Bug 210106

Summary: Crash in marker cleanup code [QList::*, IRCView::cullMarkedLine]
Product: [Applications] konversation Reporter: Modestas Vainius <modax>
Component: ircviewAssignee: Konversation Developers <konversation-devel>
Status: RESOLVED FIXED    
Severity: crash CC: antoine.mechelynck, b.buschinski, bruno, bugs.kde.org3, code.jtr, cody, demopley, dvratil, hein, hsr.desktop, keever, konversation-devel, kristjan.ugrin, luke-jr+kdebugs, rc.dunphy, rdieter, scott, sean.s.85, spindlerline, valir, wk, wstephenson, xejakig884
Priority: NOR    
Version: 1.2   
Target Milestone: ---   
Platform: Debian testing   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:
Attachments: New crash information added by DrKonqi
New crash information added by DrKonqi
New crash information added by DrKonqi
New crash information added by DrKonqi

Description Modestas Vainius 2009-10-10 19:53:46 UTC
Version:           1.2 (using KDE 4.3.1)
OS:                Linux
Installed from:    Debian testing/unstable Packages

Konversation 1.2 crashed when switching channel tab with keyboard. The crash is in the marker line code. Backtrace below:

Application: Konversation (konversation), signal: Segmentation fault
[Current thread is 1 (Thread 0x7fb055cfc750 (LWP 23949))]
 
Thread 2 (Thread 0x7fb04310f950 (LWP 23950)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:261
#1  0x00007fb052059499 in QWaitConditionPrivate::wait (this=0x2660cd0, mutex=0x2660cc8, time=18446744073709551615) at thread/qwaitcondition_unix.cpp:87
#2  QWaitCondition::wait (this=0x2660cd0, mutex=0x2660cc8, time=18446744073709551615) at thread/qwaitcondition_unix.cpp:159
#3  0x00007fb0536713b4 in QHostInfoAgent::run (this=0x2660cb0) at kernel/qhostinfo.cpp:260
#4  0x00007fb0520584a5 in QThreadPrivate::start (arg=0x2660cb0) at thread/qthread_unix.cpp:188
#5  0x00007fb04ed23f9a in start_thread (arg=<value optimized out>) at pthread_create.c:300
#6  0x00007fb0509b156d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#7  0x0000000000000000 in ?? ()
 
Thread 1 (Thread 0x7fb055cfc750 (LWP 23949)):
[KCrash Handler]
#5  *__GI___libc_free (mem=0x41) at malloc.c:3599
#6  0x000000000052f767 in QList<QTextBlock>::node_destruct (this=0x349eb98, it=...) at /usr/include/qt4/QtCore/qlist.h:348
#7  QList<QTextBlock>::erase (this=0x349eb98, it=...) at /usr/include/qt4/QtCore/qlist.h:391
#8  0x00000000005227d6 in QList<QTextBlock>::removeFirst (this=0x349eb60, where=<value optimized out>, rem=<value optimized out>, add=<value optimized out>) at /usr/include/qt4/QtCore/qlist.h:256
#9  QList<QTextBlock>::takeFirst (this=0x349eb60, where=<value optimized out>, rem=<value optimized out>, add=<value optimized out>) at /usr/include/qt4/QtCore/qlist.h:416
#10 IRCView::cullMarkedLine (this=0x349eb60, where=<value optimized out>, rem=<value optimized out>, add=<value optimized out>) at ../../src/viewer/ircview.cpp:375
#11 0x00000000004421c3 in IRCView::qt_metacall (this=0x349eb60, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fffbeb44690) at moc_ircview.cpp:212
#12 0x00007fb052152df2 in QMetaObject::activate (sender=0x34a0ac0, from_signal_index=<value optimized out>, to_signal_index=4, argv=0x0) at kernel/qobject.cpp:3112
#13 0x00007fb051bc78da in QTextDocument::contentsChange (this=0x41, _t1=0, _t2=1, _t3=0) at .moc/release-shared/moc_qtextdocument.cpp:181
#14 0x00007fb0517f0c1b in QTextDocumentPrivate::endEditBlock (this=0x34a3aa0) at text/qtextdocument_p.cpp:1102
#15 0x00007fb0517f090d in QTextDocumentPrivate::ensureMaximumBlockCount (this=0x34a3aa0) at text/qtextdocument_p.cpp:1584
#16 0x00007fb0517f0baf in QTextDocumentPrivate::endEditBlock (this=0x34a3aa0) at text/qtextdocument_p.cpp:1112
#17 0x00007fb05181c90f in QTextCursor::insertBlock (this=0x7fffbeb44960, format=..., _charFormat=...) at text/qtextcursor.cpp:1898
#18 0x00007fb05181c9af in QTextCursor::insertBlock (this=0x7fffbeb44960, format=...) at text/qtextcursor.cpp:1875
#19 0x00007fb05181ca07 in QTextCursor::insertBlock (this=0x7fffbeb44960) at text/qtextcursor.cpp:1860
#20 0x0000000000523b1e in IRCView::appendLine (this=0x349eb60, type=IRCView::RememberLine) at ../../src/viewer/ircview.cpp:508
#21 0x0000000000523e59 in IRCView::appendRememberLine (this=0x349eb60) at ../../src/viewer/ircview.cpp:441
#22 0x0000000000524ae5 in IRCView::doAppend (this=0x41, newLine=..., rtl=false, self=false) at ../../src/viewer/ircview.cpp:812
#23 0x000000000052ca7e in IRCView::appendCommandMessage (this=0x349eb60, type=..., message=..., important=<value optimized out>, parseURL=<value optimized out>, self=false)
    at ../../src/viewer/ircview.cpp:764
#24 0x00000000004c1b68 in Channel::joinNickname (this=0x345c8b0, channelNick=...) at ../../src/irc/channel.cpp:1395
#25 0x0000000000498f18 in Server::nickJoinsChannel (this=0x2466500, channelName=<value optimized out>, nickname=..., hostmask=...) at ../../src/irc/server.cpp:2738
#26 0x00000000004edb83 in InputFilter::parseClientCommand (this=0x2466620, prefix=..., command=..., parameterList=<value optimized out>) at ../../src/irc/inputfilter.cpp:627
#27 0x00000000004f9af0 in InputFilter::parseLine (this=0x2466620, line=...) at ../../src/irc/inputfilter.cpp:151
#28 0x0000000000496aaf in Server::processIncomingData (this=0x2466500) at ../../src/irc/server.cpp:897
#29 0x00000000004a81d5 in Server::qt_metacall (this=0x2466500, _c=QMetaObject::InvokeMetaMethod, _id=0, _a=0x7fffbeb45d40) at ./server.moc:383
#30 0x00007fb052152df2 in QMetaObject::activate (sender=0x2466580, from_signal_index=<value optimized out>, to_signal_index=4, argv=0x0) at kernel/qobject.cpp:3112
#31 0x00007fb05214d353 in QObject::event (this=0x2466580, e=0x349eb98) at kernel/qobject.cpp:1074
#32 0x00007fb0515b701d in QApplicationPrivate::notify_helper (this=0x211eb30, receiver=0x2466580, e=0x7fffbeb463f0) at kernel/qapplication.cpp:4065
#33 0x00007fb0515bf07a in QApplication::notify (this=0x7fffbeb46730, receiver=0x2466580, e=0x7fffbeb463f0) at kernel/qapplication.cpp:4030
#34 0x00007fb052faa0db in KApplication::notify (this=0x7fffbeb46730, receiver=0x2466580, event=0x7fffbeb463f0) at ../../kdeui/kernel/kapplication.cpp:302
#35 0x00007fb05213dc9c in QCoreApplication::notifyInternal (this=0x7fffbeb46730, receiver=0x2466580, event=0x7fffbeb463f0) at kernel/qcoreapplication.cpp:610
#36 0x00007fb05216a2c6 in QCoreApplication::sendEvent (this=0x2122320) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:213
#37 QTimerInfoList::activateTimers (this=0x2122320) at kernel/qeventdispatcher_unix.cpp:580
#38 0x00007fb052166658 in timerSourceDispatch (source=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:184
#39 idleTimerSourceDispatch (source=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:231
#40 0x00007fb04da0412a in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#41 0x00007fb04da07988 in ?? () from /lib/libglib-2.0.so.0
#42 0x00007fb04da07b3c in g_main_context_iteration () from /lib/libglib-2.0.so.0
#43 0x00007fb05216639c in QEventDispatcherGlib::processEvents (this=0x20f44c0, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:407
#44 0x00007fb05164df1f in QGuiEventDispatcherGlib::processEvents (this=0x41, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:202
#45 0x00007fb05213c562 in QEventLoop::processEvents (this=<value optimized out>, flags=...) at kernel/qeventloop.cpp:149
#46 0x00007fb05213c934 in QEventLoop::exec (this=0x7fffbeb466a0, flags=...) at kernel/qeventloop.cpp:201
#47 0x00007fb05213eba4 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:888
#48 0x0000000000467121 in main (argc=5, argv=0x7fffbeb47448) at ../../src/main.cpp:98
Comment 1 Eike Hein 2011-06-27 13:35:21 UTC
*** Bug 214514 has been marked as a duplicate of this bug. ***
Comment 2 Eike Hein 2011-09-09 13:58:22 UTC
*** Bug 281663 has been marked as a duplicate of this bug. ***
Comment 3 Eike Hein 2011-09-12 15:06:00 UTC
*** Bug 281874 has been marked as a duplicate of this bug. ***
Comment 4 Daniel Vrátil 2011-09-13 20:35:26 UTC
Created attachment 63629 [details]
New crash information added by DrKonqi

konversation (1.3.1) on KDE Platform 4.7.41 (4.7.41 (KDE 4.8 >= 20110807) using Qt 4.7.4

I can confirm this crash, happend to me a few times already, always when Konversation was minimized in tray. My backtrace is slightly different, maybe it will make it easier to track down the cause of the crash.

-- Backtrace (Reduced):
#11 0x00000000005044c5 in QList<QTextBlock>::first (this=0x19685b8) at /usr/include/QtCore/qlist.h:269
#12 0x00000000005045ac in QList<QTextBlock>::takeFirst (this=0x19685b8) at /usr/include/QtCore/qlist.h:477
#13 0x0000000000503579 in IRCView::cullMarkedLine (this=0x1968580, where=<optimized out>, rem=<optimized out>, add=<optimized out>) at /tmp/yaourt-tmp-progdan/abs-konversation/src/konversation-1.3.1/src/viewer/ircview.cpp:474
#14 0x0000000000446feb in IRCView::qt_metacall (this=0x1968580, _c=QMetaObject::InvokeMetaMethod, _id=<optimized out>, _a=0x7fffc4bb5640) at /tmp/yaourt-tmp-progdan/abs-konversation/src/build/src/moc_ircview.cpp:224
[...]
#16 0x00007f96d7d77b6a in QTextDocument::contentsChange(int, int, int) () from /usr/lib/libQtGui.so.4
Comment 5 Bernd Buschinski 2011-09-22 21:16:58 UTC
*** Bug 282576 has been marked as a duplicate of this bug. ***
Comment 6 Bernd Buschinski 2011-09-28 14:20:33 UTC
*** Bug 282971 has been marked as a duplicate of this bug. ***
Comment 7 argonel 2011-09-30 10:49:01 UTC
Git commit cbe876c954b5deaf1a6729b7123d6880df4513ee by eli mackenzie.
Committed on 30/09/2011 at 12:41.
Pushed by argonel into branch 'master'.

Changed method of remember/marker line tracking.

Qt 4.7.4 introduces a change to the handling of
QTextBlock::userState that makes it unusable for the purposes of
tracking which block represents a marker or remember line. Previous
versions of Qt also changed or otherwise corrupted the userState
value causing the loss of synchronization with the data held in the
IRCView itself. Blocks are now tracked via the userData field, which
was unmolested in the change made to QTextDocument.

Warning: this commit introduces a large volume of debugging output.

For more information about the Qt change, see QTBUG-20916.

BUG: 210106
CCBUG: 260598

M  +1    -1    src/commit.h
M  +17   -0    src/irc/outputfilter.cpp
M  +1    -0    src/irc/outputfilter.h
M  +278  -95   src/viewer/ircview.cpp
M  +16   -9    src/viewer/ircview.h

http://commits.kde.org/konversation/cbe876c954b5deaf1a6729b7123d6880df4513ee
Comment 8 Bernd Buschinski 2011-10-03 09:53:13 UTC
*** Bug 283231 has been marked as a duplicate of this bug. ***
Comment 9 Bernd Buschinski 2011-10-10 16:21:39 UTC
*** Bug 283717 has been marked as a duplicate of this bug. ***
Comment 10 Will Stephenson 2011-10-11 06:35:51 UTC
Can you backport this fix to 1.3.1?  Although the patch applies with a bit of tickling, build fails because OutputFilterInput::context is not present in the 1.3.1 codebase.
Comment 11 Bernd Buschinski 2011-10-13 06:55:15 UTC
*** Bug 283890 has been marked as a duplicate of this bug. ***
Comment 12 Bernd Buschinski 2011-10-13 06:55:50 UTC
*** Bug 283891 has been marked as a duplicate of this bug. ***
Comment 13 Eike Hein 2011-10-13 23:53:05 UTC
Will: We'll be making the fix available for 1.3.1 on a branch in konversation.git soon. Eli will post the details when it's done. We won't be able to officially support Konversation builds using it, however.

Hopefully the 1.4 release won't be that long now, either.
Comment 14 argonel 2011-10-14 08:45:31 UTC
Git commit 4a9627ef625342b450b1101ac1575bab44b5641a by eli mackenzie.
Committed on 30/09/2011 at 12:41.
Pushed by argonel into branch '1.3.1'.

reformulation of cbe876c for v1.3.1

CCBUG:210106

M  +12   -0    ChangeLog
M  +1    -1    src/commit.h
M  +1    -1    src/version.h
M  +103  -103  src/viewer/ircview.cpp
M  +16   -9    src/viewer/ircview.h

http://commits.kde.org/konversation/4a9627ef625342b450b1101ac1575bab44b5641a
Comment 15 Eike Hein 2011-10-15 12:48:55 UTC
*** Bug 284077 has been marked as a duplicate of this bug. ***
Comment 16 Bernd Buschinski 2011-10-21 12:41:44 UTC
*** Bug 284614 has been marked as a duplicate of this bug. ***
Comment 17 Bernd Buschinski 2011-10-22 08:32:58 UTC
*** Bug 284665 has been marked as a duplicate of this bug. ***
Comment 18 argonel 2011-10-22 18:26:03 UTC
[ 4 emails per report is too many ]
Comment 19 Bernd Buschinski 2011-11-02 19:10:54 UTC
*** Bug 285578 has been marked as a duplicate of this bug. ***
Comment 20 Bruno Friedmann 2011-11-04 06:28:43 UTC
Created attachment 65215 [details]
New crash information added by DrKonqi

konversation (1.3.1) on KDE Platform 4.7.2 (4.7.2) using Qt 4.7.4

- What I was doing when the application crashed:
My KDE come from KDF repository, up to date.
Don't know if the patch has already been applied ?
Normally yes, during one week no crash appear, now it always crash during the night.

Will, did we get a regression somewhere on obs ?

-- Backtrace (Reduced):
#6  0x00007ffc08cb6d95 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#7  0x00007ffc08cb82ab in __GI_abort () at abort.c:93
[...]
#9  0x00007ffc08cf6c06 in malloc_printerr (action=3, str=0x7ffc08dcd77b "free(): invalid pointer", ptr=<optimized out>) at malloc.c:6283
#10 0x0000000000524171 in node_destruct (n=0x105ee48, this=<optimized out>) at /usr/include/QtCore/qlist.h:375
#11 erase (it=<optimized out>, this=<optimized out>) at /usr/include/QtCore/qlist.h:452
Comment 21 Bruno Friedmann 2011-11-07 08:48:50 UTC
Created attachment 65329 [details]
New crash information added by DrKonqi

konversation (1.3.1) on KDE Platform 4.7.3 (4.7.3) using Qt 4.7.4

- What I was doing when the application crashed: Seems that on openSUSE KDF 4.7.3 the patch is not included, or has a problem somewhere.

I get that each morning, after letting konversation alone open during the  night

-- Backtrace (Reduced):
#6  0x00007f72bab86d95 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#7  0x00007f72bab882ab in __GI_abort () at abort.c:93
[...]
#9  0x00007f72babc6c06 in malloc_printerr (action=3, str=0x7f72bac9d77b "free(): invalid pointer", ptr=<optimized out>) at malloc.c:6283
#10 0x0000000000524171 in node_destruct (n=0x120f8b8, this=<optimized out>) at /usr/include/QtCore/qlist.h:375
#11 erase (it=<optimized out>, this=<optimized out>) at /usr/include/QtCore/qlist.h:452
Comment 22 Eike Hein 2011-11-08 10:45:24 UTC
*** Bug 286092 has been marked as a duplicate of this bug. ***
Comment 23 Bernd Buschinski 2011-11-16 21:41:37 UTC
*** Bug 286805 has been marked as a duplicate of this bug. ***
Comment 24 Eike Hein 2011-11-18 18:55:57 UTC
*** Bug 286951 has been marked as a duplicate of this bug. ***
Comment 25 Bruno Friedmann 2011-11-19 20:42:57 UTC
Created attachment 65850 [details]
New crash information added by DrKonqi

konversation (1.3.1) on KDE Platform 4.7.3 (4.7.3) using Qt 4.7.4

- What I was doing when the application crashed: Sorry I'm now on 12.2 (factory) with KDF during one week I didn't get crash now with new build this one start to reappear.
We have a regression! or a patch is forget during the obs build.

Will can have you a look at it ? Thanks.

-- Backtrace (Reduced):
#6  0x00007f8b6ebdfd15 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#7  0x00007f8b6ebe122b in __GI_abort () at abort.c:93
[...]
#9  0x00007f8b6ec1fb86 in malloc_printerr (action=3, str=0x7f8b6ecf66fb "free(): invalid pointer", ptr=<optimized out>) at malloc.c:6283
#10 0x0000000000524171 in node_destruct (n=0x2ce7608, this=<optimized out>) at /usr/include/QtCore/qlist.h:375
#11 erase (it=<optimized out>, this=<optimized out>) at /usr/include/QtCore/qlist.h:452
Comment 26 Eike Hein 2011-11-22 15:43:13 UTC
*** Bug 287269 has been marked as a duplicate of this bug. ***
Comment 27 Eike Hein 2011-11-28 19:49:03 UTC
Git commit 72111c725e35ce8c98933f768f9c826a5ad7a55d by Eike Hein.
Committed on 28/11/2011 at 20:46.
Pushed by hein into branch 'master'.

Clean up line breaks in app description.

BUG:210106

M  +2    -3    src/main.cpp

http://commits.kde.org/konversation/72111c725e35ce8c98933f768f9c826a5ad7a55d
Comment 28 Eike Hein 2011-11-28 19:55:07 UTC
Sorry about that, wrong bug number due to a clipboard problem with NX.
Comment 29 argonel 2012-01-14 05:03:33 UTC
*** Bug 291478 has been marked as a duplicate of this bug. ***