Bug 213014

Summary: crash when closing a document [QList<int>::operator[], KateViewDocumentProxyModel::mapFromSource, KateViewDocumentProxyModel::removeItemFromColoring]
Product: [Applications] kate Reporter: simon
Component: generalAssignee: KWrite Developers <kwrite-bugs-null>
Status: RESOLVED FIXED    
Severity: crash CC: andresbajotierra, colin, dhaumann, vivo75+kde
Priority: VHI    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: Compiled Sources   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:
Attachments: New crash information added by DrKonqi
New crash information added by DrKonqi
New crash information added by DrKonqi
Backtrace.

Description simon 2009-11-04 03:16:59 UTC
Application: kate (3.3.73)
KDE Version: 4.3.73 (KDE 4.3.73 (KDE 4.4 >= 20091026)) (Compiled from sources)
Qt Version: 4.6.0
Operating System: Linux 2.6.31-zen4 x86_64
Distribution (Platform): Gentoo Packages

 -- Backtrace:
Application: Kate (kdeinit4), signal: Aborted
[Current thread is 1 (Thread 0x7f9bb7b79740 (LWP 17121))]

Thread 2 (Thread 0x7f9ba6125950 (LWP 17648)):
#0  0x00007f9bb72f3d09 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#1  0x00007f9ba6a8c5ce in WTF::TCMalloc_PageHeap::scavengerThread (this=0x7f9ba6d571c0) at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:2299
#2  0x00007f9ba6a8c609 in WTF::TCMalloc_PageHeap::runScavengerThread (context=0x7f9ba6d6528c) at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:1433
#3  0x00007f9bb72effc7 in start_thread () from /lib/libpthread.so.0
#4  0x00007f9bb3d8f1fd in clone () from /lib/libc.so.6

Thread 1 (Thread 0x7f9bb7b79740 (LWP 17121)):
[KCrash Handler]
#5  0x00007f9bb3cf2ec5 in raise () from /lib/libc.so.6
#6  0x00007f9bb3cf43c1 in abort () from /lib/libc.so.6
#7  0x00007f9bb7573e65 in qt_message_output (msgType=QtFatalMsg, buf=<value optimized out>) at global/qglobal.cpp:2211
#8  0x00007f9bb757400c in qt_message (msgType=QtFatalMsg, msg=0x7f9bb76efbb8 "ASSERT failure in %s: \"%s\", file %s, line %d", ap=0x7fffa1fa7de0) at global/qglobal.cpp:2257
#9  0x00007f9bb75741c5 in qFatal (msg=0x42e1 <Address 0x42e1 out of bounds>) at global/qglobal.cpp:2440
#10 0x00007f9baa31317f in QList<int>::operator[] (this=0x934b60, i=9) at /usr/include/qt4/QtCore/qlist.h:443
#11 0x00007f9baa30e35e in KateViewDocumentProxyModel::mapFromSource (this=0x934b10, sourceIndex=...) at /var/tmp/portage/kde-base/kate-9999/work/kate-9999/kate/app/kateviewdocumentproxymodel.cpp:325
#12 0x00007f9baa30fabd in KateViewDocumentProxyModel::removeItemFromColoring (this=0x934b10, row=6) at /var/tmp/portage/kde-base/kate-9999/work/kate-9999/kate/app/kateviewdocumentproxymodel.cpp:505
#13 0x00007f9baa30fd2d in KateViewDocumentProxyModel::slotRowsAboutToBeRemoved (this=0x934b10, parent=<value optimized out>, start=1, end=<value optimized out>)
    at /var/tmp/portage/kde-base/kate-9999/work/kate-9999/kate/app/kateviewdocumentproxymodel.cpp:530
#14 0x00007f9baa311564 in KateViewDocumentProxyModel::qt_metacall (this=0x934b10, _c=InvokeMetaMethod, _id=11, _a=0x7fffa1fa82f0)
    at /var/tmp/portage/kde-base/kate-9999/work/kate-9999_build/kate/app/kateviewdocumentproxymodel.moc:117
#15 0x00007f9bb76997bf in QMetaObject::activate (sender=0x740630, m=<value optimized out>, local_signal_index=<value optimized out>, argv=0xffffffffffffffff) at kernel/qobject.cpp:3390
#16 0x00007f9bb76ec5d4 in QAbstractItemModel::rowsAboutToBeRemoved (this=0x42e1, _t1=<value optimized out>, _t2=1, _t3=1) at .moc/debug-shared/moc_qabstractitemmodel.cpp:188
#17 0x00007f9bb7675b65 in QAbstractItemModel::beginRemoveRows (this=0x740630, parent=..., first=1, last=1) at kernel/qabstractitemmodel.cpp:2447
#18 0x00007f9bb4ee5e51 in QStandardItemModelPrivate::rowsAboutToBeRemoved (this=<value optimized out>, parent=<value optimized out>, start=1, end=1) at itemviews/qstandarditemmodel.cpp:535
#19 0x00007f9bb4ee9a5f in QStandardItem::removeRows (this=0x741ce0, row=1, count=1) at itemviews/qstandarditemmodel.cpp:1618
#20 0x00007f9bb4ee9c93 in QStandardItemModel::removeRows (this=<value optimized out>, row=1, count=1, parent=<value optimized out>) at itemviews/qstandarditemmodel.cpp:2800
#21 0x00007f9baa2e51f5 in QAbstractItemModel::removeRow (this=0x42e1, arow=17121, aparent=...) at /usr/include/qt4/QtCore/qabstractitemmodel.h:315
#22 0x00007f9baa2e35d5 in KateDocManager::deleteDoc (this=0x740630, doc=0x10cb1c0) at /var/tmp/portage/kde-base/kate-9999/work/kate-9999/kate/app/katedocmanager.cpp:225
#23 0x00007f9baa2e3e37 in KateDocManager::closeDocument (this=0x740630, doc=0x10cb1c0, closeUrl=136) at /var/tmp/portage/kde-base/kate-9999/work/kate-9999/kate/app/katedocmanager.cpp:365
#24 0x00007f9baa2f5056 in KateViewManager::slotDocumentClose (this=<value optimized out>, document=0x10cb1c0) at /var/tmp/portage/kde-base/kate-9999/work/kate-9999/kate/app/kateviewmanager.cpp:202
#25 0x00007f9baa2f7579 in KateViewManager::qt_metacall (this=0x90e350, _c=InvokeMetaMethod, _id=9, _a=0x7fffa1fa8980)
    at /var/tmp/portage/kde-base/kate-9999/work/kate-9999_build/kate/app/kateviewmanager.moc:130
#26 0x00007f9bb76997bf in QMetaObject::activate (sender=0x96d910, m=<value optimized out>, local_signal_index=<value optimized out>, argv=0xffffffffffffffff) at kernel/qobject.cpp:3390
#27 0x00007f9bb4969752 in QAction::triggered (this=0x42e1, _t1=false) at .moc/debug-shared/moc_qaction.cpp:263
#28 0x00007f9bb496a840 in QAction::activate (this=0x96d910, event=<value optimized out>) at kernel/qaction.cpp:1245
#29 0x00007f9bb4cf600a in QAbstractButtonPrivate::click (this=0x9c4de0) at widgets/qabstractbutton.cpp:528
#30 0x00007f9bb4cf629d in QAbstractButton::mouseReleaseEvent (this=0x9973f0, e=0x7fffa1fa9470) at widgets/qabstractbutton.cpp:1118
#31 0x00007f9bb4db97ca in QToolButton::mouseReleaseEvent (this=0x42e1, e=0x42e1) at widgets/qtoolbutton.cpp:721
#32 0x00007f9bb49c9d3c in QWidget::event (this=0x9973f0, event=0x7fffa1fa9470) at kernel/qwidget.cpp:7904
#33 0x00007f9bb49703c6 in QApplicationPrivate::notify_helper (this=0x6b0e10, receiver=0x9973f0, e=0x7fffa1fa9470) at kernel/qapplication.cpp:4277
#34 0x00007f9bb497a4a5 in QApplication::notify (this=0x7fffa1faa120, receiver=0x9973f0, e=0x7fffa1fa9470) at kernel/qapplication.cpp:3863
#35 0x00007f9bb5a61201 in KApplication::notify(QObject*, QEvent*) () from /usr/lib64/libkdeui.so.5
#36 0x00007f9bb76827f3 in QCoreApplication::notifyInternal (this=0x7fffa1faa120, receiver=0x9973f0, event=0x7fffa1fa9470) at kernel/qcoreapplication.cpp:704
#37 0x00007f9bb4979191 in sendEvent (event=<value optimized out>, receiver=<value optimized out>) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:215
#38 QApplicationPrivate::sendMouseEvent (event=<value optimized out>, receiver=<value optimized out>) at kernel/qapplication.cpp:3002
#39 0x00007f9bb49e8dcb in QETWidget::translateMouseEvent (this=0x8f5210, event=<value optimized out>) at kernel/qapplication_x11.cpp:4396
#40 0x00007f9bb49e7926 in QApplication::x11ProcessEvent (this=0x7fffa1faa120, event=0x7fffa1fa9c80) at kernel/qapplication_x11.cpp:3535
#41 0x00007f9bb4a0ecfc in x11EventSourceDispatch (s=0x6b2570, callback=0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#42 0x00007f9bb31f0e51 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#43 0x00007f9bb31f43e8 in g_main_context_iterate () from /usr/lib/libglib-2.0.so.0
#44 0x00007f9bb31f459c in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#45 0x00007f9bb76b1115 in QEventDispatcherGlib::processEvents (this=0x6af010, flags=...) at kernel/qeventdispatcher_glib.cpp:407
#46 0x00007f9bb4a0e5cf in QGuiEventDispatcherGlib::processEvents (this=0x42e1, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:202
#47 0x00007f9bb76818b5 in QEventLoop::processEvents (this=<value optimized out>, flags=...) at kernel/qeventloop.cpp:149
#48 0x00007f9bb7681c0c in QEventLoop::exec (this=0x7fffa1fa9fd0, flags=...) at kernel/qeventloop.cpp:201
#49 0x00007f9bb7683ef9 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:981
#50 0x00007f9baa547744 in kdemain (argc=3, argv=0x659f70) at /var/tmp/portage/kde-base/kate-9999/work/kate-9999/kate/app/katemain.cpp:377
#51 0x00000000004077cd in _start ()

Reported using DrKonqi
Comment 1 Dario Andres 2010-02-04 02:47:33 UTC
From bug 225385 (KDE SC 4.3.98):
When I open several files (of various types - PHP or C/C++ files are affected)
and close them (via ctrl+w), Kate will crash. This is intermittent but very
easy to reproduce (closing half a dozen files fairly quickly seems to do it,
but it can also be triggered when just closing one file).

#0  0x00007f2d288b4955 in raise () from /lib64/libc.so.6
#1  0x00007f2d288b5f70 in abort () from /lib64/libc.so.6
#2  0x00007f2d2681f3e4 in qt_message_output (msgType=QtFatalMsg, buf=<value
optimized out>) at global/qglobal.cpp:2250
#3  0x00007f2d2681f5c2 in qt_message(QtMsgType, const char *, typedef
__va_list_tag __va_list_tag *) (msgType=QtFatalMsg, msg=0x7f2d2697ba58 "ASSERT
failure in %s: \"%s\", file %s, line %d", ap=
    0x7fff4e2be5e0) at global/qglobal.cpp:2296
#4  0x00007f2d2681f775 in qFatal (msg=0x5f3e <Address 0x5f3e out of bounds>) at
global/qglobal.cpp:2479
#5  0x00007f2d27558a0f in QList<int>::operator[](int) const () from
/usr/lib64/libkateinterfaces.so.4
#6  0x00007f2d2755397e in KateViewDocumentProxyModel::mapFromSource
(this=0x35c5df0, sourceIndex=...) at
/usr/src/debug/kdesdk-4.3.98/kate/app/kateviewdocumentproxymodel.cpp:331
#7  0x00007f2d27555200 in KateViewDocumentProxyModel::removeItemFromColoring
(this=0x35c5df0, row=5) at
/usr/src/debug/kdesdk-4.3.98/kate/app/kateviewdocumentproxymodel.cpp:518
#8  0x00007f2d275553af in KateViewDocumentProxyModel::slotRowsAboutToBeRemoved
(this=<value optimized out>, parent=<value optimized out>, start=<value
optimized out>, end=6)
    at /usr/src/debug/kdesdk-4.3.98/kate/app/kateviewdocumentproxymodel.cpp:536
...
Comment 2 Dario Andres 2010-02-04 02:47:51 UTC
*** Bug 225385 has been marked as a duplicate of this bug. ***
Comment 3 Colin Guthrie 2010-02-26 15:33:54 UTC
Is any additional info needed on this? This bug affects me about 10-15 times a day and it's really a big problem :s
Comment 4 Milian Wolff 2010-02-26 15:57:07 UTC
A way to reproduce it would help a lot. I can open tons of files in kate and press CTRL + W as often as I like to, it still doesn't crash...
Comment 5 Colin Guthrie 2010-02-26 18:02:06 UTC
Hmm, that's annoying. It seems to do it on pretty much any file I have, but it is sporadic. :s

I guess I'll just have to get my hands dirty and built it myself and see if I can work it out as I doubt I can work out a sensible test case (or at least in working out said test case I'll probably be close to finding the problem anyway!)
Comment 6 Francesco Riosa 2010-04-01 19:19:46 UTC
Created attachment 42430 [details]
New crash information added by DrKonqi

writing from the Crash Report Assistant, kate often crash when closing documents, it happen more when the number of opened file is >= 30.
the vast majority of files open are python scripts, with some bash or plain text
Comment 7 Francesco Riosa 2010-04-01 19:50:30 UTC
(In reply to comment #6)
> Created an attachment (id=42430) [details]
> New crash information added by DrKonqi
> 
> writing from the Crash Report Assistant, kate often crash when closing
> documents, it happen more when the number of opened file is >= 30.
> the vast majority of files open are python scripts, with some bash or plain
> text

Additionally:

"Sort by" of the documents panel is set to "Custom"
Comment 8 Francesco Riosa 2010-04-27 13:48:13 UTC
Created attachment 43058 [details]
New crash information added by DrKonqi

How to reproduce:
- open kate
- make left panel "Documents" visible, right click on it, select "Sort By" and then  "Custom"
- close kate
- open kate, using a new session
- by hitting ctrl+N open 70 new files
- reorder last 3 files created, the sequence could be 67,70,69,68
- click in visual descending order (67,70,69,68), 
- when on the last document (68) start rapidly closing them by hitting Ctrl+W
- kate should crash no later than 4rd document closed

HIH
Comment 9 Francesco Riosa 2010-05-07 21:06:35 UTC
To be more precise:
1) number of documents does not matter, 
2) the order matter

- by hitting ctrl+N open a total of 5 new files
- move "Untitled (5)" after "Untitled (2)"
- move "Untitled (4)" after "Untitled (5)"
- with mouse select "Untitled (3)" (the last one now)
- now hit ctrl+W, kate close  "Untitled (3)"
- you're now positioned on  "Untitled (5)"
- hit ctrl+W, kate Krash

Version 3.4.3
Using KDE Development Platform 4.4.3 (KDE 4.4.3)





(In reply to comment #8)
> Created an attachment (id=43058) [details]
> New crash information added by DrKonqi
> 
> How to reproduce:
> - open kate
> - make left panel "Documents" visible, right click on it, select "Sort By" and
> then  "Custom"
> - close kate
> - open kate, using a new session
> - by hitting ctrl+N open 70 new files
> - reorder last 3 files created, the sequence could be 67,70,69,68
> - click in visual descending order (67,70,69,68), 
> - when on the last document (68) start rapidly closing them by hitting Ctrl+W
> - kate should crash no later than 4rd document closed
> 
> HIH
Comment 10 Francesco Riosa 2010-05-07 21:13:18 UTC
Created attachment 43352 [details]
New crash information added by DrKonqi

backtrace for comment #9


as said before is totally reproducible
Comment 11 Dominik Haumann 2010-05-08 00:47:27 UTC
fix crash when closing a document (bug #213014)

The entire code in KateViewDocumentProxyModel is crap...
related: bug #187747

Fixed for KDE SC 4.5 with this commit:
http://gitorious.org/kate/kate/commit/f6702b275e3f50f4cbe6dbf8755db36fef5b7319
Comment 12 Colin Guthrie 2010-05-08 22:45:36 UTC
Not sure if you want to reopen this one or for me to create a new one, but I'm still getting a problem (could be unrelated but happens when closing documents in the same way).

Backtrace on it's way.
Comment 13 Colin Guthrie 2010-05-08 22:48:10 UTC
Created attachment 43377 [details]
Backtrace.

This is the backtrace after opening 30 php files and closing two. Seems to be quite consistently after the second file close.

This is with the patch from above applied over 4.4.3 release (perhaps other backports are needed too?)
Comment 14 Dominik Haumann 2010-05-09 01:58:41 UTC
The backtrace you posted is the same as in bug #203774, which is yet another bug in the proxy model...

So this crash is not related.
Comment 15 Colin Guthrie 2010-05-09 10:30:49 UTC
Ahh thanks, /me goes and follows that bug :)