Bug 199485

*** Bug 200470 has been marked as a duplicate of this bug. ***

*** Bug 201214 has been marked as a duplicate of this bug. ***

*** Bug 203672 has been marked as a duplicate of this bug. ***

*** Bug 205370 has been marked as a duplicate of this bug. ***

*** Bug 206195 has been marked as a duplicate of this bug. ***

*** Bug 206830 has been marked as a duplicate of this bug. ***

I got the same crash in KDE 4.3.1. I was typing the name "chromium".

Thread 1 (Thread 0x7fa10d429750 (LWP 7545)):
[KCrash Handler]
#5  QMetaObject::activate (sender=0xffffffff00000000, m=<value optimized out>, local_signal_index=1, argv=0x7fff15465010) at kernel/qobject.cpp:3183
#6  0x00007fa10b2092ca in QDBusConnectionPrivate::callWithCallbackFailed (this=0x7fa10b41eba0, _t1=<value optimized out>, _t2=<value optimized out>)
    at .moc/release-shared/moc_qdbusconnection_p.cpp:112
#7  0x00007fa10b1d0ad0 in QDBusConnectionPrivate::processFinishedCall (call=0x34d4120) at qdbusintegrator.cpp:1689
#8  0x00007fa10b1d601b in QDBusConnectionPrivate::sendWithReplyAsync (this=0x258ec30, message=<value optimized out>, receiver=0x2872080, returnMethod=0x7fa10b7986c7 "1slotReceivedId(int)", 
    errorMethod=0x7fa10b798788 "1slotReceivedIdError(QDBusError)", timeout=<value optimized out>) at qdbusintegrator.cpp:1899
#9  0x00007fa10b1bf81a in QDBusConnection::callWithCallback (this=0x2a39330, message=@0x5, receiver=0x0, returnMethod=0x4 <Address 0x4 out of bounds>, errorMethod=0x34ebac0 "�\215b\002", 
    timeout=163355136) at qdbusconnection.cpp:461
#10 0x00007fa10b1dd479 in QDBusAbstractInterface::callWithCallback (this=<value optimized out>, method=@0x7fff15465440, args=@0x7fff15465490, receiver=0x2872080, 
    returnMethod=0x7fa10b7986c7 "1slotReceivedId(int)", errorMethod=0x7fa10b798788 "1slotReceivedIdError(QDBusError)") at qdbusabstractinterface.cpp:471
#11 0x00007fa10b69b27e in KNotificationManager::notify (this=0x2a4aa00, n=0x2872080, pix=<value optimized out>, actions=@0x2a28ad8, contexts=<value optimized out>, appname=@0x7fff15465560)
    at /build/buildd/kde4libs-4.3.1/kdeui/util/knotificationmanager.cpp:143
#12 0x00007fa10b69901b in KNotification::sendEvent (this=0x2872080) at /build/buildd/kde4libs-4.3.1/kdeui/util/knotification.cpp:341
#13 0x00007fa10b69a1a0 in KNotification::qt_metacall (this=0x2872080, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fff15465640)
    at /build/buildd/kde4libs-4.3.1/obj-x86_64-linux-gnu/kdeui/knotification.moc:103
#14 0x00007fa10cf67ea2 in QMetaObject::activate (sender=0x2a33e90, from_signal_index=<value optimized out>, to_signal_index=4, argv=0x4) at kernel/qobject.cpp:3113
#15 0x00007fa10cf6d14f in QSingleShotTimer::timerEvent (this=0x2a33e90) at kernel/qtimer.cpp:298
#16 0x00007fa10cf62263 in QObject::event (this=0x2a33e90, e=0x5) at kernel/qobject.cpp:1075
#17 0x00007fa10a518f4d in QApplicationPrivate::notify_helper (this=0x2596900, receiver=0x2a33e90, e=0x7fff15465d00) at kernel/qapplication.cpp:4056
#18 0x00007fa10a52118a in QApplication::notify (this=0x2596600, receiver=0x2a33e90, e=0x7fff15465d00) at kernel/qapplication.cpp:4021
#19 0x00007fa10b62bdeb in KApplication::notify (this=0x2596600, receiver=0x2a33e90, event=0x7fff15465d00) at /build/buildd/kde4libs-4.3.1/kdeui/kernel/kapplication.cpp:302
#20 0x00007fa10cf526ac in QCoreApplication::notifyInternal (this=0x2596600, receiver=0x2a33e90, event=0x7fff15465d00) at kernel/qcoreapplication.cpp:610
#21 0x00007fa10cf7f516 in QTimerInfoList::activateTimers (this=0x259a0b0) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:213
#22 0x00007fa10cf7bb2d in timerSourceDispatch (source=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:165
#23 0x00007fa108fac20a in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#24 0x00007fa108faf8e0 in ?? () from /usr/lib/libglib-2.0.so.0
#25 0x00007fa108fafa7c in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#26 0x00007fa10cf7ba8f in QEventDispatcherGlib::processEvents (this=0x2506e70, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:327
#27 0x00007fa10a5b1bdf in QGuiEventDispatcherGlib::processEvents (this=0x7fa10b41eba0, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:202
#28 0x00007fa10cf50f42 in QEventLoop::processEvents (this=<value optimized out>, flags={i = 356933488}) at kernel/qeventloop.cpp:149
#29 0x00007fa10cf51314 in QEventLoop::exec (this=0x7fff15465fb0, flags={i = 356933568}) at kernel/qeventloop.cpp:201
#30 0x00007fa10cf535e4 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:888
#31 0x00007fa100ea857c in kdemain () from /usr/lib/libkdeinit4_krunner.so
#32 0x0000000000407215 in launch (argc=1, _name=0x2546198 "/usr/bin/krunner", args=<value optimized out>, cwd=0x0, envc=0, envs=0x25461b1 "", reset_env=false, tty=0x0, avoid_loops=false, 
    startup_id_str=0x40a3a1 "0") at /build/buildd/kde4libs-4.3.1/kinit/kinit.cpp:677
#33 0x0000000000407a38 in handle_launcher_request (sock=7, who=<value optimized out>) at /build/buildd/kde4libs-4.3.1/kinit/kinit.cpp:1169
#34 0x0000000000407fe5 in handle_requests (waitForPid=0) at /build/buildd/kde4libs-4.3.1/kinit/kinit.cpp:1362
#35 0x0000000000408b26 in main (argc=2, argv=0x7fff15466e18, envp=0x7fff15466e30) at /build/buildd/kde4libs-4.3.1/kinit/kinit.cpp:1793

*** Bug 208093 has been marked as a duplicate of this bug. ***

*** Bug 211236 has been marked as a duplicate of this bug. ***

*** Bug 213087 has been marked as a duplicate of this bug. ***

Bug 213302 got the same crash but in krusader, may be it is a kdelibs issue. Thanks

*** Bug 213302 has been marked as a duplicate of this bug. ***

*** Bug 214678 has been marked as a duplicate of this bug. ***

*** Bug 215223 has been marked as a duplicate of this bug. ***

*** Bug 215766 has been marked as a duplicate of this bug. ***

*** Bug 218083 has been marked as a duplicate of this bug. ***

Bug 219985 looks also related to this too..

It does look like the same issue. It looks like a KNotification bug though.

Hi,

I don't know if it is exactly the same problem (no problem for me with krunner and kons, konso, ...) but here a scenario that cause a krunner's crash with my mandriva 2010 up to date (kde 4.3.2)

1. Create a new user
2. Login with the new user
3. Alt-F2 ==> krunner
4. Settings of krunner
5. Tab 'User interface'
6. Change 'Command oriented' to 'Task oriented'
7. Ok
8. Type 'konsoleµ' + enter
==> no result ... normal :-)
9. Erase the 'µ' + enter

==> crash of krunner

Traces:
Application: Interface d'exécution de commande (kdeinit4), signal: Segmentation fault
[Current thread is 1 (Thread 0xb56c76d0 (LWP 19597))]

Thread 5 (Thread 0xa71ceb70 (LWP 20614)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb75469e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/i686/libpthread.so.0
#2  0xb75a1fb0 in QWaitCondition::wait (this=0x89284e8, mutex=0x8952e18, time=4294967295) at thread/qwaitcondition_unix.cpp:87
#3  0xb43eb3c9 in ?? () from /usr/lib/libthreadweaver.so.4
#4  0xb43edabb in ?? () from /usr/lib/libthreadweaver.so.4
#5  0xb43e9a1a in ?? () from /usr/lib/libthreadweaver.so.4
#6  0xb43edbbc in ?? () from /usr/lib/libthreadweaver.so.4
#7  0xb43eb653 in ?? () from /usr/lib/libthreadweaver.so.4
#8  0xb43ebc34 in ?? () from /usr/lib/libthreadweaver.so.4
#9  0xb43ec2aa in ThreadWeaver::Thread::run () from /usr/lib/libthreadweaver.so.4
#10 0xb75a0e83 in QThreadPrivate::start (arg=0x88c15c8) at thread/qthread_unix.cpp:188
#11 0xb7542885 in start_thread () from /lib/i686/libpthread.so.0
#12 0xb5f9457e in clone () from /lib/i686/libc.so.6

Thread 4 (Thread 0xa69cdb70 (LWP 20615)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb75469e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/i686/libpthread.so.0
#2  0xb75a1fb0 in QWaitCondition::wait (this=0x89284e8, mutex=0x8952e18, time=4294967295) at thread/qwaitcondition_unix.cpp:87
#3  0xb43eb3c9 in ?? () from /usr/lib/libthreadweaver.so.4
#4  0xb43edabb in ?? () from /usr/lib/libthreadweaver.so.4
#5  0xb43e9a1a in ?? () from /usr/lib/libthreadweaver.so.4
#6  0xb43edbbc in ?? () from /usr/lib/libthreadweaver.so.4
#7  0xb43eb653 in ?? () from /usr/lib/libthreadweaver.so.4
#8  0xb43edbd8 in ?? () from /usr/lib/libthreadweaver.so.4
#9  0xb43eb653 in ?? () from /usr/lib/libthreadweaver.so.4
#10 0xb43ebc34 in ?? () from /usr/lib/libthreadweaver.so.4
#11 0xb43ec2aa in ThreadWeaver::Thread::run () from /usr/lib/libthreadweaver.so.4
#12 0xb75a0e83 in QThreadPrivate::start (arg=0x89f8c68) at thread/qthread_unix.cpp:188
#13 0xb7542885 in start_thread () from /lib/i686/libpthread.so.0
#14 0xb5f9457e in clone () from /lib/i686/libc.so.6

Thread 3 (Thread 0xa61ccb70 (LWP 20616)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb75469e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/i686/libpthread.so.0
#2  0xb75a1fb0 in QWaitCondition::wait (this=0x89284e8, mutex=0x8952e18, time=4294967295) at thread/qwaitcondition_unix.cpp:87
#3  0xb43eb3c9 in ?? () from /usr/lib/libthreadweaver.so.4
#4  0xb43edabb in ?? () from /usr/lib/libthreadweaver.so.4
#5  0xb43e9a1a in ?? () from /usr/lib/libthreadweaver.so.4
#6  0xb43edbbc in ?? () from /usr/lib/libthreadweaver.so.4
#7  0xb43eb653 in ?? () from /usr/lib/libthreadweaver.so.4
#8  0xb43ebc34 in ?? () from /usr/lib/libthreadweaver.so.4
#9  0xb43ec2aa in ThreadWeaver::Thread::run () from /usr/lib/libthreadweaver.so.4
#10 0xb75a0e83 in QThreadPrivate::start (arg=0x8bbef60) at thread/qthread_unix.cpp:188
#11 0xb7542885 in start_thread () from /lib/i686/libpthread.so.0
#12 0xb5f9457e in clone () from /lib/i686/libc.so.6

Thread 2 (Thread 0xa59cbb70 (LWP 20617)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb75469e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/i686/libpthread.so.0
#2  0xb75a1fb0 in QWaitCondition::wait (this=0x89284e8, mutex=0x8952e18, time=4294967295) at thread/qwaitcondition_unix.cpp:87
#3  0xb43eb3c9 in ?? () from /usr/lib/libthreadweaver.so.4
#4  0xb43edabb in ?? () from /usr/lib/libthreadweaver.so.4
#5  0xb43e9a1a in ?? () from /usr/lib/libthreadweaver.so.4
#6  0xb43edbbc in ?? () from /usr/lib/libthreadweaver.so.4
#7  0xb43eb653 in ?? () from /usr/lib/libthreadweaver.so.4
#8  0xb43edbd8 in ?? () from /usr/lib/libthreadweaver.so.4
#9  0xb43eb653 in ?? () from /usr/lib/libthreadweaver.so.4
#10 0xb43ebc34 in ?? () from /usr/lib/libthreadweaver.so.4
#11 0xb43ec2aa in ThreadWeaver::Thread::run () from /usr/lib/libthreadweaver.so.4
#12 0xb75a0e83 in QThreadPrivate::start (arg=0x8c1c2c0) at thread/qthread_unix.cpp:188
#13 0xb7542885 in start_thread () from /lib/i686/libpthread.so.0
#14 0xb5f9457e in clone () from /lib/i686/libc.so.6

Thread 1 (Thread 0xb56c76d0 (LWP 19597)):
[KCrash Handler]
#6  0xb62c29d8 in QIcon (this=0xbfd39088, other=@0x1d) at image/qicon.cpp:578
#7  0xb2f614ff in QuickSand::QsMatchView::showSelected (this=0x8a3a000) at /usr/src/debug/kdebase-workspace-4.3.2/krunner/interfaces/quicksand/qs_matchitem.h:55
#8  0xb2f6369c in QuickSand::QsMatchView::keyPressEvent (this=0x8a3a000, e=0xbfd39564) at /usr/src/debug/kdebase-workspace-4.3.2/krunner/interfaces/quicksand/qs_matchview.cpp:634
#9  0xb62757a7 in QWidget::event (this=0x8a3a000, event=0xbfd39564) at kernel/qwidget.cpp:7589
#10 0xb621e68c in QApplicationPrivate::notify_helper (this=0x8890a38, receiver=0x8a3a000, e=0xbfd39564) at kernel/qapplication.cpp:4065
#11 0xb6227096 in QApplication::notify (this=0x8a3a000, receiver=0x8a3a000, e=0xbfd39564) at kernel/qapplication.cpp:3664
#12 0xb6c7fa21 in KApplication::notify () from /usr/lib/libkdeui.so.5
#13 0xb7697c0e in QCoreApplication::notifyInternal (this=0x8890800, receiver=0x8a3a000, event=0xbfd39564) at kernel/qcoreapplication.cpp:610
#14 0xb621f5ad in qt_sendSpontaneousEvent (receiver=0x8a3a000, event=0xbfd39088) at ../../src/corelib/kernel/qcoreapplication.h:216
#15 0xb62bcc73 in QKeyMapper::sendKeyEvent (keyWidget=0x8a3a000, grab=false, type=QEvent::KeyPress, code=16777220, modifiers=) at kernel/qkeymapper_x11.cpp:1861
#16 0xb62bf2b2 in QKeyMapperPrivate::translateKeyEvent (this=0x88b66e0, keyWidget=0x8a3a000, event=0xbfd3ad2c, grab=29) at kernel/qkeymapper_x11.cpp:1831
#17 0xb6294e3e in QApplication::x11ProcessEvent (this=0x8890800, event=0xbfd3ad2c) at kernel/qapplication_x11.cpp:3445
#18 0xb62c0d88 in x11EventSourceDispatch (s=0x8893870, callback=0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#19 0xb5e0db92 in IA__g_main_context_dispatch (context=0x8892aa0) at gmain.c:1960
#20 0xb5e11468 in g_main_context_iterate (context=0x8892aa0, block=<value optimized out>, dispatch=1, self=0x8890b28) at gmain.c:2591
#21 0xb5e1158e in IA__g_main_context_iteration (context=0x8892aa0, may_block=1) at gmain.c:2654
#22 0xb76c38f1 in QEventDispatcherGlib::processEvents (this=0x8890a18, flags={i = 36}) at kernel/qeventdispatcher_glib.cpp:406
#23 0xb62c04ba in QGuiEventDispatcherGlib::processEvents (this=0x8890a18, flags={i = 36}) at kernel/qguieventdispatcher_glib.cpp:202
#24 0xb769626d in QEventLoop::processEvents (this=0xbfd3afe4, flags=) at kernel/qeventloop.cpp:149
#25 0xb76966b9 in QEventLoop::exec (this=0xbfd3afe4, flags={i = 0}) at kernel/qeventloop.cpp:201
#26 0xb7698b50 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:888
#27 0xb621e504 in QApplication::exec () at kernel/qapplication.cpp:3525
#28 0xb2f4cd79 in kdemain (argc=1, argv=0x8850680) at /usr/src/debug/kdebase-workspace-4.3.2/krunner/main.cpp:65
#29 0x0804da54 in _start ()

A+
Raph

@Raphaël: your crash is a different one, reported at bug 200648. Regards

Hi,

@Dario: ok I put my scenario in bug 200648. Thx

A+
Raph

*** Bug 221082 has been marked as a duplicate of this bug. ***

SVN commit 1070404 by ogoffart:

Fixes crash when calling KNotification::sendEvent while still waiting for id from dbus.

In that case, it could assign two id to the same notifications, resulting in crashes later.

BUG: 199485
BUG: 219985



 M  +16 -6     knotification.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1070404

*** Bug 222714 has been marked as a duplicate of this bug. ***

*** Bug 224744 has been marked as a duplicate of this bug. ***

*** Bug 224792 has been marked as a duplicate of this bug. ***

This is not fixed, so I'm reopening.

Thiago has kindly investigated this further, and it turns out that D-Bus
currently doesn't allow a range of Utf-8 characters that are reserved by the
Unicode specification and not permitted for interchange. This range is U+FDD0
through U+FDEF. More information can be found here:
http://www.unicode.org/charts/PDF/UFB50.pdf

There are multiple avenues to fix this:

a) QString could reject those characters.
b) QtDbus could filter out these characters.
c) KNotify could filter out these characters.
d) D-Bus could not close the connection when it sees these characters.

Whether or not 'a' and 'b' are realized or not, any such change will show up in
Qt 4.6.3 at the earliest, which is still some time out seeing as 4.6.2 is not
yet released.

'c' might thus be a good idea for now. However, seeing how KDE 4.4.0 is already
tagged, it might be too late for that release.

We should however probably not limit this filter to Qt versions older than
4.6.3, since instead of the fix being made in Qt, it might instead be made in
D-Bus. Thiago has written a mail to the D-Bus mailing list where he is
pursueing 'd'. See here:
http://lists.freedesktop.org/archives/dbus/2010-February/012182.html

I'm flagging this as a 4.4.0 blocker since it's a remote crash vulnerability (see #219985 for a concrete example involving Konversation). Thiago signed off on that.

- Could bug 203285 be the same issue, but on KDED4 ?
Regards

*** Bug 227217 has been marked as a duplicate of this bug. ***

Bug 224912 seems to be a related crash but in Dolphin

*** Bug 223240 has been marked as a duplicate of this bug. ***

*** Bug 231890 has been marked as a duplicate of this bug. ***

Created attachment 42472 [details]
New crash information added by DrKonqi

crash when i try to launch amarok with krunner

Created attachment 43388 [details]
New crash information added by DrKonqi

krunner crashed while launching skype

*** Bug 242212 has been marked as a duplicate of this bug. ***

*** Bug 245241 has been marked as a duplicate of this bug. ***

*** Bug 247329 has been marked as a duplicate of this bug. ***

Created attachment 52908 [details]
New crash information added by DrKonqi

These are the steps I followed (this happens now and then):
1. Press Alt+F2 to bring up the krunner application.
2. Type in first 3-4 letters of the word Konsole.
3. I do not get this far and the application crashes

*** Bug 225286 has been marked as a duplicate of this bug. ***

*** Bug 212695 has been marked as a duplicate of this bug. ***

*** Bug 235462 has been marked as a duplicate of this bug. ***

*** Bug 239844 has been marked as a duplicate of this bug. ***

*** Bug 244476 has been marked as a duplicate of this bug. ***

*** Bug 254191 has been marked as a duplicate of this bug. ***

*** Bug 202139 has been marked as a duplicate of this bug. ***

This crash has been fixed in Qt 4.6.3 or later.

http://bugreports.qt.nokia.com/browse/QTBUG-11374