Bug#543151: epiphany-webkit: crash on picture double click with js handler

[Philipp Kern]

Package: epiphany-webkit
Version: 2.27.5-1
Severity: normal

Having [1] in a popup, double-clicking on the picture (which has javascript:self.close()) results in a SEGV on amd64 (I can currently reproduce it on every invocation after a session recover).

[1] http://gnome-look.org/content/preview.php?preview=1&id=110751&file1=110751-1.jpg&file2=&file3=&name=Linux+nature

Local retracing gives me:

Core was generated by `epiphany-webkit'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007fef8c021104 in webkit_web_view_focus_out_event (widget=0x2d3fe00, event=0x2d3d0a0) at ../WebKit/gtk/webkit/webkitwebview.cpp:616
616	../WebKit/gtk/webkit/webkitwebview.cpp: No such file or directory.
	in ../WebKit/gtk/webkit/webkitwebview.cpp
Current language:  auto; currently c++
(gdb) bt
#0  0x00007fef8c021104 in webkit_web_view_focus_out_event (widget=0x2d3fe00, event=0x2d3d0a0) at ../WebKit/gtk/webkit/webkitwebview.cpp:616
#1  0x00007fef8b88eda8 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#2  0x00007fef89c450ad in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#3  0x00007fef89c58549 in ?? () from /usr/lib/libgobject-2.0.so.0
#4  0x00007fef89c59a98 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#5  0x00007fef89c5a0d3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#6  0x00007fef8b99473e in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#7  0x00007fef8b9a2d57 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#8  0x00007fef8b9a3702 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#9  0x00007fef89c450ad in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#10 0x00007fef89c58549 in ?? () from /usr/lib/libgobject-2.0.so.0
#11 0x00007fef89c59c02 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#12 0x00007fef89c5a0d3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#13 0x00007fef8b9a9eea in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#14 0x00007fef8b9a258b in gtk_widget_unparent () from /usr/lib/libgtk-x11-2.0.so.0
#15 0x00007fef8b7d96a0 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#16 0x00007fef89c450ad in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#17 0x00007fef89c5816c in ?? () from /usr/lib/libgobject-2.0.so.0
#18 0x00007fef89c59c02 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#19 0x00007fef89c5a0d3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#20 0x00007fef8b99d7e5 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#21 0x00007fef89c4700a in g_object_unref () from /usr/lib/libgobject-2.0.so.0
#22 0x00007fef8b8876a9 in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#23 0x00007fef8b88879b in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#24 0x00007fef8b50547c in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#25 0x00007fef899ae7aa in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#26 0x00007fef899b1df8 in ?? () from /usr/lib/libglib-2.0.so.0
#27 0x00007fef899b22cd in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#28 0x00007fef8b888b97 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#29 0x0000000000430f76 in main (argc=1, argv=0x7fffcfb9d1a8) at /tmp/buildd/epiphany-webkit-2.27.5/src/ephy-main.c:783

The core dump (76M) will follow tomorrow, when I get an opportunity to up it.

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.30-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages epiphany-webkit depends on:
ii  dbus-x11                  1.2.16-2       simple interprocess messaging syst
ii  epiphany-webkit-data      2.27.5-1       Data files for the GNOME web brows
ii  gnome-icon-theme          2.26.0-1       GNOME Desktop icon theme
ii  iso-codes                 3.10.2-1       ISO language, territory, currency,
ii  libavahi-client3          0.6.25-1       Avahi client library
ii  libavahi-common3          0.6.25-1       Avahi common library
ii  libavahi-gobject0         0.6.25-1       Avahi GObject library
ii  libc6                     2.9-25         GNU C Library: Shared libraries
ii  libdbus-1-3               1.2.16-2       simple interprocess messaging syst
ii  libdbus-glib-1-2          0.82-1         simple interprocess messaging syst
ii  libgconf2-4               2.26.2-3       GNOME configuration database syste
ii  libglib2.0-0              2.20.4-1       The GLib library of C routines
ii  libgtk2.0-0               2.16.5-1       The GTK+ graphical user interface 
ii  libice6                   2:1.0.5-1      X11 Inter-Client Exchange library
ii  libnotify1 [libnotify1-gt 0.4.5-1        sends desktop notifications to a n
ii  libpango1.0-0             1.24.5-1       Layout and rendering of internatio
ii  libsm6                    2:1.1.0-2      X11 Session Management library
ii  libsoup-gnome2.4-1        2.27.4-1       an HTTP library implementation in 
ii  libsoup2.4-1              2.27.4-1       an HTTP library implementation in 
ii  libwebkit-1.0-2           1.1.12-1       Web content engine library for Gtk
ii  libx11-6                  2:1.2.2-1      X11 client-side library
ii  libxml2                   2.7.3.dfsg-2.1 GNOME XML library
ii  libxslt1.1                1.1.24-2       XSLT processing library - runtime 

Versions of packages epiphany-webkit recommends:
ii  yelp                          2.26.0-2   Help browser for GNOME

Versions of packages epiphany-webkit suggests:
pn  mozplugger                    <none>     (no description available)

-- no debconf information