When loading a web page that contains a large HTML5 canvas in an application linked against KDE libraries (such as konqueror), the library segfaults. Reproducible: Always Steps to Reproduce: 1. Download the crash.html attachment 2 [details]. In a terminal type: konqueror crash.html Actual Results: segmentation fault Expected Results: no crash
Created attachment 77191 [details] loading this html causes crash in konqueror
I can reproduce it. #0 Tile (this=0xb0c2fff8) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/imload/tile.h:55 #1 PixmapTile (this=0xb0c2fff8) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/imload/pixmaptile.h:47 #2 Array2D (this=0x85dca30, _rows=174, _cols=1736112) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/imload/array2d.h:43 #3 PixmapPlane (_parent=0x85dc9fc, _height=<optimized out>, _width=111111111, this=0x85dca18) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/imload/pixmapplane.h:49 #4 khtmlImLoad::CanvasImage::setupOriginalPlane (this=0x85dc720, width=111111111, height=11111) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/imload/canvasimage.cpp:59 #5 0xb2eca5a3 in khtmlImLoad::CanvasImage::CanvasImage (this=0x85dc720, width=111111111, height=11111) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/imload/canvasimage.cpp:65 #6 0xb2ccde38 in DOM::CanvasContext2DImpl::resetContext (this=0x85dc5d8, width=111111111, height=11111) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/html_canvasimpl.cpp:232 #7 0xb2ccdf63 in DOM::CanvasContext2DImpl::CanvasContext2DImpl (this=0x85dc5d8, element=0x85dc920, width=111111111, height=11111) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/html_canvasimpl.cpp:211 #8 0xb2cce018 in DOM::HTMLCanvasElementImpl::getContext2D (this=0x85dc920) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/html_canvasimpl.cpp:168 #9 0xb2cce34f in DOM::HTMLCanvasElementImpl::getCanvasImage (this=0x85dc920) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/html_canvasimpl.cpp:174 #10 0xb2d5742e in khtml::RenderCanvasImage::RenderCanvasImage (this=0x850a9e8, canvasEl=0x85dc920) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/rendering/render_canvasimage.cpp:54 #11 0xb2cc8d37 in DOM::HTMLCanvasElementImpl::attach (this=0x85dc920) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/html_canvasimpl.cpp:154 #12 0xb2c7a546 in khtml::KHTMLParser::insertNode (this=0x84c6ba8, n=0x85dc920, flat=<optimized out>) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/htmlparser.cpp:428 #13 0xb2c7cd74 in khtml::KHTMLParser::parseToken (this=0x84c6ba8, t=0x84f804c) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/htmlparser.cpp:301 #14 0xb2c7e30e in khtml::HTMLTokenizer::processToken (this=0x84f8038) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/htmltokenizer.cpp:2037 #15 0xb2c850c0 in khtml::HTMLTokenizer::parseTag (this=0x84f8038, src=...) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/htmltokenizer.cpp:1502 #16 0xb2c87a06 in khtml::HTMLTokenizer::write (this=0x84f8038, str=..., appendData=true) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/html/htmltokenizer.cpp:1795 #17 0xb2ba5532 in KHTMLPart::write (this=0x83e5a60, data=0x84e1550 "<html>\n <body>\n <canvas id=\"myCanvas\" width=\"111111111\" height=\"11111\"></canvas>\n </body>\n</html>\n", len=<optimized out>) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/khtml_part.cpp:2110 #18 0xb2ba130a in KHTMLPart::slotData (this=0x83e5a60, kio_job=0x849fea0, data=...) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/khtml/khtml_part.cpp:1758 #19 0xb2bcd74c in KHTMLPart::qt_static_metacall (_o=0x83e5a60, _c=QMetaObject::InvokeMetaMethod, _id=19, _a=0xbfffd164) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999_build/khtml/khtml_part.moc:253 #20 0xb63dc0c1 in QMetaObject::activate (sender=0x849fea0, m=0xb7a222cc <KIO::TransferJob::staticMetaObject>, local_signal_index=0, argv=0xbfffd164) at kernel/qobject.cpp:3539 #21 0xb784243d in KIO::TransferJob::data (this=0x849fea0, _t1=0x849fea0, _t2=...) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999_build/kio/jobclasses.moc:447 #22 0xb78424a8 in KIO::TransferJob::slotData (this=0x849fea0, _data=...) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kio/kio/job.cpp:981 #23 0xb7845167 in qt_static_metacall (_a=0xbfffd2d8, _id=8, _o=0x849fea0, _c=<optimized out>) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999_build/kio/jobclasses.moc:389 #24 KIO::TransferJob::qt_static_metacall (_o=0x849fea0, _c=QMetaObject::InvokeMetaMethod, _id=8, _a=0xbfffd2d8) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999_build/kio/jobclasses.moc:375 #25 0xb63dc0c1 in QMetaObject::activate (sender=0x84e09e0, m=0xb7a24480 <KIO::SlaveInterface::staticMetaObject>, local_signal_index=0, argv=0xbfffd2d8) at kernel/qobject.cpp:3539 #26 0xb78fdf75 in KIO::SlaveInterface::data (this=0x84e09e0, _t1=...) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999_build/kio/slaveinterface.moc:160 #27 0xb7901a7f in KIO::SlaveInterface::dispatch (this=0x84e09e0, _cmd=100, rawdata=...) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kio/kio/slaveinterface.cpp:160 #28 0xb78fd6aa in KIO::SlaveInterface::dispatch (this=0x84e09e0) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kio/kio/slaveinterface.cpp:88 #29 0xb78eec78 in KIO::Slave::gotInput (this=0x84e09e0) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kio/kio/slave.cpp:344 #30 0xb78ef2f8 in KIO::Slave::qt_static_metacall (_o=0x84e09e0, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0xbfffd560) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999_build/kio/slave.moc:57 #31 0xb63dc0c1 in QMetaObject::activate (sender=0x8473978, m=0xb7a21110 <KIO::Connection::staticMetaObject>, local_signal_index=0, argv=0x0) at kernel/qobject.cpp:3539 #32 0xb7807d35 in KIO::Connection::readyRead (this=0x8473978) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999_build/kio/connection.moc:106 #33 0xb78085ba in dequeue (this=<optimized out>) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kio/kio/connection.cpp:82 #34 KIO::ConnectionPrivate::dequeue (this=0x8299790) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kio/kio/connection.cpp:71 #35 0xb63d7411 in QMetaCallEvent::placeMetaCall (this=0x84ef708, object=0x8473978) at kernel/qobject.cpp:524 #36 0xb63e076b in QObject::event (this=0x8473978, e=0x84ef708) at kernel/qobject.cpp:1194 #37 0xb695de24 in notify_helper (e=0x84ef708, receiver=0x8473978, this=0x806ca00) at kernel/qapplication.cpp:4562 #38 QApplicationPrivate::notify_helper (this=0x806ca00, receiver=0x8473978, e=0x84ef708) at kernel/qapplication.cpp:4534 #39 0xb6963c7a in QApplication::notify (this=0x84ef708, receiver=0x8473978, e=0x84ef708) at kernel/qapplication.cpp:4291 #40 0xb74ca6a1 in KApplication::notify (this=0xbfffde84, receiver=0x8473978, event=0x84ef708) at /mnt/personal/build/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kdeui/kernel/kapplication.cpp:311 #41 0xb63c57fe in QCoreApplication::notifyInternal (this=0xbfffde84, receiver=0x8473978, event=0x84ef708) at kernel/qcoreapplication.cpp:946 #42 0xb63c93d0 in sendEvent (event=<optimized out>, receiver=<optimized out>) at kernel/qcoreapplication.h:231 #43 QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x804b370) at kernel/qcoreapplication.cpp:1570 #44 0xb63c970c in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at kernel/qcoreapplication.cpp:1463 #45 0xb63f7bc4 in sendPostedEvents () at kernel/qcoreapplication.h:236 #46 postEventSourceDispatch (s=0x806d848) at kernel/qeventdispatcher_glib.cpp:279 #47 0xb597b3a6 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #48 0xb597b748 in ?? () from /usr/lib/libglib-2.0.so.0 #49 0xb597b821 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 #50 0xb63f7fb7 in QEventDispatcherGlib::processEvents (this=0x804bef0, flags=...) at kernel/qeventdispatcher_glib.cpp:424 #51 0xb6a1081a in QGuiEventDispatcherGlib::processEvents (this=0x804bef0, flags=...) at kernel/qguieventdispatcher_glib.cpp:204 #52 0xb63c40ad in QEventLoop::processEvents (this=0xbfffdd44, flags=...) at kernel/qeventloop.cpp:149 #53 0xb63c4349 in QEventLoop::exec (this=0xbfffdd44, flags=...) at kernel/qeventloop.cpp:204 #54 0xb63c97ba in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1218 #55 0xb695b4e4 in QApplication::exec () at kernel/qapplication.cpp:3823 #56 0xb7f81f27 in kdemain () from /usr/lib/libkdeinit4_konqueror.so #57 0x0804861b in ?? () #58 0xb7d38ba3 in __libc_start_main (main=0x8048600, argc=2, ubp_av=0xbfffe1b4, init=0x8048700 <__libc_csu_init>, fini=0x8048770 <__libc_csu_fini>, rtld_fini=0xb7fed130 <_dl_fini>, stack_end=0xbfffe1ac) at libc-start.c:225 #59 0x08048641 in _start ()
Dear user, KHTML (and KJS) was a long time more or less unmaintained and got removed in KF6. Please migrate to use a QWebEngine based HTML component. We will do no further fixes or improvements to the KF5 branches of these components beside important security fixes. For security issues, please see: https://kde.org/info/security/ Sorry that we did not fix this issue during the life-time of KHTML. Greetings Christoph Cullmann