Bug 175578 - Konqueror crashes on some javascript syntax errors
Summary: Konqueror crashes on some javascript syntax errors
Status: RESOLVED FIXED
Alias: None
Product: konqueror
Classification: Applications
Component: general (show other bugs)
Version: unspecified
Platform: Debian testing Unspecified
: NOR crash
Target Milestone: ---
Assignee: Konqueror Developers
URL:
Keywords:
: 177797 178240 179054 180693 181732 181836 183545 183580 183929 184569 185024 185611 (view as bug list)
Depends on:
Blocks:
 
Reported: 2008-11-19 14:00 UTC by Martin Kunev
Modified: 2009-02-26 16:44 UTC (History)
13 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Kunev 2008-11-19 14:00:33 UTC
Version:            (using KDE 4.1.3)
Installed from:    Debian testing/unstable Packages

Konqueror crashes when some strings are passed to alert without quotation mark. I think it is caused by some special characters that I used. It must generate JavaScript error but not crashing the whole application. This example crashes konqueror when the text "Crash me" is clicked:

<div onclick="alert(http://78.90.76.55/);">Crash me!</div>
Comment 1 Maksim Orlovich 2008-11-19 14:59:19 UTC
Confirmed, debugger crash
Comment 2 Dario Andres 2008-12-26 13:22:37 UTC
Here using:

Qt: 4.4.3
KDE: 4.1.86 (KDE 4.1.86 (KDE 4.2 >= 20081221))
kdelibs svn rev. 901624 / kdebase svn rev. 901624
on ArchLinux x86_64 - Kernel 2.6.27.10

I can reproduce the crash using the testcase HTML when the JS Debugger and Report Errors are enabled.

Backtrace:

Application: Konqueror (konqueror), signal SIGSEGV
0x00007fd728b81fd0 in __nanosleep_nocancel () from /lib/libc.so.6

Thread 1 (Thread 0x7fd72dbfd750 (LWP 5573)):
[KCrash Handler]
#5  KJS::Debugger::reportSourceParsed (this=0x11c8c60, exec=0x1406030, body=0x0, source=<value optimized out>, startingLineNumber=0, errorLine=0, errorMsg=@0x7fff35d3d660)
    at /home/kde-devel/kde/src/KDE/kdelibs/kjs/debugger.cpp:158
#6  0x00007fd71e5b5a76 in KJS::FunctionObjectImp::construct (this=<value optimized out>, exec=0x1406030, args=@0x7fff35d3d810, functionName=@0x7fff35d3d7f0, sourceURL=@0x7fff35d3d7e0, lineNumber=0)
    at /home/kde-devel/kde/src/KDE/kdelibs/kjs/function_object.cpp:194
#7  0x00007fd71ecdc1d6 in KJS::JSLazyEventListener::parseCode (this=0x11d5390) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/ecma/kjs_events.cpp:193
#8  0x00007fd71ecddd99 in KJS::JSLazyEventListener::handleEvent (this=0x11c8c20, evt=@0x1406030) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/ecma/kjs_events.cpp:157
#9  0x00007fd71eac1515 in DOM::NodeImpl::handleLocalEvents (this=<value optimized out>, evt=0x1541270, useCapture=false) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:727
#10 0x00007fd71eac1a29 in DOM::NodeImpl::dispatchGenericEvent (this=0x11ed220, evt=0x1541270) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:499
#11 0x00007fd71eac1aae in DOM::NodeImpl::dispatchEvent (this=0x11ed220, evt=0x1541270, exceptioncode=@0x7fff35d3dadc, tempEvent=true)
    at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:451
#12 0x00007fd71ea1cec1 in KHTMLView::dispatchMouseEvent (this=0x130ce30, eventId=3, targetNode=0x11ed220, targetNodeNonShared=<value optimized out>, cancelable=<value optimized out>, detail=1, 
    _mouse=0x7fff35d3dc00, setUnder=true, mouseEventType=1, orient=0) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:3721
#13 0x00007fd71ea26afc in KHTMLView::mouseReleaseEvent (this=0x130ce30, _mouse=0x7fff35d3e660) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:1616
#14 0x00007fd72a72dcb4 in QWidget::event (this=0x130ce30, event=0x7fff35d3e660) at kernel/qwidget.cpp:7163
#15 0x00007fd71ea254bd in KHTMLView::widgetEvent (this=0x130ce30, e=0x1406030) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:2365
#16 0x00007fd71ea25774 in KHTMLView::eventFilter (this=0x130ce30, o=0x1316fc0, e=0x7fff35d3e660) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:2229
#17 0x00007fd72b3247f7 in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=<value optimized out>, receiver=0x1316fc0, event=0x7fff35d3e660) at kernel/qcoreapplication.cpp:694
#18 0x00007fd72a6db07c in QApplicationPrivate::notify_helper (this=0xf0a8d0, receiver=0x1316fc0, e=0x7fff35d3e660) at kernel/qapplication.cpp:3799
#19 0x00007fd72a6e2c65 in QApplication::notify (this=<value optimized out>, receiver=0x1316fc0, e=0x7fff35d3e660) at kernel/qapplication.cpp:3528
#20 0x00007fd72c1446ab in KApplication::notify (this=0x7fff35d3f4d0, receiver=0x1316fc0, event=0x7fff35d3e660) at /home/kde-devel/kde/src/KDE/kdelibs/kdeui/kernel/kapplication.cpp:307
#21 0x00007fd72b324d90 in QCoreApplication::notifyInternal (this=0x7fff35d3f4d0, receiver=0x1316fc0, event=0x7fff35d3e660) at kernel/qcoreapplication.cpp:583
#22 0x00007fd72a6e1fe2 in QApplicationPrivate::sendMouseEvent (receiver=0x1316fc0, event=0x7fff35d3e660, alienWidget=0x1316fc0, nativeWidget=0x10580d0, buttonDown=<value optimized out>, 
    lastMouseReceiver=@0x7fd72afcb450) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:212
#23 0x00007fd72a73fbec in QETWidget::translateMouseEvent (this=0x10580d0, event=<value optimized out>) at kernel/qapplication_x11.cpp:4044
#24 0x00007fd72a73ed47 in QApplication::x11ProcessEvent (this=0x7c, event=0x7fff35d3ef30) at kernel/qapplication_x11.cpp:3162
#25 0x00007fd72a763724 in x11EventSourceDispatch (s=0xf0e0f0, callback=0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:142
#26 0x00007fd726d18aa2 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#27 0x00007fd726d1c21d in g_main_context_iterate () from /usr/lib/libglib-2.0.so.0
#28 0x00007fd726d1c3db in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#29 0x00007fd72b34bcdf in QEventDispatcherGlib::processEvents (this=0xee0170, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:319
#30 0x00007fd72a762f7f in QGuiEventDispatcherGlib::processEvents (this=0x11c8c20, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:198
#31 0x00007fd72b3239c2 in QEventLoop::processEvents (this=<value optimized out>, flags={i = 903082528}) at kernel/qeventloop.cpp:143
#32 0x00007fd72b323b55 in QEventLoop::exec (this=0x7fff35d3f260, flags={i = 903082608}) at kernel/qeventloop.cpp:190
#33 0x00007fd72b3288f7 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:845
#34 0x00007fd72d8f6ac9 in kdemain (argc=<value optimized out>, argv=<value optimized out>) at /home/kde-devel/kde/src/KDE/kdebase/apps/konqueror/src/konqmain.cpp:257
#35 0x00007fd728b01546 in __libc_start_main () from /lib/libc.so.6
#36 0x00000000004007c9 in _start ()

Comment 3 Maksim Orlovich 2008-12-29 18:02:32 UTC
*** Bug 179054 has been marked as a duplicate of this bug. ***
Comment 4 Maksim Orlovich 2008-12-29 18:02:54 UTC
*** Bug 177797 has been marked as a duplicate of this bug. ***
Comment 5 Maksim Orlovich 2008-12-29 18:03:08 UTC
*** Bug 178240 has been marked as a duplicate of this bug. ***
Comment 6 Maksim Orlovich 2009-01-14 18:38:01 UTC
*** Bug 180693 has been marked as a duplicate of this bug. ***
Comment 7 Dario Andres 2009-01-24 13:21:26 UTC
*** Bug 181732 has been marked as a duplicate of this bug. ***
Comment 8 Dario Andres 2009-01-25 04:32:22 UTC
*** Bug 181836 has been marked as a duplicate of this bug. ***
Comment 9 Dario Andres 2009-02-07 13:24:34 UTC
*** Bug 183545 has been marked as a duplicate of this bug. ***
Comment 10 Maksim Orlovich 2009-02-07 17:55:32 UTC
I am wondering: did all of you folks turn the debugger on yourselves, or was it perhaps on by distro defaults (which would be very bad...)?

(will hopefully commit a fix for this today)
Comment 11 Luke-Jr 2009-02-07 18:02:40 UTC
I turned it on for one of my own pages and forgot it was enabled...
Comment 12 Maksim Orlovich 2009-02-07 18:16:42 UTC
*** Bug 183580 has been marked as a duplicate of this bug. ***
Comment 13 Maksim Orlovich 2009-02-10 20:42:25 UTC
*** Bug 183929 has been marked as a duplicate of this bug. ***
Comment 14 Marton Drotos 2009-02-10 21:37:39 UTC
(In reply to comment #10)
> I am wondering: did all of you folks turn the debugger on yourselves, or was it
> perhaps on by distro defaults (which would be very bad...)?

I don't remember turning it on myself (although I used it a long time ago), so I guess that in Debian it was the default at some point (I just copied my configs from KDE3 to KDE4).

Currently the "Defaults" button turns it off.
Comment 15 Maksim Orlovich 2009-02-14 18:43:10 UTC
SVN commit 926127 by orlovich:

Fix debugger crashes during parse errors. In particular, it means 
reportSourceParsed can't rely on there being an AST; and ditto
for reportException. Also fix the code to report the top-level 
parse errors to the debugger; and adjust the debugger UI to 
handle these cases properly, by just displaying the code (and not 
getting confused trying to stop non-running code)
BUG: 175578


 M  +15 -5     khtml/ecma/debugger/debugwindow.cpp  
 M  +5 -0      khtml/ecma/debugger/interpreter_ctx.cpp  
 M  +2 -0      khtml/ecma/debugger/interpreter_ctx.h  
 M  +7 -4      kjs/debugger.cpp  
 M  +2 -1      kjs/debugger.h  
 M  +1 -1      kjs/function.cpp  
 M  +1 -1      kjs/function_object.cpp  
 M  +9 -4      kjs/interpreter.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=926127
Comment 16 Maksim Orlovich 2009-02-14 18:45:41 UTC
SVN commit 926128 by orlovich:

Merged revision 926127:
Fix debugger crashes during parse errors. In particular, it means 
reportSourceParsed can't rely on there being an AST; and ditto
for reportException. Also fix the code to report the top-level 
parse errors to the debugger; and adjust the debugger UI to 
handle these cases properly, by just displaying the code (and not 
getting confused trying to stop non-running code)
BUG: 175578

 M  +15 -5     khtml/ecma/debugger/debugwindow.cpp  
 M  +5 -0      khtml/ecma/debugger/interpreter_ctx.cpp  
 M  +2 -0      khtml/ecma/debugger/interpreter_ctx.h  
 M  +7 -4      kjs/debugger.cpp  
 M  +2 -1      kjs/debugger.h  
 M  +1 -1      kjs/function.cpp  
 M  +1 -1      kjs/function_object.cpp  
 M  +9 -4      kjs/interpreter.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=926128
Comment 17 Maksim Orlovich 2009-02-16 23:27:14 UTC
*** Bug 184569 has been marked as a duplicate of this bug. ***
Comment 18 Tommi Tervo 2009-02-20 14:33:48 UTC
*** Bug 185024 has been marked as a duplicate of this bug. ***
Comment 19 Maksim Orlovich 2009-02-26 16:44:58 UTC
*** Bug 185611 has been marked as a duplicate of this bug. ***