Bug 31765 – Qt WebKit crashes when clicking on/selecting text on certain websites

• Component: New Bugs
• Status: RESOLVED FIXED

I can reproduce this bug with Qt 4.5.3 and Qt 4.6.0rc1 on multiple machines running both ubuntu 9.10 and CentOS 5.2 with plugins enabled or disabled. I have created a simple Qt webkit app which guarantees a segfault when clicking on the main body text on the sample page ("http://www.smh.com.au/news/entertainment/articles/2009/11/20/1258219954593.html" so far this is the only page I have seen which crashes webkit in this way, but there may be other pages also).

Basically, just load the page and click on or select the main article text a few times (sometimes it happens after a single click, other times it requires a few clicks on the text).

Log:

** (<unknown>:2559): CRITICAL **: atk_object_set_name: assertion `name != NULL' failed
Segmentation fault


Basic webkit app which guarantees segfault for me:

#include <QtGui/QApplication>
#include <QtWebKit/QWebView>

int main(int argc, char *argv[]) {
 QApplication app(argc, argv);
 QWebView webView;
 webView.settings()->setAttribute(QWebSettings::PluginsEnabled,true);
 webView.setUrl(QUrl::fromEncoded("http://www.smh.com.au/news/entertainment/articles/2009/11/20/1258219954593.html"));
 webView.show();
 return app.exec();
}

BTW the log message:

** (<unknown>:2559): CRITICAL **: atk_object_set_name: assertion `name != NULL'
failed

Comes up as soon as the application is launched and is most likely unrelated to the crash.

[Girish Ramakrishnan]

Works with r51026. Page seems to be using windowless plugins which is supported only in 4.6.

[Girish Ramakrishnan]

Sorry, I should have read the complete description :-)

I am able to reproduce the crash with r51026. I don't have a debug build to get a backtrace.

[Antonio Gomes]

totally reproducible here too.

backtrace coming ...

[Antonio Gomes]

Created attachment 43950 [details]
backtrace 1

backtrace from QtLauncher (r51397) debug build

[Simon Hausmann]

Hmm, interesting! Is the crash reproducible when recording this paint sequence using the trace graphics system and replaying it?

Such a trace would make it a lot easier to fix inside of Qt.

[Andreas Kling]

Created attachment 47561 [details]
Reduced Qt-only testcase

The QRegion-from-a-QPolygon constructor reliably crashes with certain input data.

[Andreas Kling]

This issue is now being tracked in the Qt bug tracker:
http://bugreports.qt.nokia.com/browse/QTBUG-7699

[Tor Arne Vestbø]

Please follow the QtWebKit bug reporting guidelines when reporting bugs.

See http://trac.webkit.org/wiki/QtWebKitBugs

Specifically:

  - The 'QtWebKit' component should be used for bugs/features in the public QtWebKit API layer, not to signify that the bug is specific to the Qt port of WebKit

    http://trac.webkit.org/wiki/QtWebKitBugs#Component

[Tor Arne Vestbø]

Fix should be available in Qt soonish (it's in staging). Please close when verified.

[Andreas Kling]

Fixed for Qt 4.6.3, see http://bugreports.qt.nokia.com/browse/QTBUG-7699