Bug 263306

Summary:	[BoxSwitch] Crash when last window is closed
Product:	[Plasma] kwin	Reporter:	Martin Flöser <mgraesslin>
Component:	general	Assignee:	KWin default assignee <kwin-bugs-null>
Status:	RESOLVED FIXED
Severity:	crash
Priority:	NOR
Version:	unspecified
Target Milestone:	---
Platform:	Compiled Sources
OS:	Linux
Latest Commit:		Version Fixed In:	4.7.0
Sentry Crash Report:

Description Martin Flöser 2011-01-16 11:51:25 UTC

Application: kwin (4.6.41 (4.7 >= 20110106))
KDE Platform Version: 4.6.41 (4.7 >= 20110106) (Compiled from sources)
Qt Version: 4.7.0
Operating System: Linux 2.6.35-trunk-amd64 x86_64
Distribution: Debian GNU/Linux 6.0 (n/a)

-- Information about the crash:
- What I was doing when the application crashed:
1. Go to a desktop without any windows
2. Open Kopete contact list with setting to autohide contact list
3. Activate the desktop to make Kopete inactive
4. Start alt+tab with boxswitch and window animation - only one entry for Kopete should be shown
5. Wait till Kopete contact lists get's hidden
6. CRASH

- Custom settings of the application:
Boxswitch with animate thumbnails, kwin-gles branch running (though desktop gl 1.x).

-- Backtrace:
Application: KWin (kwin), signal: Aborted
[Current thread is 1 (Thread 0x7ffc9e485780 (LWP 21048))]

Thread 2 (Thread 0x7ffc86991710 (LWP 21052)):
#0  0x00007ffc9b46916c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#1  0x00007ffc9dabe954 in ?? () from /usr/lib/libQtScript.so.4
#2  0x00007ffc9dabe989 in ?? () from /usr/lib/libQtScript.so.4
#3  0x00007ffc9b4648ba in start_thread () from /lib/libpthread.so.0
#4  0x00007ffc97b1e02d in clone () from /lib/libc.so.6
#5  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7ffc9e485780 (LWP 21048)):
[KCrash Handler]
#6  0x00007ffc97a81165 in raise () from /lib/libc.so.6
#7  0x00007ffc97a83f70 in abort () from /lib/libc.so.6
#8  0x00007ffc9b6fcf8f in qt_message_output(QtMsgType, char const*) () from /usr/lib/libQtCore.so.4
#9  0x00007ffc9b6fd132 in ?? () from /usr/lib/libQtCore.so.4
#10 0x00007ffc9b6fd2e5 in qFatal(char const*, ...) () from /usr/lib/libQtCore.so.4
#11 0x00007ffc86a95b3c in QList<KWin::EffectWindow*>::last (this=0x7fffbf576c30) at /usr/include/qt4/QtCore/qlist.h:271
#12 0x00007ffc86a90c04 in KWin::BoxSwitchEffect::calculateItemSizes (this=0x1948250) at /opt/kde/src/KDE/kdebase/workspace/kwin/effects/boxswitch/boxswitch.cpp:718
#13 0x00007ffc86a8f23b in KWin::BoxSwitchEffect::tabBoxUpdated (this=0x1948250) at /opt/kde/src/KDE/kdebase/workspace/kwin/effects/boxswitch/boxswitch.cpp:449
#14 0x00007ffc9e136cba in KWin::EffectsHandlerImpl::tabBoxUpdated (this=0x185d8f0) at /opt/kde/src/KDE/kdebase/workspace/kwin/effects.cpp:398
#15 0x00007ffc9e097177 in KWin::TabBox::TabBox::setCurrentIndex (this=0x1904f60, index=..., notifyEffects=true) at /opt/kde/src/KDE/kdebase/workspace/kwin/tabbox.cpp:470
#16 0x00007ffc9e096d48 in KWin::TabBox::TabBox::reset (this=0x1904f60, partial_reset=true) at /opt/kde/src/KDE/kdebase/workspace/kwin/tabbox.cpp:360
#17 0x00007ffc9e05d38a in KWin::Workspace::removeClient (this=0x181b250, c=0x1ee5ae0) at /opt/kde/src/KDE/kdebase/workspace/kwin/workspace.cpp:724
#18 0x00007ffc9e075245 in KWin::Client::releaseWindow (this=0x1ee5ae0, on_shutdown=false) at /opt/kde/src/KDE/kdebase/workspace/kwin/client.cpp:265
#19 0x00007ffc9e0b9f79 in KWin::Client::unmapNotifyEvent (this=0x1ee5ae0, e=0x7fffbf5779c0) at /opt/kde/src/KDE/kdebase/workspace/kwin/events.cpp:809
#20 0x00007ffc9e0b992a in KWin::Client::windowEvent (this=0x1ee5ae0, e=0x7fffbf5779c0) at /opt/kde/src/KDE/kdebase/workspace/kwin/events.cpp:655
#21 0x00007ffc9e0b87fb in KWin::Workspace::workspaceEvent (this=0x181b250, e=0x7fffbf5779c0) at /opt/kde/src/KDE/kdebase/workspace/kwin/events.cpp:304
#22 0x00007ffc9e093106 in KWin::Application::x11EventFilter (this=0x7fffbf577c10, e=0x7fffbf5779c0) at /opt/kde/src/KDE/kdebase/workspace/kwin/main.cpp:367
#23 0x00007ffc9a9b6da1 in ?? () from /usr/lib/libQtGui.so.4
#24 0x00007ffc9a9c6951 in QApplication::x11ProcessEvent(_XEvent*) () from /usr/lib/libQtGui.so.4
#25 0x00007ffc9a9f3967 in ?? () from /usr/lib/libQtGui.so.4
#26 0x00007ffc9b7f6732 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#27 0x00007ffc9b7f6b1c in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#28 0x00007ffc9b7fabbb in QCoreApplication::exec() () from /usr/lib/libQtCore.so.4
#29 0x00007ffc9e09426c in kdemain (argc=2, argv=0x7fffbf578248) at /opt/kde/src/KDE/kdebase/workspace/kwin/main.cpp:542
#30 0x0000000000400946 in main (argc=2, argv=0x7fffbf578248) at /opt/kde/build/KDE/kdebase/workspace/kwin/kwin_dummy.cpp:3

Possible duplicates by query: bug 207512, bug 201729, bug 201366, bug 195821, bug 195295.

Reported using DrKonqi

Comment 1 Thomas Lübking 2011-01-16 15:58:53 UTC

probably a dupe of all mentioned.

seems the QHash< EffectWindow*, ItemInfo* >::operator[] gets in trouble.
the qFatal is a QList::isEmpty() assertion and the list is part of the hash, during ::contains() for the ::operator[]

could be an upstream issue or corrupted memory (but it happens a bit too predictable for this) - avoiding the (completely poitless) operator[] should however circumvent it.

(it does btw. not look like possibly present(?) Info values would be replaced or at least deleted -> hello leak?)

Comment 2 Martin Flöser 2011-05-07 11:14:20 UTC

Git commit 52147c672de192d7a02183f2ab38ef2d1de2af9b by Martin Gräßlin.
Committed on 07/05/2011 at 11:23.
Pushed by graesslin into branch 'master'.

Ensure that list is not empty before accessing

With settings to animate windows in boxswitch it was
possible that an empty list was accessed when the last
window closed.
BUG: 263306
FIXED-IN: 4.7.0

M  +4    -0    kwin/effects/boxswitch/boxswitch.cpp     

http://commits.kde.org/kde-workspace/52147c672de192d7a02183f2ab38ef2d1de2af9b