Bug 107187 - crashes on browse of google.maps
Summary: crashes on browse of google.maps
Status: RESOLVED FIXED
Alias: None
Product: konqueror
Classification: Applications
Component: khtml ecma (show other bugs)
Version: unspecified
Platform: unspecified Linux
: NOR crash
Target Milestone: ---
Assignee: Konqueror Developers
URL:
Keywords:
: 107229 107720 107892 112773 (view as bug list)
Depends on:
Blocks:
 
Reported: 2005-06-10 20:27 UTC by Grzegorz Jaskiewicz
Modified: 2005-11-04 07:20 UTC (History)
5 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Grzegorz Jaskiewicz 2005-06-10 20:27:36 UTC
Version:           3.4.0 (using KDE 3.4.89 (>= 20050508), compiled sources)
Compiler:          gcc version 3.4.4 20050314 (prerelease) (Debian 3.4.3-12)
OS:                Linux (i686) release 2.6.11.7

just wonder around map for some time, press zoom +/-, etc
try to move mouse and keep LMB pressed. After few minutes I get crash:

Using host libthread_db library "/lib/tls/libthread_db.so.1".
`system-supplied DSO at 0xffffe000' has disappeared; keeping its symbols.
[Thread debugging using libthread_db enabled]
[New Thread -1231578912 (LWP 28414)]
[KCrash handler]
#3  0x0897dfc8 in ?? ()
#4  0xb5eddba3 in KJS::FunctionImp::call (this=0x8dd09b8, exec=0x8d67038, 
    thisObj=@0xbfffe8c0, args=@0x8e87534)
    at /home/gj/kde-sources/kdelibs/kjs/function.cpp:342
#5  0xb61e09a4 in KJS::ScheduledAction::execute (this=0x8e87530, 
    window=0xbfffe8b0)
    at /home/gj/kde-sources/kdelibs/khtml/ecma/kjs_window.cpp:1832
#6  0xb61eb9bd in KJS::WindowQObject::timerEvent (this=0x8bab730)
    at /home/gj/kde-sources/kdelibs/khtml/ecma/kjs_window.cpp:1973
#7  0xb711e7d6 in QObject::event (this=0x8bab730, e=0xbfffec30)
    at kernel/qobject.cpp:741
#8  0xb70bc4fd in QApplication::internalNotify (this=0xbffff2d0, 
    receiver=0x8bab730, e=0xbfffec30) at kernel/qapplication.cpp:2635
#9  0xb70bb9c1 in QApplication::notify (this=0xbffff2d0, receiver=0x8bab730, 
    e=0xbfffec30) at kernel/qapplication.cpp:2358
#10 0xb7766ee3 in KApplication::notify (this=0xbffff2d0, receiver=0x8bab730, 
    event=0xbfffec30)
    at /home/gj/kde-sources/kdelibs/kdecore/kapplication.cpp:549
#11 0xb704d945 in QApplication::sendEvent (receiver=0x8bab730, 
    event=0xbfffec30) at qapplication.h:491
#12 0xb70aa233 in QEventLoop::activateTimers (this=0x8098e40)
    at kernel/qeventloop_unix.cpp:556
#13 0xb7061609 in QEventLoop::processEvents (this=0x8098e40, flags=4)
    at kernel/qeventloop_x11.cpp:389
#14 0xb70d1588 in QEventLoop::enterLoop (this=0x8098e40)
    at kernel/qeventloop.cpp:198
#15 0xb70d14a6 in QEventLoop::exec (this=0x8098e40)
    at kernel/qeventloop.cpp:145
#16 0xb70bc67d in QApplication::exec (this=0xbffff2d0)
    at kernel/qapplication.cpp:2758
#17 0xb681aedc in kdemain (argc=2, argv=0x8076480)
    at /home/gj/kde-sources/kdebase/konqueror/konq_main.cc:206
#18 0xb767e980 in kdeinitmain (argc=2, argv=0x8076480)
    at ./konqueror/kdeinit_konqueror.la.cpp:2
#19 0x0804e274 in launch (argc=2, _name=0x807721c "konqueror", 
    args=0x8077230 "\001", cwd=0x0, envc=1, envs=0x8077241 "", 
    reset_env=false, tty=0x0, avoid_loops=false, startup_id_str=0x8050c66 "0")
    at /home/gj/kde-sources/kdelibs/kinit/kinit.cpp:636
#20 0x0804ea1e in handle_launcher_request (sock=8)
    at /home/gj/kde-sources/kdelibs/kinit/kinit.cpp:1200
#21 0x0804efcd in handle_requests (waitForPid=0)
    at /home/gj/kde-sources/kdelibs/kinit/kinit.cpp:1403
#22 0x0804f754 in main (argc=2, argv=0xbffffbf4, envp=0xbffffc00)
    at /home/gj/kde-sources/kdelibs/kinit/kinit.cpp:1847
Comment 1 Tommi Tervo 2005-06-11 10:50:41 UTC
Dupe of this one #106112? (bt doesn't match at all). 
Comment 2 Thiago Macieira 2005-06-11 21:56:16 UTC
*** Bug 107229 has been marked as a duplicate of this bug. ***
Comment 3 Thiago Macieira 2005-06-19 14:56:52 UTC
*** Bug 107720 has been marked as a duplicate of this bug. ***
Comment 4 Thiago Macieira 2005-06-19 15:08:30 UTC
I cannot reproduce any crashes on Google maps with Konqueror trunk 424191.
Comment 5 Eric Kjeldergaard 2005-06-22 09:45:09 UTC
On 19 Jun 2005 13:08:31 -0000, Thiago Macieira <thiago@kde.org> wrote:
[bugs.kde.org quoted mail]

Just built konqueror from today's sources, I've a crash and backtrace
from maps.google.com.

[New LWP 100134]
[Switching to LWP 100134]
0x293d8317 in wait4 () from /lib/libc.so.6
#0  0x293d8317 in wait4 () from /lib/libc.so.6
#1  0x293c8c77 in waitpid () from /lib/libc.so.6
#2  0x2927511a in waitpid () from /usr/lib/libpthread.so.1
#3  0x2890ba50 in KCrash::defaultCrashHandler (sig=11)
    at /usr/src/kde/kdelibs/kdecore/kcrash.cpp:251
#4  0x2927e7f7 in sigaction () from /usr/lib/libpthread.so.1
#5  0xbfbfffb4 in ?? ()
#6  0x0000000b in ?? ()
#7  0xbfbfdd10 in ?? ()
#8  0xbfbfda50 in ?? ()
#9  0x00000000 in ?? ()
#10 0x2927dedc in sigaction () from /usr/lib/libpthread.so.1
#11 0x29ea190d in KJS::ScopeChain::operator= (this=0xbfbfde58, c=@0x83cd328)
    at /usr/src/kde/kdelibs/kjs/scope_chain.cpp:40
#12 0x29e8162c in ContextImp (this=0xbfbfde40, glob=@0x82a4e04, 
    interpreter=0x82a4e00, thisV=@0xbfbfdf00, _sourceId=192, 
    type=KJS::FunctionCode, callingCon=0x0, func=0x83cd300, args=0x8679d84)
    at /usr/src/kde/kdelibs/kjs/internal.cpp:424
#13 0x29e91f9e in KJS::FunctionImp::call (this=0x83cd300, exec=0x826f4a0, 
    thisObj=@0xbfbfdf00, args=@0x8679d84)
    at /usr/src/kde/kdelibs/kjs/function.cpp:335
#14 0x29d0c5eb in KJS::ScheduledAction::execute (this=0x8679d80, 
    window=0x82d8f00) at /usr/src/kde/kdelibs/khtml/ecma/kjs_window.cpp:1835
#15 0x29d0d4a6 in KJS::WindowQObject::timerEvent (this=0x82c5080)
    at /usr/src/kde/kdelibs/khtml/ecma/kjs_window.cpp:1976
#16 0x28d0a1d6 in QObject::event () from /usr/X11R6/lib/libqt-mt.so.3
#17 0x28cabd0c in QApplication::internalNotify ()
   from /usr/X11R6/lib/libqt-mt.so.3
#18 0x28cabe9f in QApplication::notify () from /usr/X11R6/lib/libqt-mt.so.3
#19 0x28870cc0 in KApplication::notify (this=0xbfbfe6a0, receiver=0x82c5080, 
    event=0xbfbfe2b0) at /usr/src/kde/kdelibs/kdecore/kapplication.cpp:549
#20 0x28c9fdfb in QEventLoop::activateTimers ()
   from /usr/X11R6/lib/libqt-mt.so.3
#21 0x28c58a14 in QEventLoop::processEvents ()
   from /usr/X11R6/lib/libqt-mt.so.3
#22 0x28cc1c36 in QEventLoop::enterLoop () from /usr/X11R6/lib/libqt-mt.so.3
#23 0x28cc1b8e in QEventLoop::exec () from /usr/X11R6/lib/libqt-mt.so.3
#24 0x28caaff3 in QApplication::exec () from /usr/X11R6/lib/libqt-mt.so.3
#25 0x297a1e48 in kdemain (argc=2, argv=0x808e9c0)
    at /usr/src/kde/kdebase/konqueror/konq_main.cc:206
#26 0x2973f814 in kdeinitmain (argc=2, argv=0x808e9c0)
    at ./konqueror/kdeinit_konqueror.la.cpp:2
#27 0x0804e77b in launch (argc=2, _name=0x8075504 "konqueror", 
    args=0x8075517 "\001", cwd=0x0, envc=1, envs=0x8075528 "", 
    reset_env=false, tty=0x0, avoid_loops=false, 
    startup_id_str=0x807552c ";1119423435;476784;52965_TIME820157")
    at /usr/src/kde/kdelibs/kinit/kinit.cpp:636
#28 0x0804fa8a in handle_launcher_request (sock=8)
    at /usr/src/kde/kdelibs/kinit/kinit.cpp:1200
#29 0x080501d4 in handle_requests (waitForPid=0)
    at /usr/src/kde/kdelibs/kinit/kinit.cpp:1403
#30 0x08051799 in main (argc=2, argv=0xbfbfed0c, envp=0xbfbfed18)
    at /usr/src/kde/kdelibs/kinit/kinit.cpp:1847

Best of luck,

Eric Kjeldergaard
Comment 6 Thiago Macieira 2005-06-22 13:24:24 UTC
Can you give us some steps in how to reproduce this?
Comment 7 Eric Kjeldergaard 2005-06-22 15:05:12 UTC
On 22 Jun 2005 11:24:26 -0000, Thiago Macieira <thiago@kde.org> wrote:
[bugs.kde.org quoted mail]

Tell ya I'd really love to, but it's not something where I can readily
figure out how to reproduce it.  It happens to me reliably within 30
minutes or so of playing with google maps, but it doesn't seem to be a
single event that triggers it (i.e. search for "Wally's pizza" in
Washington DC and drag SouthWest), but it happens after a while of
searching and dragging.
Comment 8 Thiago Macieira 2005-06-25 06:29:39 UTC
*** Bug 107892 has been marked as a duplicate of this bug. ***
Comment 9 Thiago Macieira 2005-06-25 06:31:56 UTC
I can reproduce bug #107892
Comment 10 Ezequiel R. Aguerre 2005-07-26 18:08:04 UTC
The same happens to me, it crashes after playing a while.
Comment 11 Thiago Macieira 2005-09-17 07:26:27 UTC
*** Bug 112773 has been marked as a duplicate of this bug. ***
Comment 12 Maksim Orlovich 2005-09-27 02:42:13 UTC
SVN commit 464347 by orlovich:

Make sure the action we're currently executing does not escape from marking.
(Before this change, any single-shot action would be removed from the action 
list before execution, so any GC within execution will not make it marked,
and the stuff being run would be unreachable and hence collected). 
Also protect against recursion here, for paranoia reasons.
Fixes #110089, and quite possibly #107187, #113002 which I can't reproduce;
so feedback from those who can/could would be appreciated.
BUG:110089
CCBUG:107187
CCBUG:113002


 M  +12 -2     kjs_window.cpp  
 M  +1 -0      kjs_window.h  


--- branches/KDE/3.5/kdelibs/khtml/ecma/kjs_window.cpp #464346:464347
@@ -1930,6 +1930,7 @@
                this, SLOT( parentDestroyed() ) );
   pausedTime = 0;
   lastTimerId = 0;
+  currentlyDispatching = false;
 }
 
 WindowQObject::~WindowQObject()
@@ -2006,6 +2007,8 @@
   if (scheduledActions.isEmpty())
     return;
 
+  currentlyDispatching = true;
+
   QTime currentActual = QTime::currentTime();
   QTime currentAdjusted = currentActual.addMSecs(-pausedTime);
 
@@ -2026,14 +2029,16 @@
 
     action->executing = true; // prevent deletion in clearTimeout()
 
-    if (action->singleShot)
-      scheduledActions.removeRef(action);
     if (parent->part()) {
       bool ok = action->execute(parent);
       if ( !ok ) // e.g. JS disabled
         scheduledActions.removeRef( action );
     }
 
+    if (action->singleShot) {
+      scheduledActions.removeRef(action);
+    }
+
     action->executing = false;
 
     if (!scheduledActions.containsRef(action))
@@ -2044,12 +2049,17 @@
 
   pausedTime += currentActual.msecsTo(QTime::currentTime());
 
+  currentlyDispatching = false;
+
   // Work out when next event is to occur
   setNextTimer();
 }
 
 void WindowQObject::setNextTimer()
 {
+  if (currentlyDispatching)
+    return; // Will schedule at the end 
+
   if (scheduledActions.isEmpty())
     return;
 
--- branches/KDE/3.5/kdelibs/khtml/ecma/kjs_window.h #464346:464347
@@ -232,6 +232,7 @@
     QPtrList<ScheduledAction> scheduledActions;
     int pausedTime;
     int lastTimerId;
+    bool currentlyDispatching;
   };
 
   class Location : public ObjectImp {
Comment 13 Maksim Orlovich 2005-11-04 07:20:40 UTC
Looking at the bt again, I am fairly confident this is what I fixed..So please reopen if it happens in versions >= 464347