Bug 59684 - [Qt] QtTestBrowser built with RVCT4.0 crashes when any plugin is loaded into html page containing iframe with display:none style.
Summary: [Qt] QtTestBrowser built with RVCT4.0 crashes when any plugin is loaded into ...
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: Frames (show other bugs)
Version: 528+ (Nightly build)
Hardware: S60 Hardware Other
: P1 Critical
Assignee: Nobody
URL:
Keywords: Qt, QtTriaged
Depends on:
Blocks:
 
Reported: 2011-04-28 03:31 PDT by Vinesh.Pallikandy
Modified: 2011-05-31 07:18 PDT (History)
7 users (show)

See Also:


Attachments
Sample html files to reproduce the crash (3.90 KB, application/x-zip-compressed)
2011-04-28 03:31 PDT, Vinesh.Pallikandy
no flags Details
Unfiltered call stack from MCL W17 (37.16 KB, text/plain)
2011-05-04 04:09 PDT, Janne Koskinen
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Vinesh.Pallikandy 2011-04-28 03:31:02 PDT
Created attachment 91461 [details]
Sample html files to reproduce the crash

Overview: 
    Qttestbrowser crashes when any plugin is loaded into html page containing iframe with display:none style. This happens only in RVCT 4.0 based builds.

Steps to Reproduce:
    1. Open the attached sample html file using qttestbrowser.(main.html)
   
Actual Results:
    The application crashed.

Expected Results:
    The application should not crash, since iframe display is set to none, plugin should not be visible.

Additional Builds and Platforms:
    This crash happens only on RVCT 4.0 based builds, not for RVCT 2.2 builds.If display:none is not set, there is no crash.

WRT Bugzilla Entry : WRT 7796
Comment 1 Laszlo Gombos 2011-05-02 13:47:15 PDT
Vinesh, do you have the following fix - http://trac.webkit.org/changeset/80796. This is essential to have a functioning WebKit with RVCT 4 ?
Comment 2 Vinesh.Pallikandy 2011-05-02 22:40:09 PDT
(In reply to comment #1)
> Vinesh, do you have the following fix - http://trac.webkit.org/changeset/80796. This is essential to have a functioning WebKit with RVCT 4 ?

This fix is part qtwebkit webkit.pri file.
Comment 3 Janne Koskinen 2011-05-04 04:09:23 PDT
Created attachment 92213 [details]
Unfiltered call stack from MCL W17

iFrame alone won't cause the crash. you need a plugin object as well. Didn't test if other plugin than Flash causes this.
Crash is EExcDataAbort and R0 is 0 -> null pointer.

I don't have this environment with source, so looking other ways to reproduce this.
Comment 4 Janne Koskinen 2011-05-06 04:08:20 PDT
If display is none we don't have renderer (RenderObject) and app crashes when plugins are updating on null renderer.

http://www.w3.org/TR/CSS2/visuren.html#propdef-display

I tried reading what the standard says if everything in display:none should be running or not. Alas, there wasn't any conclusive answer. If we have continuous animation like in the test case hiding and revealing will have different effect if running or not.
Comment 5 Joe Wild 2011-05-06 09:29:54 PDT
Wanted to point out that there is a similar error.  May not be a complete duplicate since this seems to involve plugins.

https://bugs.webkit.org/show_bug.cgi?id=56393
Bug 56393 - Without checking existence of the renderer of the
element,tries to access the enclosing layer.
Comment 6 Janne Koskinen 2011-05-06 13:11:14 PDT
(In reply to comment #5)
> Wanted to point out that there is a similar error.  May not be a complete duplicate since this seems to involve plugins.
> 
> https://bugs.webkit.org/show_bug.cgi?id=56393
> Bug 56393 - Without checking existence of the renderer of the
> element,tries to access the enclosing layer.

Thanks, it indeed looks very similar. I have to try that layer check on Monday. I'm pretty sure that would fix this issue.
This particular crash can be worked around also in plugin callback level. I have few options at the moment but none of them seem to be the correct fix.
Comment 7 Joe Wild 2011-05-09 13:33:07 PDT
The patch from 

https://bugs.webkit.org/show_bug.cgi?id=56393
Bug 56393 - Without checking existence of the renderer of the
element,tries to access the enclosing layer.

at least fixes this simple test case for this error.

The Sample html files to reproduce the crash in 
https://bugs.webkit.org/show_bug.cgi?id=59684 
show a small test case.
Comment 8 Janne Koskinen 2011-05-16 07:18:20 PDT
Compiled QtWebkit2.1.x branch with RVCT4 and cannot reproduce this anymore with my own build.
Comment 9 Janne Koskinen 2011-05-16 07:27:54 PDT
(In reply to comment #8)
> Compiled QtWebkit2.1.x branch with RVCT4 and cannot reproduce this anymore with my own build.

Compiler options passed in working build:

C:/RVCT_4/bin/armcc.exe -O2 --dwarf2 --dllimport_runtime --exceptions --exceptions_unwind --diag_suppress 161,611,654,997,1152,1300,1464,1488,2523,6318,6331 --diag_error 1267 --cpu 5TE --enum_is_int --library_interface=aeabi_clib --fpmode ieee_no_fenv --no_unaligned_access --no_vfe --apcs /inter -c --arm --fpu softvfp+vfpv2 --visibility_inlines_hidden --fpmode fast -OTime -O3 --gnu --diag_suppress 68,111,177,368,830,1293 --signed_bitfields --no_parse_templates --import_all_vtbl --cpp -D__MARM_INTERWORK__ -D__SUPPORT_CPP_EXCEPTIONS__ -D_UNICODE -D__SYMBIAN32__ -D__EPOC32__ -D__MARM__ -D__EABI__ '-D__PRODUCT_INCLUDE__="X:/epoc32/include/feature_settings.hrh"' -DUNICODE -DQT_KEYPAD_NAVIGATION -DQT_SOFTKEYS_ENABLED -DQT_USE_MATH_H_FLOATS -DBUILDING_QT__=1 -DWTF_USE_ACCELERATED_COMPOSITING -DUSE_SYSTEM_MALLOC -DNDEBUG -DQT_NO_UITOOLS -DQT_MAKEDLL -DBUILD_WEBKIT -DENABLE_FAST_MOBILE_SCROLLING=1 -DWTF_USE_QT_MOBILE_THEME=1 -DENABLE_NO_LISTBOX_RENDERING=1 -DBUILDING_QT__ -DBUILDING_JavaScriptCore -DBUILDING_WTF -DENABLE_XSLT=0 -DENABLE_JAVASCRIPT_DEBUGGER=1 -DENABLE_DATABASE=1 -DENABLE_EVENTSOURCE=1 -DENABLE_OFFLINE_WEB_APPLICATIONS=1 -DENABLE_DOM_STORAGE=1 -DENABLE_ICONDATABASE=1 -DENABLE_CHANNEL_MESSAGING=1 -DENABLE_DIRECTORY_UPLOAD=0 -DENABLE_SQLITE=1 -DENABLE_DASHBOARD_SUPPORT=0 -DENABLE_FILTERS=1 -DENABLE_XPATH=1 -DENABLE_WCSS=0 -DENABLE_WML=0 -DENABLE_SHARED_WORKERS=1 -DENABLE_WORKERS=1 -DENABLE_XHTMLMP=0 -DENABLE_DATAGRID=0 -DENABLE_RUBY=1 -DENABLE_SANDBOX=1 -DENABLE_METER_TAG=1 -DENABLE_PROGRESS_TAG=1 -DENABLE_BLOB_SLICE=0 -DENABLE_NOTIFICATIONS=1 -DENABLE_IMAGE_RESIZER=0 -DENABLE_INPUT_SPEECH=0 -DENABLE_HAPTICS=1 -DENABLE_3D_RENDERING=1 -DENABLE_SVG=1 -DENABLE_SVG_FONTS=1 -DENABLE_SVG_FOREIGN_OBJECT=1 -DENABLE_SVG_ANIMATION=1 -DENABLE_SVG_AS_IMAGE=1 -DENABLE_SVG_USE=1 -DENABLE_DATALIST=1 -DENABLE_TILED_BACKING_STORE=1 -DENABLE_NETSCAPE_PLUGIN_API=1 -DENABLE_WEB_SOCKETS=1 -DENABLE_WEB_TIMING=0 -DENABLE_GEOLOCATION=1 -DENABLE_ORIENTATION_EVENTS=1 -DENABLE_DEVICE_ORIENTATION=1 -DENABLE_QT_USERAGENT_DEVICEMODEL=1 -DENABLE_QT_BEARER=1 -DENABLE_TOUCH_EVENTS=1 -DENABLE_VIDEO=1 -DENABLE_QT_MULTIMEDIA=1 -DWTF_USE_QT_MULTIMEDIA -DWTF_USE_PREEMPT_GEOLOCATION_PERMISSION -DQT_NO_DEBUG -DQT_OPENGL_LIB -DQT_GUI_LIB -DQT_NETWORK_LIB -DQT_CORE_LIB -D__MARM_ARMV5__ -D__ARMCC_4__ -D__ARMCC_4_0__ -DNDEBUG -D__ARMCC__ -D__DLL__ -D__SYMBIAN_STDCPP_SUPPORT__ --
Comment 10 Janne Koskinen 2011-05-31 05:11:31 PDT
Cannot reproduce in MCL W20 with UDA images nor with self-built QtWebkit 2.1.x.
Tested on E7 and N8.