+++ This bug was initially created as a clone of Bug #870749 +++

libreport version: 2.0.10
abrt_version:   2.0.7
backtrace_rating: 4
cmdline:        konqueror ./func-8b26260.svg
comment:        Load a huge svg with WebKit as default rendering engine for svg. If it doesn't complete loading within a couple of seconds, the process crashes.
crash_function: primarySimpleFontData
executable:     /usr/bin/konqueror
kernel:         3.6.2-1.fc16.x86_64
pid:            15358
time:           Sun 28 Oct 2012 04:34:52 PM MSK
uid:            500
username:       sasha

backtrace:      Text file, 82909 bytes
build_ids:      Text file, 9391 bytes
dso_list:       Text file, 22168 bytes
maps:           Text file, 97187 bytes

environ:
:XDG_VTNR=1
:SSH_AGENT_PID=1628
:XDG_SESSION_ID=1
:KDE_MULTIHEAD=false
:HOSTNAME=ricdesk
:DM_CONTROL=/var/run/xdmctl
:IMSETTINGS_INTEGRATE_DESKTOP=yes
:SHELL=/bin/bash
:TERM=xterm
:XDG_MENU_PREFIX=kde4-
:XDG_SESSION_COOKIE=3912d21dd1c5c5a641983fd700000009-1351401279.237474-1570901722
:HISTSIZE=1000
:XDM_MANAGED=method=classic
:GTK2_RC_FILES=/etc/gtk-2.0/gtkrc:/home/sasha/.gtkrc-2.0:/home/sasha/.gtkrc-2.0-kde4:/home/sasha/.kde/share/config/gtkrc-2.0
:KONSOLE_DBUS_SERVICE=:1.45
:GS_LIB=
:GTK_RC_FILES=/etc/gtk/gtkrc:/home/sasha/.gtkrc:/home/sasha/.kde/share/config/gtkrc
:WINDOWID=41943132
:QTDIR=/usr/lib64/qt-3.3
:GNOME_KEYRING_CONTROL=/tmp/keyring-iPmlfI
:SHELL_SESSION_ID=07f6c372b7054000813e353349642ae6
:QTINC=/usr/lib64/qt-3.3/include
:KDE_FULL_SESSION=true
:IMSETTINGS_MODULE=IBus
:USER=sasha
:LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;05;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.tbz=01;31:*.tbz2=01;31:*.bz=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.axa=01;36:*.oga=01;36:*.spx=01;36:*.xspf=01;36:*.pdf=00;33:*.ps=00;33:*.ps.gz=00;33:*.txt=00;33:*.patch=00;33:*.diff=00;33:*.log=00;33:*.tex=00;33:*.xls=00;33:*.xlsx=00;33:*.ppt=00;33:*.pptx=00;33:*.rtf=00;33:*.doc=00;33:*.docx=00;33:*.odt=00;33:*.ods=00;33:*.odp=00;33:*.xml=00;33:*.epub=00;33:*.abw=00;33:*.html=00;33:*.wpd=00;33:
:SSH_AUTH_SOCK=/tmp/ssh-fkMpOVGm1509/agent.1509
:SESSION_MANAGER=local/unix:@/tmp/.ICE-unix/1706,unix/unix:/tmp/.ICE-unix/1706
:MC_TMPDIR=/tmp/mc-sasha
:DESKTOP_SESSION=default
:MAIL=/var/spool/mail/sasha
:PATH=/usr/lib64/qt-3.3/bin:/usr/NX/bin:/usr/lib64/ccache:/usr/local/bin:/usr/bin:/bin:/usr/games:/usr/local/sbin:/usr/sbin:/sbin:/home/sasha/.local/bin:/home/sasha/bin:/opt/android-sdk/platform-tools
:_=/usr/bin/setsid
:NXDIR=/usr/NX
:QT_IM_MODULE=ibus
:PWD=/home/sasha/Games/DF/profiling
:XMODIFIERS=@im=ibus
:KDE_SESSION_UID=500
:LANG=en_US.UTF-8
:GNOME_KEYRING_PID=1507
:KDE_IS_PRELINKED=1
:KDEDIRS=/usr
:KONSOLE_DBUS_SESSION=/Sessions/8
:HISTCONTROL=ignorespace
:SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
:HOME=/home/sasha
:COLORFGBG=15;0
:XDG_SEAT=seat0
:SHLVL=5
:KDE_SESSION_VERSION=4
:LANGUAGE=
:XCURSOR_THEME=default
:MC_SID=11145
:LOGNAME=sasha
:CVS_RSH=ssh
:QTLIB=/usr/lib64/qt-3.3/lib
:XDG_DATA_DIRS=/usr/share/kde-settings/kde-profile/default/share:/usr/local/share:/usr/share
:DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-HYZl7NGUiP,guid=0becf115a66f00ce5a63ea580000006e
:'LESSOPEN=||/usr/bin/lesspipe.sh %s'
:WINDOWPATH=1
:PROFILEHOME=
:XDG_RUNTIME_DIR=/run/user/sasha
:DISPLAY=:0
:QT_PLUGIN_PATH=/home/sasha/.kde/lib64/kde4/plugins/:/usr/lib64/kde4/plugins/:/usr/lib/kde4/plugins
:GTK_IM_MODULE=ibus
:XAUTHORITY=/tmp/kde-sasha/xauth-500-_0
:CCACHE_HASHDIR=

var_log_messages:
:Oct 28 14:23:12 ricdesk abrt[12822]: Saved core dump of pid 12786 (/usr/bin/konqueror) to /var/spool/abrt/ccpp-2012-10-28-14:23:10-12786 (1213964288 bytes)
:Oct 28 15:51:37 ricdesk abrt[15012]: Saved core dump of pid 14973 (/usr/bin/konqueror) to /var/spool/abrt/ccpp-2012-10-28-15:51:35-14973 (1221152768 bytes)
:Oct 28 15:52:09 ricdesk abrt[15083]: Saved core dump of pid 15046 (/usr/bin/konqueror) to /var/spool/abrt/ccpp-2012-10-28-15:52:06-15046 (1393483776 bytes)
:Oct 28 15:52:50 ricdesk abrt[15151]: Saved core dump of pid 15117 (/usr/bin/konqueror) to /var/spool/abrt/ccpp-2012-10-28-15:52:47-15117 (1389223936 bytes)
:Oct 28 16:34:55 ricdesk abrt[15384]: Saved core dump of pid 15358 (/usr/bin/konqueror) to /var/spool/abrt/ccpp-2012-10-28-16:34:52-15358 (1331646464 bytes)

--- Additional comment from Alexander Gavrilov on 2012-10-28 08:44:10 EDT ---

Created attachment 634512 [details]
File: dso_list

--- Additional comment from Alexander Gavrilov on 2012-10-28 08:44:12 EDT ---

Created attachment 634513 [details]
File: build_ids

--- Additional comment from Alexander Gavrilov on 2012-10-28 08:44:15 EDT ---

Created attachment 634514 [details]
File: maps

--- Additional comment from Alexander Gavrilov on 2012-10-28 08:44:17 EDT ---

Created attachment 634515 [details]
File: backtrace

--- Additional comment from Alexander Gavrilov on 2012-11-02 14:30:42 EDT ---

Created attachment 637199 [details]
Work-around patch for qtwebkit.

I have done some searching and debugging, and after applying this work-around patch I haven't had a single crash for two days (while previously it crashed very often).

It would seem that the issue is incomplete invalidation of layout state when parsing is done incrementally in the background as painting events happen. I suspect it is probably via Node::attach(), but this patch may catch some other unguarded modification sources too.

--- Additional comment from Alexander Gavrilov on 2012-11-19 02:56:23 EST ---

It's been weeks now and I never had a single crash after applying the workaround, so it definitely works.