https://bugs.kde.org/show_bug.cgi?id=524111
Bug ID: 524111
Summary: Akregator crashes with SIGTRAP when a feed item
contains a cross-origin iframe
Classification: Applications
Product: akregator
Version First 6.7.3
Reported In:
Platform: Gentoo Packages
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: internal browser
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DESCRIPTION
Akregator crashes with SIGTRAP. The trap is a fatal Chromium CHECK
(base::ImmediateCrash, int3/ud2) in the QtWebEngine browser process, raised
when the article viewer renders a feed item whose description contains a
cross-origin <iframe>.
Trigger in the wild: since around 2026-08-06, Slashdot's RSS feed
(https://rss.slashdot.org/Slashdot/slashdotMain) embeds a discussion widget in
every item description:
<iframe
src="https://slashdot.org/slashdot-it.pl?op=discuss&id=...&smallembed=1";
style="height: 300px; width: 100%; border: none;"></iframe>
Any subscription to that feed makes Akregator crash on every start as soon as
the article viewer renders such an item, which effectively bricks the
application (crash loop on startup once the feed content is displayed).
STEPS TO REPRODUCE
1. Start Akregator with a fresh profile containing a single feed, e.g. with
this as data/akregator/data/feeds.opml:
<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0"><head><text/></head><body>
<outline title="Slashdot"
xmlUrl="https://rss.slashdot.org/Slashdot/slashdotMain"/>
</body></opml>
2. Let it fetch and render the feed. No interaction needed.
OBSERVED RESULT
The main process dies with SIGTRAP within ~10-15 seconds. With
QTWEBENGINE_CHROMIUM_FLAGS="--enable-logging=stderr --v=1" the last logged
network request before the trap is always the embedded iframe URL
(https://slashdot.org/slashdot-it.pl?op=discuss&id=...&smallembed=1),
immediately followed by a new renderer process being created for the
out-of-process iframe, after which the browser process traps. Shortly
before/after the trap this is logged:
ERROR:content/common/zygote/zygote_communication_linux.cc:299
Failed to send GetTerminationStatus message to zygote
WARNING:content/common/zygote/zygote_communication_linux.cc:311
Socket closed prematurely.
KCrash: Application 'akregator' crashing... crashRecursionCounter = 2
Crash is 100% reproducible with the sandbox disabled
(QTWEBENGINE_DISABLE_SANDBOX=1) and with --disable-gpu, so it is neither
sandbox- nor GPU-related.
EXPECTED RESULT
The article renders (with or without the iframe content); a subframe must not
be able to bring down the whole application.
SOFTWARE/OS VERSIONS
Operating System: Gentoo Linux 2.18
KDE Plasma Version: 6.6.6
KDE Frameworks Version: 6.27.0
Qt Version: 6.11.1
Kernel Version: 7.1.5-gentoo (64-bit)
Graphics Platform: Wayland
Processors: 24 × 13th Gen Intel® Core™ i7-13700K
Memory: 64 Gibyte of RAM (62.1 Gibyte usable)
Graphics Processor: Mesa Intel® Graphics
ADDITIONAL INFORMATION
- The same iframe embedded in a normal web page loads fine in Konqueror
(QtWebEngine, same machine, same libraries). The crash only happens in
Akregator's article viewer, i.e. when the article HTML is provided by the
application itself with a remote base URL and the page then needs an
out-of-process iframe for the cross-origin frame. So this is possibly a
QtWebEngine site-isolation/process-model issue surfaced by how
Akregator/messagelib feeds HTML to the view, and may need to be forwarded
upstream to Qt.
- Interestingly, when the same feed XML is loaded from a file:// URL instead of
http(s), the iframe is never requested and no crash occurs — the crash requires
the article to originate from a remote URL.
- Workaround: subscribe to the atom variant of the feed
(https://rss.slashdot.org/Slashdot/slashdotMainatom), which contains no
iframes.
- A core dump is available and I can provide further gdb output on request (the
distribution build has no debug symbols, so the backtrace is currently
unsymbolized).
- I used Claude with Fable/Opus 5 to help with debugging, tracing, analysis and
drafting the bug report.
BACKTRACE
Thread 1 "akregator" received signal SIGTRAP, Trace/breakpoint trap.
#0 base::ImmediateCrash () at base/immediate_crash.h:180
#1 logging::CheckFailure () at base/check.h:259
#2 content::NavigationRequest::GetOriginForURLLoaderFactoryAfterResponse ()
at content/browser/renderer_host/navigation_request.cc:8890
#3 content::NavigationRequest::GetOriginToCommit ()
navigation_request.cc:8749
#4 content::NavigationRequest::ComputeCrossOriginIsolationKey ()
navigation_request.cc:10822
#5 content::NavigationRequest::GetUrlInfo ()
navigation_request.cc:4184
#6 content::NavigationRequest::SelectFrameHostForOnResponseStarted ()
navigation_request.cc:4792
#7 content::NavigationRequest::OnResponseStarted ()
navigation_request.cc:4702
#8 content::NavigationURLLoaderImpl::NotifyResponseStarted ()
navigation_url_loader_impl.cc:2348
#9-13 base::…::Invoker / OnceCallback (bound-callback dispatch)
#14 content::NavigationURLLoaderImpl::ParseHeaders ()
navigation_url_loader_impl.cc:1961
#15 content::NavigationURLLoaderImpl::CallOnReceivedResponse ()
navigation_url_loader_impl.cc:1516
#16 content::NavigationURLLoaderImpl::OnReceiveResponse ()
navigation_url_loader_impl.cc:1459
#17 blink::ThrottlingURLLoader::OnReceiveResponse ()
throttling_url_loader.cc:714
#18 network::mojom::URLLoaderClientStubDispatch::Accept ()
url_loader.mojom.cc:1161
#19-32 mojo::… (InterfaceEndpointClient → MultiplexRouter → Connector →
SimpleWatcher)
#33-37 base::TaskAnnotator / ThreadControllerWithMessagePumpImpl::DoWork ()
#38 QtWebEngineCore::MessagePumpForUIQt::handleScheduledWork ()
browser_main_parts_qt.cpp:156
#43 QObject::event(QEvent*) libQt6Core.so.6
#53 QCoreApplication::exec() libQt6Core.so.6
#54 main
(My first bug report here so new to how KDE handles bug reporting/data
collecting)
/ Kim
--
You are receiving this mail because:
You are watching all bug changes.
