[WebKit-devel] [Bug 252473] New: Flash crashes KDEWebKit but not QtWebKit/Arora

Dawit Alemayehu adawit at kde.org
Tue Oct 19 19:08:48 CEST 2010 

https://bugs.kde.org/show_bug.cgi?id=252473

           Summary: Flash crashes KDEWebKit but not QtWebKit/Arora
           Product: kdelibs
           Version: 4.5
          Platform: openSUSE RPMs
        OS/Version: Linux
            Status: NEW
          Severity: crash
          Priority: NOR
         Component: kdewebkit
        AssignedTo: webkit-devel at kde.org
        ReportedBy: markus.s at kdemail.net
                CC: adawit at kde.org



Dawit Alemayehu <adawit at kde.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adawit at kde.org


Version:           4.5 (using KDE 4.5.1) 
OS:                Linux

I tried with both Rekonq and Konqueror+WebKit. Whenever I visit a website with
Flash, the browser crashes.
Arora loads the plugin just fine, so it can't be a QtWebKit bug.
Konqueror+KHTML works fine as well.

Reproducible: Didn't try




Application: rekonq (kdeinit4), signal: Segmentation fault
[Current thread is 1 (Thread 0xb5a9b710 (LWP 3974))]

Thread 6 (Thread 0xaf678b70 (LWP 3979)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb6e3c125 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0xb48c0857 in WTF::TCMalloc_PageHeap::runScavengerThread(void*) () from
/usr/lib/libQtWebKit.so.4
#3  0xb6e37b25 in start_thread () from /lib/libpthread.so.0
#4  0xb61ed46e in clone () from /lib/libc.so.6

Thread 5 (Thread 0xaadbfb70 (LWP 4000)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb6e3c125 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0xb39ff457 in QTWTF::TCMalloc_PageHeap::scavengerThread (this=0xb3b1e1a0)
at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:2359
#3  0xb39ff49f in QTWTF::TCMalloc_PageHeap::runScavengerThread
(context=0xb3b1e1a0) at
../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:1464
#4  0xb6e37b25 in start_thread () from /lib/libpthread.so.0
#5  0xb61ed46e in clone () from /lib/libc.so.6

Thread 4 (Thread 0xa9c60b70 (LWP 4016)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb6e3c125 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0xb6eb3980 in wait (this=0x819cff0, mutex=0x81a7308, time=4294967295) at
thread/qwaitcondition_unix.cpp:88
#3  QWaitCondition::wait (this=0x819cff0, mutex=0x81a7308, time=4294967295) at
thread/qwaitcondition_unix.cpp:160
#4  0xb3830056 in
ThreadWeaver::WeaverImpl::blockThreadUntilJobsAreBeingAssigned (this=0x819cfd8,
th=0x852dfd0) at
/usr/src/debug/kdelibs-4.5.1/threadweaver/Weaver/WeaverImpl.cpp:365
#5  0xb3833797 in waitForAvailableJob (this=0x819d0f8, th=0x852dfd0) at
/usr/src/debug/kdelibs-4.5.1/threadweaver/Weaver/WeaverImpl.cpp:356
#6  ThreadWeaver::WorkingHardState::applyForWork (this=0x819d0f8, th=0x852dfd0)
at /usr/src/debug/kdelibs-4.5.1/threadweaver/Weaver/WorkingHardState.cpp:71
#7  0xb382fa03 in ThreadWeaver::WeaverImpl::applyForWork (this=0x819cfd8,
th=0x852dfd0, previous=0x85462c0) at
/usr/src/debug/kdelibs-4.5.1/threadweaver/Weaver/WeaverImpl.cpp:351
#8  0xb3830564 in ThreadWeaver::ThreadRunHelper::run (this=0xa9c60314,
parent=0x819cfd8, th=0x852dfd0) at
/usr/src/debug/kdelibs-4.5.1/threadweaver/Weaver/Thread.cpp:87
#9  0xb383061a in ThreadWeaver::Thread::run (this=0x852dfd0) at
/usr/src/debug/kdelibs-4.5.1/threadweaver/Weaver/Thread.cpp:142
#10 0xb6eb327a in QThreadPrivate::start (arg=0x852dfd0) at
thread/qthread_unix.cpp:266
#11 0xb6e37b25 in start_thread () from /lib/libpthread.so.0
#12 0xb61ed46e in clone () from /lib/libc.so.6

Thread 3 (Thread 0xa76b8b70 (LWP 4021)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb6e3c125 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0xa834e2d7 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#3  0xa84532f5 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#4  0xa834ecd4 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#5  0xb6e37b25 in start_thread () from /lib/libpthread.so.0
#6  0xb61ed46e in clone () from /lib/libc.so.6

Thread 2 (Thread 0xa6eb7b70 (LWP 4022)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb6e3c125 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0xa834e2d7 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#3  0xa84532f5 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#4  0xa834ecd4 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#5  0xb6e37b25 in start_thread () from /lib/libpthread.so.0
#6  0xb61ed46e in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb5a9b710 (LWP 3974)):
[KCrash Handler]
#7  XtRemoveTimeOut (id=9) at NextEvent.c:803
#8  0xa834431c in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#9  0xa83458bc in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#10 0xa8345b0e in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#11 0xa8341905 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#12 0xa833abdb in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#13 0xa833e694 in ?? () from /usr/lib/browser-plugins/libflashplayer.so
#14 0xb44b444d in WebCore::PluginView::stop() () from /usr/lib/libQtWebKit.so.4
#15 0xb44b5172 in WebCore::PluginView::~PluginView() () from
/usr/lib/libQtWebKit.so.4
#16 0xb44b5692 in WebCore::PluginView::~PluginView() () from
/usr/lib/libQtWebKit.so.4
#17 0xb411b618 in WTF::RefCounted<WebCore::Widget>::deref() () from
/usr/lib/libQtWebKit.so.4
#18 0xb456e67e in WTF::HashTable<WTF::RefPtr<WebCore::Widget>,
std::pair<WTF::RefPtr<WebCore::Widget>, WebCore::FrameView*>,
WTF::PairFirstExtractor<std::pair<WTF::RefPtr<WebCore::Widget>,
WebCore::FrameView*> >, WTF::PtrHash<WTF::RefPtr<WebCore::Widget> >,
WTF::PairHashTraits<WTF::HashTraits<WTF::RefPtr<WebCore::Widget> >,
WTF::HashTraits<WebCore::FrameView*> >,
WTF::HashTraits<WTF::RefPtr<WebCore::Widget> >
>::deallocateTable(std::pair<WTF::RefPtr<WebCore::Widget>,
WebCore::FrameView*>*, int) () from /usr/lib/libQtWebKit.so.4
#19 0xb456f5a6 in WebCore::RenderWidget::resumeWidgetHierarchyUpdates() () from
/usr/lib/libQtWebKit.so.4
#20 0xb41fcbbe in WebCore::Element::detach() () from /usr/lib/libQtWebKit.so.4
#21 0xb41d1d8b in WebCore::ContainerNode::detach() () from
/usr/lib/libQtWebKit.so.4
#22 0xb41e9b7b in WebCore::Document::detach() () from /usr/lib/libQtWebKit.so.4
#23 0xb4427724 in WebCore::Frame::setView(WTF::PassRefPtr<WebCore::FrameView>)
() from /usr/lib/libQtWebKit.so.4
#24 0xb4428796 in WebCore::Frame::createView(WebCore::IntSize const&,
WebCore::Color const&, bool, WebCore::IntSize const&, bool,
WebCore::ScrollbarMode, bool, WebCore::ScrollbarMode, bool) ()
   from /usr/lib/libQtWebKit.so.4
#25 0xb45deed4 in
WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage() () from
/usr/lib/libQtWebKit.so.4
#26 0xb43b35bf in
WebCore::FrameLoader::transitionToCommitted(WTF::PassRefPtr<WebCore::CachedPage>)
() from /usr/lib/libQtWebKit.so.4
#27 0xb43b76e1 in
WebCore::FrameLoader::commitProvisionalLoad(WTF::PassRefPtr<WebCore::CachedPage>)
() from /usr/lib/libQtWebKit.so.4
#28 0xb43a0437 in WebCore::DocumentLoader::commitIfReady() () from
/usr/lib/libQtWebKit.so.4
#29 0xb43a04a6 in WebCore::DocumentLoader::commitLoad(char const*, int) () from
/usr/lib/libQtWebKit.so.4
#30 0xb43a960b in WebCore::FrameLoader::receivedData(char const*, int) () from
/usr/lib/libQtWebKit.so.4
#31 0xb43d29db in WebCore::MainResourceLoader::addData(char const*, int, bool)
() from /usr/lib/libQtWebKit.so.4
#32 0xb43e3872 in WebCore::ResourceLoader::didReceiveData(char const*, int,
long long, bool) () from /usr/lib/libQtWebKit.so.4
#33 0xb43d3578 in WebCore::MainResourceLoader::didReceiveData(char const*, int,
long long, bool) () from /usr/lib/libQtWebKit.so.4
#34 0xb43e1fdf in
WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*,
int, int) () from /usr/lib/libQtWebKit.so.4
#35 0xb45be285 in WebCore::QNetworkReplyHandler::forwardData() () from
/usr/lib/libQtWebKit.so.4
#36 0xb45bed1c in WebCore::QNetworkReplyHandler::qt_metacall(QMetaObject::Call,
int, void**) () from /usr/lib/libQtWebKit.so.4
#37 0xb6fb896d in QMetaObject::metacall (object=0x854cbe0,
cl=QMetaObject::InvokeMetaMethod, idx=7, argv=0xbf99b6cc) at
kernel/qmetaobject.cpp:237
#38 0xb6fc8b1c in QMetaObject::activate (sender=0x842d628, m=0xb70ebc48,
local_signal_index=0, argv=0x0) at kernel/qobject.cpp:3272
#39 0xb7015875 in QIODevice::readyRead (this=0x842d628) at
.moc/release-shared/moc_qiodevice.cpp:91
#40 0xb57f0c18 in KDEPrivate::AccessManagerReply::appendData (this=0x842d628,
kioJob=0x8589a88, data=...) at
/usr/src/debug/kdelibs-4.5.1/kio/kio/accessmanagerreply_p.cpp:168
#41 0xb57f0d5c in KDEPrivate::AccessManagerReply::qt_metacall (this=0x842d628,
_c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0xbf99b834)
    at /usr/src/debug/kdelibs-4.5.1/build/kio/accessmanagerreply_p.moc:81
#42 0xb6fb896d in QMetaObject::metacall (object=0x842d628,
cl=QMetaObject::InvokeMetaMethod, idx=15, argv=0xbf99b834) at
kernel/qmetaobject.cpp:237
#43 0xb6fc8b1c in QMetaObject::activate (sender=0x8589a88, m=0xb5933360,
local_signal_index=0, argv=0xbf99b834) at kernel/qobject.cpp:3272
#44 0xb5752cdd in KIO::TransferJob::data (this=0x8589a88, _t1=0x8589a88,
_t2=...) at /usr/src/debug/kdelibs-4.5.1/build/kio/jobclasses.moc:388
#45 0xb5752d48 in KIO::TransferJob::slotData (this=0x8589a88, _data=...) at
/usr/src/debug/kdelibs-4.5.1/kio/kio/job.cpp:1003
#46 0xb5856563 in KIO::TransferJob::qt_metacall (this=0x8589a88,
_c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0xbf99b9c8)
    at /usr/src/debug/kdelibs-4.5.1/build/kio/jobclasses.moc:368
#47 0xb6fb896d in QMetaObject::metacall (object=0x8589a88,
cl=QMetaObject::InvokeMetaMethod, idx=48, argv=0xbf99b9c8) at
kernel/qmetaobject.cpp:237
#48 0xb6fc8b1c in QMetaObject::activate (sender=0x8413eb8, m=0xb5933660,
local_signal_index=0, argv=0xbf99b9c8) at kernel/qobject.cpp:3272
#49 0xb5767f85 in KIO::SlaveInterface::data (this=0x8413eb8, _t1=...) at
/usr/src/debug/kdelibs-4.5.1/build/kio/slaveinterface.moc:146
#50 0xb5894948 in KIO::SlaveInterface::dispatch (this=0x8413eb8, _cmd=100,
rawdata=...) at /usr/src/debug/kdelibs-4.5.1/kio/kio/slaveinterface.cpp:163
#51 0xb582821a in KIO::SlaveInterface::dispatch (this=0x8413eb8) at
/usr/src/debug/kdelibs-4.5.1/kio/kio/slaveinterface.cpp:91
#52 0xb58271b8 in KIO::Slave::gotInput (this=0x8413eb8) at
/usr/src/debug/kdelibs-4.5.1/kio/kio/slave.cpp:344
#53 0xb582c3ec in KIO::Slave::qt_metacall (this=0x8413eb8,
_c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0xbf99bc8c) at
/usr/src/debug/kdelibs-4.5.1/build/kio/slave.moc:82
#54 0xb6fb896d in QMetaObject::metacall (object=0x8413eb8,
cl=QMetaObject::InvokeMetaMethod, idx=30, argv=0xbf99bc8c) at
kernel/qmetaobject.cpp:237
#55 0xb6fc8b1c in QMetaObject::activate (sender=0x8414df8, m=0xb5933250,
local_signal_index=0, argv=0x0) at kernel/qobject.cpp:3272
#56 0xb57491e5 in KIO::Connection::readyRead (this=0x8414df8) at
/usr/src/debug/kdelibs-4.5.1/build/kio/connection.moc:92
#57 0xb582c15a in KIO::ConnectionPrivate::dequeue (this=0x8413bc8) at
/usr/src/debug/kdelibs-4.5.1/kio/kio/connection.cpp:82
#58 0xb582c22f in KIO::Connection::qt_metacall (this=0x8414df8,
_c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x8301e50) at
/usr/src/debug/kdelibs-4.5.1/build/kio/connection.moc:79
#59 0xb6fb896d in QMetaObject::metacall (object=0x8414df8,
cl=QMetaObject::InvokeMetaMethod, idx=5, argv=0x8301e50) at
kernel/qmetaobject.cpp:237
#60 0xb6fc3465 in QMetaCallEvent::placeMetaCall (this=0x84d7298,
object=0x8414df8) at kernel/qobject.cpp:534
#61 0xb6fc769f in QObject::event (this=0x8414df8, e=0x84d7298) at
kernel/qobject.cpp:1211
#62 0xb64b21a4 in QApplicationPrivate::notify_helper (this=0x80cf120,
receiver=0x8414df8, e=0x84d7298) at kernel/qapplication.cpp:4396
#63 0xb64badd7 in QApplication::notify (this=0xbf99c594, receiver=0x8414df8,
e=0x84d7298) at kernel/qapplication.cpp:3798
#64 0xb75f9401 in KApplication::notify (this=0xbf99c594, receiver=0x8414df8,
event=0x84d7298) at
/usr/src/debug/kdelibs-4.5.1/kdeui/kernel/kapplication.cpp:310
#65 0xb6fb212e in QCoreApplication::notifyInternal (this=0xbf99c594,
receiver=0x8414df8, event=0x84d7298) at kernel/qcoreapplication.cpp:732
#66 0xb6fb5e6c in sendEvent (receiver=0x0, event_type=0, data=0x80572a0) at
kernel/qcoreapplication.h:215
#67 QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0,
data=0x80572a0) at kernel/qcoreapplication.cpp:1373
#68 0xb6fb5fbc in QCoreApplication::sendPostedEvents (receiver=0x0,
event_type=0) at kernel/qcoreapplication.cpp:1266
#69 0xb6fe06d4 in sendPostedEvents (s=0x80d1588) at
kernel/qcoreapplication.h:220
#70 postEventSourceDispatch (s=0x80d1588) at
kernel/qeventdispatcher_glib.cpp:277
#71 0xb5ceeb49 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#72 0xb5cef350 in ?? () from /usr/lib/libglib-2.0.so.0
#73 0xb5cef60e in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#74 0xb6fe085b in QEventDispatcherGlib::processEvents (this=0x80cfa38,
flags=...) at kernel/qeventdispatcher_glib.cpp:415
#75 0xb656719a in QGuiEventDispatcherGlib::processEvents (this=0x80cfa38,
flags=...) at kernel/qguieventdispatcher_glib.cpp:204
#76 0xb6fb140d in QEventLoop::processEvents (this=0xbf99c4e4, flags=...) at
kernel/qeventloop.cpp:149
#77 0xb6fb1639 in QEventLoop::exec (this=0xbf99c4e4, flags=...) at
kernel/qeventloop.cpp:201
#78 0xb6fb6090 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1009
#79 0xb64afed4 in QApplication::exec () at kernel/qapplication.cpp:3672
#80 0xb1ab46fb in kdemain (argc=1, argv=0x80b38f0) at
/usr/src/debug/rekonq/src/main.cpp:198
#81 0x0804e441 in _start ()

--- Comment #1 from Dawit Alemayehu <adawit kde org>  2010-10-19 19:05:03 ---
Qt 4.6 or 4.7 ? x86-64 or i686 ? Any particular site or does the crash happen
on any site that contains flash content ? 

The backtrace you provided clearly shows that the crash is upstream in
QtWebKit.  And there were a couple of known QtWebkit crashes caused by Adobe's
flash player that were addressed recently:

https://bugs.webkit.org/show_bug.cgi?id=40567
https://bugs.webkit.org/show_bug.cgi?id=45363

However, none of those produce the backtrace you provided and the fact that the
problem is not reproduciable with Arora makes this a baffling problem. Hmm...
and the only XtRemoveTimeOut related flash crashes were observed with KDE's
nsplugin viewer with older versions of adobe's flash player. See
http://www.kdedevelopers.org/node/3162. What version of the flash player are
you using ?

-- 
Configure bugmail: https://bugs.kde.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the WebKit-devel mailing list