30947== by 0x1E193B44: KHTMLView::eventFilter(QObject*, QEvent*) (khtmlview.cpp:1904) ==30947== by 0x1C7941BB: QObject::activate_filters(QEvent*) (qobject.cpp:902) ==30947== by 0x1C79402D: QObject::event(QEvent*) (qobject.cpp:735) ==30947== by 0x1C7CE9DE: QWidget::event(QEvent*) (qwidget.cpp:4655) ==30947== by 0x1C7339D2: QApplication::internalNotify(QObject*, QEvent*) (qapplication.cpp:2635) ==30947== by 0x1C733602: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:2523) ==30947== by 0x1C2367F9: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:549) ==30947== by 0x1C6C9396: QApplication::sendEvent(QObject*, QEvent*) (qapplication.h:491) ==30947== by 0x1C6FD2A4: QWidget::repaint(QRegion const&, bool) (qwidget_x11.cpp:1626) ==30947== by 0x1C7348C6: QApplication::sendPostedEvents(QObject*, int) (qapplication.cpp:3258) ==30947== by 0x1C734672: QApplication::sendPostedEvents() (qapplication.cpp:3172) ==30947== by 0x1C6DA6DA: QEventLoop::processEvents(unsigned) (qeventloop_x11.cpp:202) ==30947== by 0x1C747C0D: QEventLoop::enterLoop() (qeventloop.cpp:198) ==30947== by 0x1C747B29: QEventLoop::exec() (qeventloop.cpp:145) ==30947== by 0x1C733B52: QApplication::exec() (qapplication.cpp:2758) ==30947== by 0x1B955D4D: kdemain (konq_main.cc:206) ==30947== by 0x80486F7: main (konqueror.la.cc:2) ==30947== Address 0xC is not stack'd, malloc'd or (recently) free'd *** Bug 100346 has been marked as a duplicate of this bug. *** CVS commit by ggarand:
Don't delete this's placeholder box on layout, parent will take care of it.
Fix crash in dynamic pop-ups.
BUG: 97085
M +2 -0 render_box.cpp 1.256
M +0 -1 render_flow.cpp 1.362
--- kdelibs/khtml/rendering/render_box.cpp #1.255:1.256
@@ -201,4 +201,6 @@ void RenderBox::detach()
InlineBox* RenderBox::createInlineBox(bool /*makePlaceHolderBox*/, bool /*isRootLineBox*/)
{
+ if (m_placeHolderBox)
+ m_placeHolderBox->detach(renderArena());
return (m_placeHolderBox = new (renderArena()) InlineBox(this));
}
--- kdelibs/khtml/rendering/render_flow.cpp #1.361:1.362
@@ -141,5 +141,4 @@ void RenderFlow::deleteInlineBoxes(Rende
m_lastLineBox = 0;
}
- RenderBox::deleteInlineBoxes(arena);
}
CVS commit by ggarand:
backport crash fix
CCBUG: 97085
M +2 -0 render_box.cpp 1.255.2.1
M +0 -1 render_flow.cpp 1.361.2.1
--- kdelibs/khtml/rendering/render_box.cpp #1.255:1.255.2.1
@@ -201,4 +201,6 @@ void RenderBox::detach()
InlineBox* RenderBox::createInlineBox(bool /*makePlaceHolderBox*/, bool /*isRootLineBox*/)
{
+ if (m_placeHolderBox)
+ m_placeHolderBox->detach(renderArena());
return (m_placeHolderBox = new (renderArena()) InlineBox(this));
}
--- kdelibs/khtml/rendering/render_flow.cpp #1.361:1.361.2.1
@@ -141,5 +141,4 @@ void RenderFlow::deleteInlineBoxes(Rende
m_lastLineBox = 0;
}
- RenderBox::deleteInlineBoxes(arena);
}
*** Bug 102729 has been marked as a duplicate of this bug. *** *** Bug 105287 has been marked as a duplicate of this bug. *** |