Bug 189173 - Konqueror crashes at www.bseindia.com (khtml::InputTextCommandImpl::prepareForTextInsertion, khtml::InputTextCommandImpl::execute, khtml::InputTextCommand::input)
Summary: Konqueror crashes at www.bseindia.com (khtml::InputTextCommandImpl::prepareFo...
Status: RESOLVED FIXED
Alias: None
Product: konqueror
Classification: Applications
Component: general (show other bugs)
Version: unspecified
Platform: unspecified Linux
: NOR grave
Target Milestone: ---
Assignee: Konqueror Developers
URL:
Keywords:
: 207919 208011 208144 208460 208740 209414 209808 209860 210004 210396 211165 211742 213920 214469 216326 231071 231578 (view as bug list)
Depends on:
Blocks:
 
Reported: 2009-04-09 06:20 UTC by Mohd Asif Ali Rizwaan
Modified: 2010-03-21 21:25 UTC (History)
19 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
please see the redbox (115.27 KB, image/jpeg)
2009-04-09 06:23 UTC, Mohd Asif Ali Rizwaan
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mohd Asif Ali Rizwaan 2009-04-09 06:20:56 UTC
Version:           4.2.2 (KDE 4.2.2) (using 4.2.2 (KDE 4.2.2), Kubuntu packages)
Compiler:          cc
OS:                Linux (i686) release 2.6.28-11-generic

0. trying (clicking and typing at) "Search by company name" crashes konqueror.
1. Please visit:http://www.bseindia.com/stockreach/stockreach.htm?scripcd=507685
2. click on the lineedit at bottom of the page and type any text, and konqueror crashes.
Comment 1 Mohd Asif Ali Rizwaan 2009-04-09 06:23:58 UTC
Created attachment 32714 [details]
please see the redbox
Comment 2 Dario Andres 2009-04-09 14:51:17 UTC
Here using:

Qt: 4.5.0 + qt-copy-patches-936035
KDE: 4.2.68 (KDE 4.2.68 (KDE 4.3 >= 20090327))
kdelibs svn rev. 949645 / kdebase svn rev. 949645
on ArchLinux i686 - Kernel 2.6.28.8

I can reproduce the crash:

Application: Konqueror (konqueror), signal Segmentation fault

[Current thread is 0 (LWP 5611)]

Thread 2 (Thread 0xb1aa2b90 (LWP 5614)):
#0  0xb7f87424 in __kernel_vsyscall ()
#1  0xb71d4f82 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0xb723371c in QWaitCondition::wait (this=0x9bbeb70, mutex=0x9bbeb6c, time=30000) at thread/qwaitcondition_unix.cpp:85
#3  0xb7228da6 in QThreadPoolThread::run (this=0x9b47398) at concurrent/qthreadpool.cpp:140
#4  0xb7232b60 in QThreadPrivate::start (arg=0x9b47398) at thread/qthread_unix.cpp:189
#5  0xb71d1155 in start_thread () from /lib/libpthread.so.0
#6  0xb6611a5e in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb5e92700 (LWP 5611)):
[KCrash Handler]
#6  khtml::InputTextCommandImpl::prepareForTextInsertion (this=0x9cab018, adjustDownstream=false) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/editing/htmlediting_impl.cpp:1574
#7  0xb3f721ae in khtml::InputTextCommandImpl::execute (this=0x9cab018, text=@0xbf8a0e78) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/editing/htmlediting_impl.cpp:1650
#8  0xb3f5ffaa in khtml::InputTextCommand::input (this=0xbf8a0d44, text=@0xbf8a0e78) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/editing/htmlediting.cpp:372
#9  0xb3f687a3 in khtml::TypingCommandImpl::insertText (this=0x9cadd48, text=@0xbf8a0e78) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/editing/htmlediting_impl.cpp:2373
#10 0xb3f5f0da in khtml::TypingCommand::insertText (this=0xbf8a0da4, text=@0xbf8a0e78) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/editing/htmlediting.cpp:812
#11 0xb3f6187e in khtml::TypingCommand::insertText (document=0x9b445c0, text=@0xbf8a0e78) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/editing/htmlediting.cpp:745
#12 0xb3f5c998 in DOM::Editor::handleKeyEvent (this=0x96a63e0, _ke=0x9d152a0) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/editing/editor.cpp:528
#13 0xb3dd7ddd in DOM::ElementImpl::defaultEventHandler (this=0x9d1b2b8, e=0x9cad0f8) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_elementimpl.cpp:781
#14 0xb3e3a0fb in DOM::HTMLGenericFormElementImpl::defaultEventHandler (this=0x9d1b2b8, evt=0x9cad0f8) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/html/html_formimpl.cpp:1082
#15 0xb3e4a202 in DOM::HTMLInputElementImpl::defaultEventHandler (this=0x9d1b2b8, evt=0x9cad0f8) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/html/html_formimpl.cpp:1922
#16 0xb3dcf552 in DOM::NodeImpl::dispatchGenericEvent (this=0x9d1b2b8, evt=0x9cad0f8) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:526
#17 0xb3dcf736 in DOM::NodeImpl::dispatchEvent (this=0x9d1b2b8, evt=0x9cad0f8, exceptioncode=@0xbf8a1038, tempEvent=true) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:453
#18 0xb3dd000c in DOM::NodeImpl::dispatchKeyEvent (this=0x9d1b2b8, key=0xbf8a152c, keypress=true) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/xml/dom_nodeimpl.cpp:692
#19 0xb3d278de in KHTMLView::dispatchKeyEventHelper (this=0x9aef5f8, _ke=0xbf8a152c, keypress=<value optimized out>) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:1664
#20 0xb3d2a8de in KHTMLView::dispatchKeyEvent (this=0x9aef5f8, _ke=0xbf8a152c) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:1620
#21 0xb3d33b2b in KHTMLView::keyPressEvent (this=0x9aef5f8, _ke=0xbf8a152c) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:1741
#22 0xb3d31ee4 in KHTMLView::eventFilter (this=0x9aef5f8, o=0x9d18c28, e=0xbf8a152c) at /home/kde-devel/kde/src/KDE/kdelibs/khtml/khtmlview.cpp:2279
#23 0xb7321b2a in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=0x96d75f0, receiver=0x9d18c28, event=0xbf8a152c) at kernel/qcoreapplication.cpp:718
#24 0xb6a4efea in QApplicationPrivate::notify_helper (this=0x96d75f0, receiver=0x9d18c28, e=0xbf8a152c) at kernel/qapplication.cpp:4080
#25 0xb6a58c44 in QApplication::notify (this=0xbf8a2158, receiver=0x9d18c28, e=0xbf8a152c) at kernel/qapplication.cpp:3690
#26 0xb78791fd in KApplication::notify (this=0xbf8a2158, receiver=0x9d18c28, event=0xbf8a152c) at /home/kde-devel/kde/src/KDE/kdelibs/kdeui/kernel/kapplication.cpp:307
#27 0xb732211b in QCoreApplication::notifyInternal (this=0xbf8a2158, receiver=0x9d18c28, event=0xbf8a152c) at kernel/qcoreapplication.cpp:598
#28 0xb6a501fe in qt_sendSpontaneousEvent (receiver=0x9d18c28, event=0xbf8a0ccc) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:216
#29 0xb6ae4573 in QKeyMapper::sendKeyEvent (keyWidget=0x9d18c28, grab=false, type=QEvent::KeyPress, code=65, modifiers={i = -1081468948}, text=@0xbf8a1818, autorepeat=<value optimized out>, count=1, 
    nativeScanCode=38, nativeVirtualKey=97, nativeModifiers=0) at kernel/qkeymapper_x11.cpp:1675
#30 0xb6ae64ab in QKeyMapperPrivate::translateKeyEvent (this=0x970b560, keyWidget=0x9d18c28, event=0xbf8a1cdc, grab=false) at kernel/qkeymapper_x11.cpp:1645
#31 0xb6abf31c in QApplication::x11ProcessEvent (this=0xbf8a2158, event=0xbf8a1cdc) at kernel/qapplication_x11.cpp:3436
#32 0xb6ae7dda in x11EventSourceDispatch (s=0x96da7b0, callback=0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#33 0xb61cc5e8 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#34 0xb61cfb4b in g_main_context_iterate () from /usr/lib/libglib-2.0.so.0
#35 0xb61cfcc8 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#36 0xb734ca58 in QEventDispatcherGlib::processEvents (this=0x96d75d0, flags={i = -1081467240}) at kernel/qeventdispatcher_glib.cpp:323
#37 0xb6ae7535 in QGuiEventDispatcherGlib::processEvents (this=0x96d75d0, flags={i = -1081467192}) at kernel/qguieventdispatcher_glib.cpp:202
#38 0xb7320b5a in QEventLoop::processEvents (this=0xbf8a1f30, flags={i = -1081467128}) at kernel/qeventloop.cpp:149
#39 0xb7320d1a in QEventLoop::exec (this=0xbf8a1f30, flags={i = -1081467080}) at kernel/qeventloop.cpp:196
#40 0xb7325da1 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:880
#41 0xb6a4ed37 in QApplication::exec () at kernel/qapplication.cpp:3553
#42 0xb7f6de8f in kdemain (argc=2, argv=0xbf8a24d4) at /home/kde-devel/kde/src/KDE/kdebase/apps/konqueror/src/konqmain.cpp:257
#43 0x08048732 in main (argc=0, argv=0x0) at /home/kde-devel/kde/build/KDE/kdebase/apps/konqueror/src/konqueror_dummy.cpp:3

Valgrind:

==5631== Invalid read of size 4
==5631==    at 0xA02B605: khtml::InputTextCommandImpl::prepareForTextInsertion(bool) (htmlediting_impl.cpp:1574)
==5631==    by 0xA02C1AD: khtml::InputTextCommandImpl::execute(DOM::DOMString const&) (htmlediting_impl.cpp:1650)
==5631==    by 0xA019FA9: khtml::InputTextCommand::input(DOM::DOMString const&) (htmlediting.cpp:372)
==5631==    by 0xA0227A2: khtml::TypingCommandImpl::insertText(DOM::DOMString const&) (htmlediting_impl.cpp:2373)
==5631==    by 0xA0190D9: khtml::TypingCommand::insertText(DOM::DOMString const&) (htmlediting.cpp:812)
==5631==    by 0xA01B87D: khtml::TypingCommand::insertText(DOM::DocumentImpl*, DOM::DOMString const&) (htmlediting.cpp:745)
==5631==    by 0xA016997: DOM::Editor::handleKeyEvent(QKeyEvent*) (editor.cpp:528)
==5631==    by 0x9E91DDC: DOM::ElementImpl::defaultEventHandler(DOM::EventImpl*) (dom_elementimpl.cpp:781)
==5631==    by 0x9EF40FA: DOM::HTMLGenericFormElementImpl::defaultEventHandler(DOM::EventImpl*) (html_formimpl.cpp:1082)
==5631==    by 0x9F04201: DOM::HTMLInputElementImpl::defaultEventHandler(DOM::EventImpl*) (html_formimpl.cpp:1922)
==5631==    by 0x9E89551: DOM::NodeImpl::dispatchGenericEvent(DOM::EventImpl*, int&) (dom_nodeimpl.cpp:526)
==5631==    by 0x9E89735: DOM::NodeImpl::dispatchEvent(DOM::EventImpl*, int&, bool) (dom_nodeimpl.cpp:453)
==5631==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
Comment 3 Dario Andres 2009-09-19 22:31:30 UTC
*** Bug 207919 has been marked as a duplicate of this bug. ***
Comment 4 Dario Andres 2009-09-19 22:31:57 UTC
Bug 207919 is about another situation: adding a comment in Facebook.
Comment 5 Tommi Tervo 2009-09-20 20:01:00 UTC
*** Bug 208011 has been marked as a duplicate of this bug. ***
Comment 6 Dario Andres 2009-09-23 03:48:17 UTC
*** Bug 208144 has been marked as a duplicate of this bug. ***
Comment 7 Tommi Tervo 2009-09-25 17:47:09 UTC
*** Bug 208460 has been marked as a duplicate of this bug. ***
Comment 8 Tommi Tervo 2009-09-28 08:41:35 UTC
*** Bug 208740 has been marked as a duplicate of this bug. ***
Comment 9 Tommi Tervo 2009-09-29 09:15:06 UTC
bt from trunk (r1028766)
I had to search something first and go back to bseindia search page and search again until konqueror crashed.

#6  khtml::InputTextCommandImpl::prepareForTextInsertion (this=0x8cdc160, adjustDownstream=false) at /u/staff/teve/scratch/kdelibs/khtml/editing/htmlediting_impl.cpp:1826
#7  0xb465f0c9 in khtml::InputTextCommandImpl::execute (this=0x8cdc160, text=@0xbfbf5258) at /u/staff/teve/scratch/kdelibs/khtml/editing/htmlediting_impl.cpp:1915
#8  0xb465fa82 in khtml::TypingCommandImpl::insertText (this=0x8d0f648, text=@0xbfbf5258) at /u/staff/teve/scratch/kdelibs/khtml/editing/htmlediting_impl.cpp:1781
#9  0xb465fecb in khtml::TypingCommandImpl::insertText0 (document=0x8a220c8, text=@0xbfbf5258) at /u/staff/teve/scratch/kdelibs/khtml/editing/htmlediting_impl.cpp:2723
#10 0xb4649240 in DOM::Editor::handleKeyEvent (this=0x8c088b0, _ke=0x8cd8810) at /u/staff/teve/scratch/kdelibs/khtml/editing/editor.cpp:566
#11 0xb44b336d in DOM::ElementImpl::defaultEventHandler (this=0x8ca7f58, e=0x89a1d18) at /u/staff/teve/scratch/kdelibs/khtml/xml/dom_elementimpl.cpp:809
#12 0xb4519d1f in DOM::HTMLGenericFormElementImpl::defaultEventHandler (this=0x8ca7f58, evt=0x89a1d18) at /u/staff/teve/scratch/kdelibs/khtml/html/html_formimpl.cpp:1114
#13 0xb452a3e2 in DOM::HTMLInputElementImpl::defaultEventHandler (this=0x8ca7f58, evt=0x89a1d18) at /u/staff/teve/scratch/kdelibs/khtml/html/html_formimpl.cpp:1954
#14 0xb44aa002 in DOM::NodeImpl::dispatchGenericEvent (this=0x8ca7f58, evt=0x89a1d18) at /u/staff/teve/scratch/kdelibs/khtml/xml/dom_nodeimpl.cpp:526
#15 0xb44aa1e6 in DOM::NodeImpl::dispatchEvent (this=0x8ca7f58, evt=0x89a1d18, exceptioncode=@0xbfbf5418, tempEvent=true) at /u/staff/teve/scratch/kdelibs/khtml/xml/dom_nodeimpl.cpp:453
#16 0xb44aaaec in DOM::NodeImpl::dispatchKeyEvent (this=0x8ca7f58, key=0xbfbf58fc, keypress=true) at /u/staff/teve/scratch/kdelibs/khtml/xml/dom_nodeimpl.cpp:694
#17 0xb43ff72e in KHTMLView::dispatchKeyEventHelper (this=0x8defec0, _ke=0xbfbf58fc, keypress=<value optimized out>) at /u/staff/teve/scratch/kdelibs/khtml/khtmlview.cpp:1672
#18 0xb4402833 in KHTMLView::dispatchKeyEvent (this=0x8defec0, _ke=0xbfbf58fc) at /u/staff/teve/scratch/kdelibs/khtml/khtmlview.cpp:1628
#19 0xb440ba7b in KHTMLView::keyPressEvent (this=0x8defec0, _ke=0xbfbf58fc) at /u/staff/teve/scratch/kdelibs/khtml/khtmlview.cpp:1749
#20 0xb4409e34 in KHTMLView::eventFilter (this=0x8defec0, o=0x8d2c740, e=0xbfbf58fc) at /u/staff/teve/scratch/kdelibs/khtml/khtmlview.cpp:2287
#21 0xb742a1ca in QCoreApplicationPrivate::sendThroughObjectEventFilters () from /u/staff/teve/scratch/apps/lib/libQtCore.so.4
#22 0xb6c37d0a in QApplicationPrivate::notify_helper () from /u/staff/teve/scratch/apps/lib/libQtGui.so.4
#23 0xb6c40905 in QApplication::notify () from /u/staff/teve/scratch/apps/lib/libQtGui.so.4
#24 0xb798e06d in KApplication::notify (this=0xbfbf6508, receiver=0x8d2c740, event=0xbfbf58fc) at /u/staff/teve/scratch/kdelibs/kdeui/kernel/kapplication.cpp:302
#25 0xb742af8b in QCoreApplication::notifyInternal () from /u/staff/teve/scratch/apps/lib/libQtCore.so.4
#26 0xb6c391ee in ?? () from /u/staff/teve/scratch/apps/lib/libQtGui.so.4
Comment 10 Viacheslav Tokarev 2009-09-29 17:56:26 UTC
The reduced test case is like that:
<div>
    <input contenteditable=""></input>
</div>

The problem is that selection is not set (i.e. the caret position here) before typing command execution
Comment 11 Viacheslav Tokarev 2009-09-30 18:12:50 UTC
SVN commit 1029732 by vtokarev:

don't handle event if it was before
BUG: 189173

 M  +1 -1      dom_elementimpl.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1029732
Comment 12 Frank Reininghaus 2009-10-04 17:29:07 UTC
*** Bug 209414 has been marked as a duplicate of this bug. ***
Comment 13 Dario Andres 2009-10-09 01:37:14 UTC
@Viacheslav Tokarev: was your fix backported to 4.3.x too ? Thanks
Comment 14 Dario Andres 2009-10-09 01:38:02 UTC
*** Bug 209860 has been marked as a duplicate of this bug. ***
Comment 15 Dario Andres 2009-10-09 03:03:10 UTC
*** Bug 209808 has been marked as a duplicate of this bug. ***
Comment 16 Frank Reininghaus 2009-10-09 20:02:49 UTC
(In reply to comment #13)
> @Viacheslav Tokarev: was your fix backported to 4.3.x too ? Thanks

The fix is in 4.3.2 according to WebSVN:
http://websvn.kde.org/tags/KDE/4.3.2/kdelibs/khtml/xml/dom_elementimpl.cpp?view=log
Comment 17 Frank Reininghaus 2009-10-09 20:03:39 UTC
*** Bug 210004 has been marked as a duplicate of this bug. ***
Comment 18 Tommi Tervo 2009-10-13 08:35:21 UTC
*** Bug 210396 has been marked as a duplicate of this bug. ***
Comment 19 Frank Reininghaus 2009-10-20 19:42:24 UTC
*** Bug 211165 has been marked as a duplicate of this bug. ***
Comment 20 Frank Reininghaus 2009-10-20 19:44:22 UTC
@Viacheslav: KDE 4.3.2 still crashes according to the last two duplicates although it seems that your commit is in there :-( 

Maybe this report should be reopened?
Comment 21 Maksim Orlovich 2009-10-20 20:40:18 UTC
Yeah, it should be :(
Comment 22 Dario Andres 2009-10-22 16:14:49 UTC
Bug 211449 seems to be this (on 4.4) but with an assert. Can you confirm it is the same ? Thanks
Comment 23 Tommi Tervo 2009-10-25 09:32:26 UTC
*** Bug 211742 has been marked as a duplicate of this bug. ***
Comment 24 Jakob Petsovits 2009-10-25 22:29:08 UTC
I could repeatedly reproduce it with the Facebook status message textbox on my new Arch system. Running it through gdb, here's the current backtrace:

#0  khtml::InputTextCommandImpl::prepareForTextInsertion (this=0x2733b90,                        
    adjustDownstream=<value optimized out>)                                                      
    at (...)/kdelibs-4.3.2/khtml/editing/htmlediting_impl.cpp:1574  
#1  0x00007fffdfabcc81 in khtml::InputTextCommandImpl::execute (this=0x2733b90, text=...)
    at (...)/kdelibs-4.3.2/khtml/editing/htmlediting_impl.cpp:1650
#2  0x00007fffdfab5f57 in khtml::TypingCommandImpl::insertText (this=0x2733cd0, text=...)
    at (...)/kdelibs-4.3.2/khtml/editing/htmlediting_impl.cpp:2373
#3  0x00007fffdfaafae8 in khtml::TypingCommand::insertText (document=0x987fa0, text=...)
    at (...)/kdelibs-4.3.2/khtml/editing/htmlediting.cpp:745
#4  0x00007fffdfaab938 in DOM::Editor::handleKeyEvent (this=0x247ff50,
    _ke=<value optimized out>)
    at (...)/kdelibs-4.3.2/khtml/editing/editor.cpp:528
#5  0x00007fffdf933ba2 in DOM::ElementImpl::defaultEventHandler (this=0x2635880, e=0x27cbdd0)
    at (...)/kdelibs-4.3.2/khtml/xml/dom_elementimpl.cpp:810
#6  0x00007fffdf92b184 in DOM::NodeImpl::dispatchGenericEvent (this=0x2635880, evt=0x27cbdd0)
    at (...)/kdelibs-4.3.2/khtml/xml/dom_nodeimpl.cpp:526
#7  0x00007fffdf92b37e in DOM::NodeImpl::dispatchEvent (this=0x2635880, evt=0x27cbdd0,
    exceptioncode=@0x7fffffffaeac, tempEvent=true)
    at (...)/kdelibs-4.3.2/khtml/xml/dom_nodeimpl.cpp:453
#8  0x00007fffdf92bc82 in DOM::NodeImpl::dispatchKeyEvent (this=<value optimized out>,
    key=0x7fffffffb830, keypress=<value optimized out>)
    at (...)/kdelibs-4.3.2/khtml/xml/dom_nodeimpl.cpp:694
#9  0x00007fffdf891d3d in KHTMLView::dispatchKeyEvent (this=0xb06c70, _ke=0x7fffffffb830)
    at (...)/kdelibs-4.3.2/khtml/khtmlview.cpp:1628
#10 0x00007fffdf89a5e1 in KHTMLView::keyPressEvent (this=0xb06c70, _ke=0x7fffffffb830)
    at (...)/kdelibs-4.3.2/khtml/khtmlview.cpp:1749
#11 0x00007ffff494ef12 in QWidget::event(QEvent*) () from /usr/lib/libQtGui.so.4
#12 0x00007ffff4ca82b6 in QFrame::event(QEvent*) () from /usr/lib/libQtGui.so.4
#13 0x00007ffff4d36fe9 in QAbstractScrollArea::event(QEvent*) () from /usr/lib/libQtGui.so.4
#14 0x00007fffdf898c57 in KHTMLView::event (this=0xb06c70, e=<value optimized out>)
    at (...)/kdelibs-4.3.2/khtml/khtmlview.cpp:546
#15 0x00007ffff490060c in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /usr/lib/libQtGui.so.4
#16 0x00007ffff49083f3 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4
#17 0x00007ffff60655a6 in KApplication::notify (this=0x7fffffffdb10, receiver=0xb06c70,
    event=0x7fffffffb830)
    at (...)/kdelibs-4.3.2/kdeui/kernel/kapplication.cpp:302
#18 0x00007ffff545433c in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
   from /usr/lib/libQtCore.so.4
#19 0x00007ffff499005a in ?? () from /usr/lib/libQtGui.so.4
#20 0x00007ffff49925a1 in ?? () from /usr/lib/libQtGui.so.4
#21 0x00007ffff496ba24 in QApplication::x11ProcessEvent(_XEvent*) () from /usr/lib/libQtGui.so.4
#22 0x00007ffff4993efc in ?? () from /usr/lib/libQtGui.so.4
#23 0x00007ffff11ea1fe in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#24 0x00007ffff11edbb8 in g_main_context_iterate () from /usr/lib/libglib-2.0.so.0
#25 0x00007ffff11edce0 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#26 0x00007ffff547c863 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#27 0x00007ffff49936de in ?? () from /usr/lib/libQtGui.so.4
#28 0x00007ffff5452c72 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /usr/lib/libQtCore.so.4
#29 0x00007ffff5453044 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /usr/lib/libQtCore.so.4
#30 0x00007ffff54551f9 in QCoreApplication::exec() () from /usr/lib/libQtCore.so.4
#31 0x00007ffff7bb26b6 in kdemain (argc=<value optimized out>, argv=<value optimized out>)
    at (...)/kdebase-4.3.2/apps/konqueror/src/konqmain.cpp:271


Also note that KHTML tried to paint on a non-active QPainter (twice) on that page when initially loading it. Probably unrelated, but who knows:

QPainter::begin: Widget painting can only begin as a result of a paintEvent
QPainter::translate: Painter not active                                    
QPainter::setClipRect: Painter not active                                  
QPainter::hasClipping: Painter not active                                  
QPainter::setPen: Painter not active                                       
QPainter::setBrush: Painter not active                                     
QPainter::drawRects: Painter not active                                    
QPainter::setPen: Painter not active                                       
QPainter::worldTransform: Painter not active                               
QPainter::hasClipping: Painter not active                                  
QPainter::setPen: Painter not active                                       
QPainter::setBrush: Painter not active
(...)

If you need certain values in there, I am confident that we can whip up an RDC connection and that it will reproduce again. Or if you've got a specific suspicion, just ask in here.
Comment 25 Maksim Orlovich 2009-10-29 01:41:48 UTC
SVN commit 1042044 by orlovich:

Better handling of the case where we get editting input events w/o a proper
caret set --- such as when facebook apparently rewrites textareas into 
content-editable divs in a middle of handling of a click.... Either
grab the caret, or drop the event. Should hopefully finally fix 
the prepareForTextInsertion crasher on facebook

BUG:189173    
BUG:211449
BUG:212138
BUG:212175



 M  +16 -2     editor.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1042044
Comment 26 Maksim Orlovich 2009-10-29 02:12:09 UTC
SVN commit 1042054 by orlovich:

automatically merged revision 1042044:
Better handling of the case where we get editting input events w/o a proper
caret set --- such as when facebook apparently rewrites textareas into 
content-editable divs in a middle of handling of a click.... Either
grab the caret, or drop the event. Should hopefully finally fix 
the prepareForTextInsertion crasher on facebook

BUG:189173    
BUG:211449
BUG:212138
BUG:212175

 M  +16 -2     editor.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1042054
Comment 27 Frank Reininghaus 2009-11-10 13:55:54 UTC
*** Bug 213920 has been marked as a duplicate of this bug. ***
Comment 28 Dario Andres 2009-11-14 03:37:32 UTC
*** Bug 214469 has been marked as a duplicate of this bug. ***
Comment 29 Frank Reininghaus 2009-11-27 11:52:17 UTC
*** Bug 216326 has been marked as a duplicate of this bug. ***
Comment 30 Maksim Orlovich 2010-03-17 15:48:38 UTC
*** Bug 231071 has been marked as a duplicate of this bug. ***
Comment 31 Dario Andres 2010-03-21 21:25:59 UTC
*** Bug 231578 has been marked as a duplicate of this bug. ***