Bug 134497 – Krita crashes in select contiguous area

Bug 134497:

Krita crashes in select contiguous area

Alias:
Product:	krita
Component:	general
Status:	RESOLVED
Resolution:	FIXED
Target:	---

Version:	unspecified
Priority:	NOR
Severity:	normal

Votes:

Description From boud@valdyas.org 2006-09-22 15:12:13

Version:            (using KDE KDE 3.5.4)
Installed from:    Ubuntu Packages

I get the following crash when using the magic wand/select contiguous tool on the roof part of the attached image. Sometimes one click is enough, sometimes more clicks are needed.

#6  0xb5de1d09 in KisBasicU8HistogramProducer::addRegionToBin (
    this=0x89860e8, 
    pixels=0xa6fc2f10 "\024\021\023

------- Comment #1 From boud@valdyas.org 2006-09-22 15:14:10 -------

Created an attachment (id=17878) [details]
image with which I can crash Krita

You may want to crop until just the building with the two towers is left.

------- Comment #2 From boud@valdyas.org 2006-09-22 15:20:58 -------

Valgrind says:

==8467==
==8467== Syscall param writev(vector[...]) points to uninitialised byte(s)
==8467==    at 0x4000772: (within /lib/ld-2.3.6.so)
==8467==    by 0x56E14E2: (within /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56E1735: _X11TransWritev (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56E676E: _XSend (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56D6ED8: (within /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56D706D: XPutImage (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F83922: QPixmap::convertFromImage(QImage const&, int) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x504F5A9: QPixmap::convertFromImage(QImage const&, QPixmap::ColorMode) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4BA4C99: KIconLoader::loadIcon(QString const&, KIcon::Group, int, int, QString*, bool) const (in /usr/lib/libkdecore.so.4.2.0)
==8467==    by 0x4BA6E0B: DesktopIcon(QString const&, int, int, KInstance*) (in /usr/lib/libkdecore.so.4.2.0)
==8467==    by 0x4BA6F08: KApplication::icon() const (in /usr/lib/libkdecore.so.4.2.0)
==8467==    by 0x4BA6FFE: KApplication::setTopWidget(QWidget*) (in /usr/lib/libkdecore.so.4.2.0)
==8467==  Address 0x5A9CF0D is 253 bytes inside a block of size 16,384 alloc'd
==8467==    at 0x401D7AA: calloc (vg_replace_malloc.c:279)
==8467==    by 0x56D1F65: XOpenDisplay (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F5F50F: qt_init_internal(int*, char**, _XDisplay*, unsigned long, unsigned long) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4F615F3: qt_init(int*, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD62D1: QApplication::construct(int&, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD6610: QApplication::QApplication(int&, char**, bool) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4BB56B7: KApplication::KApplication(bool, bool) (in /usr/lib/libkdecore.so.4.2.0)
==8467==    by 0x40BBD12: KoApplication::KoApplication() (in /usr/lib/libkofficecore.so.3.0.0)
==8467==    by 0x40212E9: kdemain (in /usr/lib/libkdeinit_krita.so)
==8467==    by 0x80486E5: main (kdeinit_krita.cpp:2)
==8467==
==8467== Syscall param write(buf) points to uninitialised byte(s)
==8467==    at 0x4000772: (within /lib/ld-2.3.6.so)
==8467==    by 0x56E16F3: _X11TransWrite (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56E606A: (within /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56C3F10: XFlush (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F9BD11: QWidget::setCursor(QCursor const&) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x50F2FAD: QDockWindowResizeHandle::setOrientation(Qt::Orientation) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x50F3140: QDockWindowResizeHandle::QDockWindowResizeHandle(Qt::Orientation, QWidget*, QDockWindow*, char const*) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x50F996F: QDockWindow::init() (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x50FA331: QDockWindow::QDockWindow(QDockWindow::Place, QWidget*, char const*, unsigned, bool) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x519262F: QToolBar::QToolBar(QString const&, QMainWindow*, QWidget*, bool, char const*, unsigned) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x486DEFE: KToolBar::KToolBar(QWidget*, char const*, bool, bool) (in /usr/lib/libkdeui.so.4.2.0)
==8467==    by 0x48AB7D6: KXMLGUIBuilder::createContainer(QWidget*, int, QDomElement const&, int&) (in /usr/lib/libkdeui.so.4.2.0)
==8467==  Address 0x5A9CE3C is 44 bytes inside a block of size 16,384 alloc'd
==8467==    at 0x401D7AA: calloc (vg_replace_malloc.c:279)
==8467==    by 0x56D1F65: XOpenDisplay (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F5F50F: qt_init_internal(int*, char**, _XDisplay*, unsigned long, unsigned long) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4F615F3: qt_init(int*, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD62D1: QApplication::construct(int&, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD6610: QApplication::QApplication(int&, char**, bool) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4BB56B7: KApplication::KApplication(bool, bool) (in /usr/lib/libkdecore.so.4.2.0)
==8467==    by 0x40BBD12: KoApplication::KoApplication() (in /usr/lib/libkofficecore.so.3.0.0)
==8467==    by 0x40212E9: kdemain (in /usr/lib/libkdeinit_krita.so)
==8467==    by 0x80486E5: main (kdeinit_krita.cpp:2)
ScimInputContextPlugin()
==8467==
==8467== Syscall param write(buf) points to uninitialised byte(s)
==8467==    at 0x4000772: (within /lib/ld-2.3.6.so)
==8467==    by 0x56E16F3: _X11TransWrite (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56E606A: (within /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56C1C69: XDrawLine (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F8B7D9: QPainter::drawLine(int, int, int, int) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x5D374A3: PlastikStyle::renderContour(QPainter*, QRect const&, QColor const&, QColor const&, unsigned) const (in /usr/lib/kde3/plugins/styles/plastik.so)
==8467==    by 0x5D469C2: PlastikStyle::drawPrimitive(QStyle::PrimitiveElement, QPainter*, QRect const&, QColorGroup const&, unsigned, QStyleOption const&) const (in /usr/lib/kde3/plugins/styles/plastik.so)
==8467==    by 0x4D2064E: KStyle::drawComplexControl(QStyle::ComplexControl, QPainter*, QWidget const*, QRect const&, QColorGroup const&, unsigned, unsigned, unsigned, QStyleOption const&) const (in /usr/lib/libkdefx.so.4.2.0)
==8467==    by 0x5D3C94D: PlastikStyle::drawComplexControl(QStyle::ComplexControl, QPainter*, QWidget const*, QRect const&, QColorGroup const&, unsigned, unsigned, unsigned, QStyleOption const&) const (in /usr/lib/kde3/plugins/styles/plastik.so)
==8467==    by 0x516CF1A: QScrollBar::drawControls(unsigned, unsigned, QPainter*) const (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x516CF7B: QScrollBar::drawControls(unsigned, unsigned) const (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x516D125: QScrollBar::rangeChange() (in /usr/lib/libqt-mt.so.3.3.6)
==8467==  Address 0x5A9EC94 is 7,812 bytes inside a block of size 16,384 alloc'd
==8467==    at 0x401D7AA: calloc (vg_replace_malloc.c:279)
==8467==    by 0x56D1F65: XOpenDisplay (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F5F50F: qt_init_internal(int*, char**, _XDisplay*, unsigned long, unsigned long) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4F615F3: qt_init(int*, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD62D1: QApplication::construct(int&, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD6610: QApplication::QApplication(int&, char**, bool) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4BB56B7: KApplication::KApplication(bool, bool) (in /usr/lib/libkdecore.so.4.2.0)
==8467==    by 0x40BBD12: KoApplication::KoApplication() (in /usr/lib/libkofficecore.so.3.0.0)
==8467==    by 0x40212E9: kdemain (in /usr/lib/libkdeinit_krita.so)
==8467==    by 0x80486E5: main (kdeinit_krita.cpp:2)
==8467==
==8467== Syscall param write(buf) points to uninitialised byte(s)
==8467==    at 0x4000772: (within /lib/ld-2.3.6.so)
==8467==    by 0x56E16F3: _X11TransWrite (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56E606A: (within /usr/lib/libX11.so.6.2.0)
==8467==    by 0x56BD95B: XCheckTypedWindowEvent (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F52720: QETWidget::translateConfigEvent(_XEvent const*) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4F5CE0D: QApplication::x11ProcessEvent(_XEvent*) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4F764DA: QEventLoop::processEvents(unsigned) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FEA946: QEventLoop::enterLoop() (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FEA869: QEventLoop::exec() (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD0964: QApplication::exec() (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4021302: kdemain (in /usr/lib/libkdeinit_krita.so)
==8467==    by 0x80486E5: main (kdeinit_krita.cpp:2)
==8467==  Address 0x5A9DBD0 is 3,520 bytes inside a block of size 16,384 alloc'd
==8467==    at 0x401D7AA: calloc (vg_replace_malloc.c:279)
==8467==    by 0x56D1F65: XOpenDisplay (in /usr/lib/libX11.so.6.2.0)
==8467==    by 0x4F5F50F: qt_init_internal(int*, char**, _XDisplay*, unsigned long, unsigned long) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4F615F3: qt_init(int*, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD62D1: QApplication::construct(int&, char**, QApplication::Type) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4FD6610: QApplication::QApplication(int&, char**, bool) (in /usr/lib/libqt-mt.so.3.3.6)
==8467==    by 0x4BB56B7: KApplication::KApplication(bool, bool) (in /usr/lib/libkdecore.so.4.2.0)
==8467==    by 0x40BBD12: KoApplication::KoApplication() (in /usr/lib/libkofficecore.so.3.0.0)
==8467==    by 0x40212E9: kdemain (in /usr/lib/libkdeinit_krita.so)
==8467==    by 0x80486E5: main (kdeinit_krita.cpp:2)
~ScimInputContextPlugin()

------- Comment #3 From Bart Coppens 2006-09-22 17:24:29 -------

SVN commit 587382 by coppens:

Fix a crash where the histogram docker would try to fetch selectedness outside of the consecutive area of the selection (but inside the consecutive area of the actual iterator). This shouldn't have happened because the comment of selectionMask() says it shouldn't:
'this is guaranteed to have the same number of consecutive pixels that the iterator has at a given point'
BUG:134497

 M  +23 -2     kis_iterators_pixel.h  


--- branches/koffice/1.6/koffice/krita/core/kis_iterators_pixel.h #587381:587382
@@ -58,6 +58,16 @@
     
     Q_INT32 y() const { return KisHLineIterator::y() + m_offsety; }
     
+    Q_INT32 nConseqHPixels() const {
+        if (m_selectionIterator) {
+            Q_INT32 parent = KisHLineIteratorPixel::nConseqHPixels();
+            Q_INT32 selection = m_selectionIterator->nConseqHPixels();
+            if (parent < selection)
+                return parent;
+            return selection;
+        }
+        return KisHLineIteratorPixel::nConseqHPixels();
+    }
 protected:
 
     Q_INT32 m_offsetx, m_offsety;
@@ -85,7 +95,7 @@
     Q_INT32 x() const { return KisVLineIterator::x() + m_offsetx; }
     
     Q_INT32 y() const { return KisVLineIterator::y() + m_offsety; }
-    
+
 protected:
 
     Q_INT32 m_offsetx, m_offsety;
@@ -113,7 +123,18 @@
     Q_INT32 x() const { return KisRectIterator::x() + m_offsetx; }
     
     Q_INT32 y() const { return KisRectIterator::y() + m_offsety; }
-    
+
+    Q_INT32 nConseqPixels() const {
+        if (m_selectionIterator) {
+            Q_INT32 parent = KisRectIterator::nConseqPixels();
+            Q_INT32 selection = m_selectionIterator->nConseqPixels();
+            if (parent < selection)
+                return parent;
+            return selection;
+        }
+        return KisRectIterator::nConseqPixels();
+    }
+
 protected:
 
     Q_INT32 m_offsetx, m_offsety;

------- Comment #4 From Bart Coppens 2006-09-22 17:26:01 -------

SVN commit 587383 by coppens:

Seems to be needed after the fix for the difference between selection and actual conseqpixels. Seems a bit weird but doesn't loop infinitely anymore.
CCBUG:134497

 M  +2 -0      kis_cachedhistogram.cc  


--- branches/koffice/1.6/koffice/krita/plugins/viewplugins/histogram_docker/kis_cachedhistogram.cc #587382:587383
@@ -31,5 +31,7 @@
         i = srcIt.nConseqPixels();
         m_producer->addRegionToBin(srcIt.rawData(), srcIt.selectionMask(), i, dev->colorSpace());
         srcIt += i;
+        if (i == 0)
+            ++srcIt;
     }
 }

Platform:	Ubuntu Packages
OS:	Linux
Keywords:
URL:

People

Reporter:
Assigned To:	Bart Coppens

Related actions

View Bug Activity

Format For Printing

Clone This Bug

Search for Duplicates

Note

You need to log in before you can comment on or make changes to this bug.

Attachments
image with which I can crash Krita (734.38 KB, image/jpeg) 2006-09-22 15:14, boud@valdyas.org	Details
View All Add an attachment (proposed patch, testcase, etc.)

Depends on:
Blocks:
	Show dependency tree - Show dependency graph

Actions

Reports

My Account