Bug 59684 – [Qt] QtTestBrowser built with RVCT4.0 crashes when any plugin is loaded into html page containing iframe with display:none style.

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: Frames

Created attachment 91461 [details]
Sample html files to reproduce the crash

Overview: 
    Qttestbrowser crashes when any plugin is loaded into html page containing iframe with display:none style. This happens only in RVCT 4.0 based builds.

Steps to Reproduce:
    1. Open the attached sample html file using qttestbrowser.(main.html)
   
Actual Results:
    The application crashed.

Expected Results:
    The application should not crash, since iframe display is set to none, plugin should not be visible.

Additional Builds and Platforms:
    This crash happens only on RVCT 4.0 based builds, not for RVCT 2.2 builds.If display:none is not set, there is no crash.

WRT Bugzilla Entry : WRT 7796

[Laszlo Gombos]

Vinesh, do you have the following fix - http://trac.webkit.org/changeset/80796. This is essential to have a functioning WebKit with RVCT 4 ?

(In reply to comment #1)
> Vinesh, do you have the following fix - http://trac.webkit.org/changeset/80796. This is essential to have a functioning WebKit with RVCT 4 ?

This fix is part qtwebkit webkit.pri file.

[Janne Koskinen]

Created attachment 92213 [details]
Unfiltered call stack from MCL W17

iFrame alone won't cause the crash. you need a plugin object as well. Didn't test if other plugin than Flash causes this.
Crash is EExcDataAbort and R0 is 0 -> null pointer.

I don't have this environment with source, so looking other ways to reproduce this.

[Janne Koskinen]

If display is none we don't have renderer (RenderObject) and app crashes when plugins are updating on null renderer.

http://www.w3.org/TR/CSS2/visuren.html#propdef-display

I tried reading what the standard says if everything in display:none should be running or not. Alas, there wasn't any conclusive answer. If we have continuous animation like in the test case hiding and revealing will have different effect if running or not.

[Joe Wild]

Wanted to point out that there is a similar error.  May not be a complete duplicate since this seems to involve plugins.

https://bugs.webkit.org/show_bug.cgi?id=56393
Bug 56393 - Without checking existence of the renderer of the
element,tries to access the enclosing layer.

[Janne Koskinen]

(In reply to comment #5)
> Wanted to point out that there is a similar error.  May not be a complete duplicate since this seems to involve plugins.
> 
> https://bugs.webkit.org/show_bug.cgi?id=56393
> Bug 56393 - Without checking existence of the renderer of the
> element,tries to access the enclosing layer.

Thanks, it indeed looks very similar. I have to try that layer check on Monday. I'm pretty sure that would fix this issue.
This particular crash can be worked around also in plugin callback level. I have few options at the moment but none of them seem to be the correct fix.

[Joe Wild]

The patch from 

https://bugs.webkit.org/show_bug.cgi?id=56393
Bug 56393 - Without checking existence of the renderer of the
element,tries to access the enclosing layer.

at least fixes this simple test case for this error.

The Sample html files to reproduce the crash in 
https://bugs.webkit.org/show_bug.cgi?id=59684 
show a small test case.

[Janne Koskinen]

Compiled QtWebkit2.1.x branch with RVCT4 and cannot reproduce this anymore with my own build.

[Janne Koskinen]

(In reply to comment #8)
> Compiled QtWebkit2.1.x branch with RVCT4 and cannot reproduce this anymore with my own build.

Compiler options passed in working build:

C:/RVCT_4/bin/armcc.exe -O2 --dwarf2 --dllimport_runtime --exceptions --exceptions_unwind --diag_suppress 161,611,654,997,1152,1300,1464,1488,2523,6318,6331 --diag_error 1267 --cpu 5TE --enum_is_int --library_interface=aeabi_clib --fpmode ieee_no_fenv --no_unaligned_access --no_vfe --apcs /inter -c --arm --fpu softvfp+vfpv2 --visibility_inlines_hidden --fpmode fast -OTime -O3 --gnu --diag_suppress 68,111,177,368,830,1293 --signed_bitfields --no_parse_templates --import_all_vtbl --cpp -D__MARM_INTERWORK__ -D__SUPPORT_CPP_EXCEPTIONS__ -D_UNICODE -D__SYMBIAN32__ -D__EPOC32__ -D__MARM__ -D__EABI__ '-D__PRODUCT_INCLUDE__="X:/epoc32/include/feature_settings.hrh"' -DUNICODE -DQT_KEYPAD_NAVIGATION -DQT_SOFTKEYS_ENABLED -DQT_USE_MATH_H_FLOATS -DBUILDING_QT__=1 -DWTF_USE_ACCELERATED_COMPOSITING -DUSE_SYSTEM_MALLOC -DNDEBUG -DQT_NO_UITOOLS -DQT_MAKEDLL -DBUILD_WEBKIT -DENABLE_FAST_MOBILE_SCROLLING=1 -DWTF_USE_QT_MOBILE_THEME=1 -DENABLE_NO_LISTBOX_RENDERING=1 -DBUILDING_QT__ -DBUILDING_JavaScriptCore -DBUILDING_WTF -DENABLE_XSLT=0 -DENABLE_JAVASCRIPT_DEBUGGER=1 -DENABLE_DATABASE=1 -DENABLE_EVENTSOURCE=1 -DENABLE_OFFLINE_WEB_APPLICATIONS=1 -DENABLE_DOM_STORAGE=1 -DENABLE_ICONDATABASE=1 -DENABLE_CHANNEL_MESSAGING=1 -DENABLE_DIRECTORY_UPLOAD=0 -DENABLE_SQLITE=1 -DENABLE_DASHBOARD_SUPPORT=0 -DENABLE_FILTERS=1 -DENABLE_XPATH=1 -DENABLE_WCSS=0 -DENABLE_WML=0 -DENABLE_SHARED_WORKERS=1 -DENABLE_WORKERS=1 -DENABLE_XHTMLMP=0 -DENABLE_DATAGRID=0 -DENABLE_RUBY=1 -DENABLE_SANDBOX=1 -DENABLE_METER_TAG=1 -DENABLE_PROGRESS_TAG=1 -DENABLE_BLOB_SLICE=0 -DENABLE_NOTIFICATIONS=1 -DENABLE_IMAGE_RESIZER=0 -DENABLE_INPUT_SPEECH=0 -DENABLE_HAPTICS=1 -DENABLE_3D_RENDERING=1 -DENABLE_SVG=1 -DENABLE_SVG_FONTS=1 -DENABLE_SVG_FOREIGN_OBJECT=1 -DENABLE_SVG_ANIMATION=1 -DENABLE_SVG_AS_IMAGE=1 -DENABLE_SVG_USE=1 -DENABLE_DATALIST=1 -DENABLE_TILED_BACKING_STORE=1 -DENABLE_NETSCAPE_PLUGIN_API=1 -DENABLE_WEB_SOCKETS=1 -DENABLE_WEB_TIMING=0 -DENABLE_GEOLOCATION=1 -DENABLE_ORIENTATION_EVENTS=1 -DENABLE_DEVICE_ORIENTATION=1 -DENABLE_QT_USERAGENT_DEVICEMODEL=1 -DENABLE_QT_BEARER=1 -DENABLE_TOUCH_EVENTS=1 -DENABLE_VIDEO=1 -DENABLE_QT_MULTIMEDIA=1 -DWTF_USE_QT_MULTIMEDIA -DWTF_USE_PREEMPT_GEOLOCATION_PERMISSION -DQT_NO_DEBUG -DQT_OPENGL_LIB -DQT_GUI_LIB -DQT_NETWORK_LIB -DQT_CORE_LIB -D__MARM_ARMV5__ -D__ARMCC_4__ -D__ARMCC_4_0__ -DNDEBUG -D__ARMCC__ -D__DLL__ -D__SYMBIAN_STDCPP_SUPPORT__ --

[Janne Koskinen]

Cannot reproduce in MCL W20 with UDA images nor with self-built QtWebkit 2.1.x.
Tested on E7 and N8.