Exception code c0000005 in QtWebKit4.dll

[lukaslang]

Dear all,

from time to time I get a crash in my application, the windows dialog gives the information:

* Exception code: c0000005
* Module: QtWebKit4.dll
* Modver: 4.7.2.0
* Offset:00473e74

The application contains some QGraphicsWebViews. I don't know how to approach that error. Unfortunately it is hard to reproduce. The offset can vary to some degree. I used a disassembler and searched for the offset to get an idea where this happens, and concluded that QTextBoundaryFinder is always involved. Can anyone please give me some hints how to track this issue further down?

Lukas

[ChrisW67]

Run a debug build in a debugger and when it crashes look at the backtrace to find exactly how you are getting to the crash location. Inspect everything that is passed as a parameter. c0000005 Access violation is more than likely a NULL or invalid pointer problem in your data structure.

[lukaslang]

Unfortunately, I cannot reproduce it when running in the debugger, really tough. Also the error occurs more often on other computers than mine. I have one suspicion: since I set some text in the web content dynamically by evaluating JavaScript snippets, maybe there is a condition with threads in WebKit. Can anyone please point me to some information about threads in Qt WebKit?

[lukaslang]

I have not really understood this error, but i hunted it down to the function setUpIterator and made a quick fix that seems to work for me. The problem is that the static object staticLineBreakIterator is left with a pointer to the last examined string even after the string is deleted. That is why I only had that error when opening a second web page after closing a first one.

The quick fix in TextBreakIteratorQt.cpp is:



TextBreakIterator* setUpIterator(TextBreakIterator& iterator, QTextBoundaryFinder::BoundaryType type, const UChar* string, int length)
{
if (!string || !length)
return 0;

if (iterator.isValid() && type == iterator.type() && length == iterator.length
&& string == iterator.string
&& memcmp(string, iterator.string, length) == 0)
{
iterator.toStart();
return &iterator;
}

iterator = TextBreakIterator(type, string, length);
return &iterator;
}


The additional comparison in line 7 ensures that memcpy is only called if the new string is exactly the last examined. Maybe the memcpy can be omitted.