Bug 228118

Summary: Dolphin crashed after opening and deleting a few image files
Product: [Applications] dolphin Reporter: Dima Ryazanov <dima>
Component: generalAssignee: Peter Penz <peter.penz19>
Status: RESOLVED DUPLICATE    
Severity: crash CC: andresbajotierra
Priority: NOR    
Version: 16.12.2   
Target Milestone: ---   
Platform: Ubuntu   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:

Description Dima Ryazanov 2010-02-22 22:59:53 UTC
Version:            (using KDE 4.4.0)
OS:                Linux
Installed from:    Ubuntu Packages

(The Crash Reporting Assistant refused to submit a bug report for this. I don't know what you guys think, but if an application crashes, I believe it's a bug. I followed the instructions for installing the debug symbols, so if it's not enough... then please tell me what I need to do.)

I was previewing, opening, and deleting image files in my home directory. After deleting five or so files, Dolphin crashed. Here are the stack traces:

Application: Dolphin (dolphin), signal: Segmentation fault
[Current thread is 1 (Thread 0x7f3d55ed47f0 (LWP 26243))]

Thread 3 (Thread 0x7f3d4496b910 (LWP 26289)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:220
#1  0x00007f3d3ee12c91 in ?? () from /usr/lib/libxine.so.1
#2  0x00007f3d4f0c7a04 in start_thread (arg=<value optimized out>) at pthread_create.c:300
#3  0x00007f3d51b6280d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#4  0x0000000000000000 in ?? ()

Thread 2 (Thread 0x7f3d36ab3910 (LWP 26510)):
[KCrash Handler]
#5  0x0000000000465464 in _start ()
The current source language is "auto; currently asm".

Thread 1 (Thread 0x7f3d55ed47f0 (LWP 26243)):
#0  0x00007f3d51b54abb in read () from /lib/libc.so.6
#1  0x00007f3d4df9ca43 in read (context=0x1cbc480, max_priority=2147483647, fds=0x2497db0, n_fds=14) at /usr/include/bits/unistd.h:45
#2  IA__g_main_context_check (context=0x1cbc480, max_priority=2147483647, fds=0x2497db0, n_fds=14) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2421
#3  0x00007f3d4df9d290 in g_main_context_iterate (context=0x1cbc480, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>)
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2588
#4  0x00007f3d4df9d6c0 in IA__g_main_context_iteration (context=0x1cbc480, may_block=1) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2654
#5  0x00007f3d52299463 in QEventDispatcherGlib::processEvents (this=0x1c84e20, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:412
#6  0x00007f3d52f147ee in QGuiEventDispatcherGlib::processEvents (this=0x3, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:204
#7  0x00007f3d5226e862 in QEventLoop::processEvents (this=<value optimized out>, flags=) at kernel/qeventloop.cpp:149
#8  0x00007f3d5226ec3c in QEventLoop::exec (this=0x7fffc17b6f10, flags=) at kernel/qeventloop.cpp:201
#9  0x00007f3d5227297b in QCoreApplication::exec () at kernel/qcoreapplication.cpp:981
#10 0x000000000043ac95 in _start ()
The current source language is "auto; currently c".
Comment 1 Dima Ryazanov 2010-02-23 00:58:11 UTC
I reproduced it after viewing/deleting five more image files, this time while running it in Valgrind. Here's the output:


QThread: Destroyed while thread is still running
QObject: Cannot create children for a parent that is in a different thread.
(Parent is QDBusConnectionPrivate(0x10d08cb0), parent's thread is QThread(0xfe3e190), current thread is QThread(0x0)
==3543== Thread 3:
==3543== Invalid write of size 4
==3543==    at 0x46540B: ??? (in /usr/bin/dolphin)
==3543==    by 0x861D744: QThreadPrivate::start(void*) (qthread_unix.cpp:248)
==3543==    by 0xB852A03: start_thread (pthread_create.c:300)
==3543==    by 0x8E1680C: clone (clone.S:112)
==3543==  Address 0x17d13640 is 16 bytes inside a block of size 72 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x441E55: ??? (in /usr/bin/dolphin)
==3543==    by 0x44227C: ??? (in /usr/bin/dolphin)
==3543==    by 0x8721C78: QObject::event(QEvent*) (qobject.cpp:1248)
==3543==    by 0x74009AE: QWidget::event(QEvent*) (qwidget.cpp:8435)
==3543==    by 0x442BE7: ??? (in /usr/bin/dolphin)
==3543==    by 0x73AAFAB: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4298)
==3543==    by 0x73B159A: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4181)
==3543==    by 0x6DD6D15: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)
==3543==    by 0x8711F3B: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:704)
==3543==    by 0x87146B6: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.h:215)
==3543==    by 0x873B922: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (qcoreapplication.h:220)
==3543==
==3543== Invalid read of size 8
==3543==    at 0x866282D: QString::operator=(QString const&) (qstring.cpp:1281)
==3543==    by 0x465422: ??? (in /usr/bin/dolphin)
==3543==    by 0x861D744: QThreadPrivate::start(void*) (qthread_unix.cpp:248)
==3543==    by 0xB852A03: start_thread (pthread_create.c:300)
==3543==    by 0x8E1680C: clone (clone.S:112)
==3543==  Address 0x17d13648 is 24 bytes inside a block of size 72 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x441E55: ??? (in /usr/bin/dolphin)
==3543==    by 0x44227C: ??? (in /usr/bin/dolphin)
==3543==    by 0x8721C78: QObject::event(QEvent*) (qobject.cpp:1248)
==3543==    by 0x74009AE: QWidget::event(QEvent*) (qwidget.cpp:8435)
==3543==    by 0x442BE7: ??? (in /usr/bin/dolphin)
==3543==    by 0x73AAFAB: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4298)
==3543==    by 0x73B159A: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4181)
==3543==    by 0x6DD6D15: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)
==3543==    by 0x8711F3B: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:704)
==3543==    by 0x87146B6: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.h:215)
==3543==    by 0x873B922: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (qcoreapplication.h:220)
==3543==
==3543== Invalid write of size 8
==3543==    at 0x866284B: QString::operator=(QString const&) (qstring.cpp:1283)
==3543==    by 0x465422: ??? (in /usr/bin/dolphin)
==3543==    by 0x861D744: QThreadPrivate::start(void*) (qthread_unix.cpp:248)
==3543==    by 0xB852A03: start_thread (pthread_create.c:300)
==3543==    by 0x8E1680C: clone (clone.S:112)
==3543==  Address 0x17d13648 is 24 bytes inside a block of size 72 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x441E55: ??? (in /usr/bin/dolphin)
==3543==    by 0x44227C: ??? (in /usr/bin/dolphin)
==3543==    by 0x8721C78: QObject::event(QEvent*) (qobject.cpp:1248)
==3543==    by 0x74009AE: QWidget::event(QEvent*) (qwidget.cpp:8435)
==3543==    by 0x442BE7: ??? (in /usr/bin/dolphin)
==3543==    by 0x73AAFAB: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4298)
==3543==    by 0x73B159A: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4181)
==3543==    by 0x6DD6D15: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)
==3543==    by 0x8711F3B: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:704)
==3543==    by 0x87146B6: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.h:215)
==3543==    by 0x873B922: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (qcoreapplication.h:220)
==3543==
==3543== Invalid read of size 8
==3543==    at 0x465454: ??? (in /usr/bin/dolphin)
==3543==    by 0x861D744: QThreadPrivate::start(void*) (qthread_unix.cpp:248)
==3543==    by 0xB852A03: start_thread (pthread_create.c:300)
==3543==    by 0x8E1680C: clone (clone.S:112)
==3543==  Address 0x17d13650 is 32 bytes inside a block of size 72 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x441E55: ??? (in /usr/bin/dolphin)
==3543==    by 0x44227C: ??? (in /usr/bin/dolphin)
==3543==    by 0x8721C78: QObject::event(QEvent*) (qobject.cpp:1248)
==3543==    by 0x74009AE: QWidget::event(QEvent*) (qwidget.cpp:8435)
==3543==    by 0x442BE7: ??? (in /usr/bin/dolphin)
==3543==    by 0x73AAFAB: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4298)
==3543==    by 0x73B159A: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4181)
==3543==    by 0x6DD6D15: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)
==3543==    by 0x8711F3B: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:704)
==3543==    by 0x87146B6: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.h:215)
==3543==    by 0x873B922: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (qcoreapplication.h:220)
==3543==
==3543== Invalid read of size 8
==3543==    at 0x465496: ??? (in /usr/bin/dolphin)
==3543==    by 0x861D744: QThreadPrivate::start(void*) (qthread_unix.cpp:248)
==3543==    by 0xB852A03: start_thread (pthread_create.c:300)
==3543==    by 0x8E1680C: clone (clone.S:112)
==3543==  Address 0x17d13668 is 56 bytes inside a block of size 72 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x441E55: ??? (in /usr/bin/dolphin)
==3543==    by 0x44227C: ??? (in /usr/bin/dolphin)
==3543==    by 0x8721C78: QObject::event(QEvent*) (qobject.cpp:1248)
==3543==    by 0x74009AE: QWidget::event(QEvent*) (qwidget.cpp:8435)
==3543==    by 0x442BE7: ??? (in /usr/bin/dolphin)
==3543==    by 0x73AAFAB: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4298)
==3543==    by 0x73B159A: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4181)
==3543==    by 0x6DD6D15: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)
==3543==    by 0x8711F3B: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:704)
==3543==    by 0x87146B6: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.h:215)
==3543==    by 0x873B922: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (qcoreapplication.h:220)
==3543==
==3543== Invalid read of size 8
==3543==    at 0x861D2B6: QThreadPrivate::finish(void*) (qthread.h:130)
==3543==    by 0x861D74C: QThreadPrivate::start(void*) (pthread.h:535)
==3543==    by 0xB852A03: start_thread (pthread_create.c:300)
==3543==    by 0x8E1680C: clone (clone.S:112)
==3543==  Address 0x17d13638 is 8 bytes inside a block of size 72 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x441E55: ??? (in /usr/bin/dolphin)
==3543==    by 0x44227C: ??? (in /usr/bin/dolphin)
==3543==    by 0x8721C78: QObject::event(QEvent*) (qobject.cpp:1248)
==3543==    by 0x74009AE: QWidget::event(QEvent*) (qwidget.cpp:8435)
==3543==    by 0x442BE7: ??? (in /usr/bin/dolphin)
==3543==    by 0x73AAFAB: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4298)
==3543==    by 0x73B159A: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4181)
==3543==    by 0x6DD6D15: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:302)
==3543==    by 0x8711F3B: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:704)
==3543==    by 0x87146B6: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.h:215)
==3543==    by 0x873B922: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (qcoreapplication.h:220)
==3543==
==3543== Invalid read of size 8
==3543==    at 0x86188C9: QMutex::lock() (qmutex.cpp:150)
==3543==    by 0x861D2C8: QThreadPrivate::finish(void*) (qthread_unix.cpp:270)
==3543==    by 0x861D74C: QThreadPrivate::start(void*) (pthread.h:535)
==3543==    by 0xB852A03: start_thread (pthread_create.c:300)
==3543==    by 0x8E1680C: clone (clone.S:112)
==3543==  Address 0x90 is not stack'd, malloc'd or (recently) free'd
==3543==
KCrash: Application 'dolphin' crashing...
sock_file=/home/dima/.kde/socket-dima-ubuntu/kdeinit4__0
QSocketNotifier: Invalid socket 9 and type 'Read', disabling...
==3543== Thread 1:
==3543== Invalid read of size 2
==3543==    at 0x873B8D1: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:92)
==3543==    by 0xC942AA9: g_main_context_check (gmain.c:2469)
==3543==    by 0xC94328F: g_main_context_iterate (gmain.c:2588)
==3543==    by 0xC9436BF: g_main_context_iteration (gmain.c:2654)
==3543==    by 0x873B462: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:412)
==3543==    by 0x745A7ED: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204)
==3543==    by 0x8710861: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149)
==3543==    by 0x8710C3B: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:201)
==3543==    by 0x871497A: QCoreApplication::exec() (qcoreapplication.cpp:981)
==3543==    by 0x43AC94: ??? (in /usr/bin/dolphin)
==3543==    by 0x8D55ABC: (below main) (libc-start.c:220)
==3543==  Address 0x1120d176 is 6 bytes inside a block of size 16 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x873B8D0: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:92)
==3543==    by 0xC942AA9: g_main_context_check (gmain.c:2469)
==3543==    by 0xC94328F: g_main_context_iterate (gmain.c:2588)
==3543==    by 0xC9436BF: g_main_context_iteration (gmain.c:2654)
==3543==    by 0x873B462: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:412)
==3543==    by 0x745A7ED: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204)
==3543==    by 0x8710861: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149)
==3543==    by 0x8710C3B: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:201)
==3543==    by 0x871497A: QCoreApplication::exec() (qcoreapplication.cpp:981)
==3543==    by 0x43AC94: ??? (in /usr/bin/dolphin)
==3543==    by 0x8D55ABC: (below main) (libc-start.c:220)
==3543==
==3543== Invalid read of size 2
==3543==    at 0x873B8D5: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:83)
==3543==    by 0xC942AA9: g_main_context_check (gmain.c:2469)
==3543==    by 0xC94328F: g_main_context_iterate (gmain.c:2588)
==3543==    by 0xC9436BF: g_main_context_iteration (gmain.c:2654)
==3543==    by 0x873B462: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:412)
==3543==    by 0x745A7ED: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204)
==3543==    by 0x8710861: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149)
==3543==    by 0x8710C3B: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:201)
==3543==    by 0x871497A: QCoreApplication::exec() (qcoreapplication.cpp:981)
==3543==    by 0x43AC94: ??? (in /usr/bin/dolphin)
==3543==    by 0x8D55ABC: (below main) (libc-start.c:220)
==3543==  Address 0x1120d174 is 4 bytes inside a block of size 16 free'd
==3543==    at 0x4C24A9E: operator delete(void*) (vg_replace_malloc.c:346)
==3543==    by 0x873B8D0: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:92)
==3543==    by 0xC942AA9: g_main_context_check (gmain.c:2469)
==3543==    by 0xC94328F: g_main_context_iterate (gmain.c:2588)
==3543==    by 0xC9436BF: g_main_context_iteration (gmain.c:2654)
==3543==    by 0x873B462: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:412)
==3543==    by 0x745A7ED: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204)
==3543==    by 0x8710861: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149)
==3543==    by 0x8710C3B: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:201)
==3543==    by 0x871497A: QCoreApplication::exec() (qcoreapplication.cpp:981)
==3543==    by 0x43AC94: ??? (in /usr/bin/dolphin)
==3543==    by 0x8D55ABC: (below main) (libc-start.c:220)
==3543==
QSocketNotifier: Invalid socket 10 and type 'Read', disabling...
QSocketNotifier: Invalid socket 13 and type 'Read', disabling...
QSocketNotifier: Invalid socket 18 and type 'Read', disabling...
QSocketNotifier: Invalid socket 15 and type 'Read', disabling...
QSocketNotifier: Invalid socket 17 and type 'Read', disabling...
dolphin(3544)/kio (Slave) KIO::Slave::gotInput: slave died pid =  3556
Comment 2 Dario Andres 2010-03-12 20:41:39 UTC
Fixed for KDE SC 4.4.2 / 4.5 +  (bug 222324, bug 224848)
Regards

*** This bug has been marked as a duplicate of bug 222324 ***