Bug 265449

Summary: Crash in TOC
Product: [Applications] calligrawords Reporter: Sebastian Sauer <mail>
Component: opendocumentAssignee: T Zachmann <t.zachmann>
Status: RESOLVED FIXED    
Severity: normal    
Priority: NOR    
Version: unspecified   
Target Milestone: ---   
Platform: Unlisted Binaries   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:

Description Sebastian Sauer 2011-02-04 20:18:02 UTC
Version:           unspecified
OS:                Linux

Application: Words (words), signal: Aborted
[KCrash Handler]
#6  0x00007fe0137089e5 in raise () from /lib64/libc.so.6
#7  0x00007fe013709ee6 in abort () from /lib64/libc.so.6
#8  0x00007fe01477e864 in qt_message_output (msgType=<value optimized out>, buf=<value optimized out>) at global/qglobal.cpp:2282
#9  0x00007fe01477ea2d in qt_message(QtMsgType, const char *, typedef __va_list_tag __va_list_tag *) (msgType=QtFatalMsg, msg=0x7fe0148d1c08 "ASSERT: \"%s\" in file %s, line %d", ap=0x7ffff00c6d80)
    at global/qglobal.cpp:2328
#10 0x00007fe01477ebc5 in qFatal (msg=<value optimized out>) at global/qglobal.cpp:2511
#11 0x00007fe01477ec0a in qt_assert (assertion=0x74a5 <Address 0x74a5 out of bounds>, file=0x6 <Address 0x6 out of bounds>, line=-1) at global/qglobal.cpp:2027
#12 0x00007fe018d17ca4 in KoTosContainerModel::remove (this=0x4176990, shape=0x417d1e0) at /home/kdab/src/kde/calligra/libs/flake/KoTosContainerModel.cpp:48
#13 0x00007fe018ca453b in KoShapeContainer::removeShape (this=0x4178030, shape=0x417d1e0) at /home/kdab/src/kde/calligra/libs/flake/KoShapeContainer.cpp:90
#14 0x00007fe018c9402d in KoShape::setParent (this=0x417d1e0, parent=0x0) at /home/kdab/src/kde/calligra/libs/flake/KoShape.cpp:567
#15 0x00007fe018ca454c in KoShapeContainer::removeShape (this=0x4178030, shape=0x417d1e0) at /home/kdab/src/kde/calligra/libs/flake/KoShapeContainer.cpp:91
#16 0x00007fe018c91915 in KoShapePrivate::~KoShapePrivate (this=0x417d520, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoShape.cpp:118
#17 0x00007fe018ca4031 in KoShapeContainerPrivate::~KoShapeContainerPrivate (this=0x417d520, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoShapeContainer.cpp:37
#18 0x00007fe018ca4064 in KoShapeContainerPrivate::~KoShapeContainerPrivate (this=0x417d520, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoShapeContainer.cpp:40
#19 0x00007fe018c92ad9 in KoShape::~KoShape (this=0x417d1e0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoShape.cpp:312
#20 0x00007fe018ca42bf in KoShapeContainer::~KoShapeContainer (this=0x417d1e0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoShapeContainer.cpp:59
#21 0x00007fdfff5df3b1 in TextShape::~TextShape (this=0x417d1e0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/plugins/textshape/TextShape.cpp:107
#22 0x00007fdfff5df3ec in TextShape::~TextShape (this=0x417d1e0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/plugins/textshape/TextShape.cpp:110
#23 0x00007fe018d1683a in KoTosContainer::~KoTosContainer (this=0x4178030, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoTosContainer.cpp:51
#24 0x00007fe018c75ad8 in KoPathShape::~KoPathShape (this=0x4178030, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoPathShape.cpp:104
#25 0x00007fe018ccc41c in KoParameterShape::~KoParameterShape (this=0x4178030, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoParameterShape.cpp:37
#26 0x00007fdffe236f2a in EllipseShape::~EllipseShape (this=0x4178030, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/plugins/pathshapes/ellipse/EllipseShape.cpp:50
#27 0x00007fdffe236f5c in EllipseShape::~EllipseShape (this=0x4178030, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/plugins/pathshapes/ellipse/EllipseShape.cpp:52
#28 0x00007fe0049ac917 in KWFrameSet::~KWFrameSet (this=0x41780d0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/frames/KWFrameSet.cpp:36
#29 0x00007fe0049ac9f0 in KWFrameSet::~KWFrameSet (this=0x41780d0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/frames/KWFrameSet.cpp:37
#30 0x00007fe004966530 in qDeleteAll<QList<KWFrameSet*>::const_iterator> (begin=..., end=...) at /usr/include/QtCore/qalgorithms.h:322
#31 0x00007fe0049648db in qDeleteAll<QList<KWFrameSet*> > (c=...) at /usr/include/QtCore/qalgorithms.h:330
#32 0x00007fe00495cda2 in KWDocument::~KWDocument (this=0x89aa90, __in_chrg=<value optimized out>, __vtt_parm=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/KWDocument.cpp:184
#33 0x00007fe00495ce96 in KWDocument::~KWDocument (this=0x89aa90, __in_chrg=<value optimized out>, __vtt_parm=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/KWDocument.cpp:185
#34 0x00007fe01962ba19 in KoMainWindow::setRootDocument (this=0x824260, doc=0x0) at /home/kdab/src/kde/calligra/libs/main/KoMainWindow.cpp:497
#35 0x00007fe01962f6ab in KoMainWindow::closeEvent (this=0x824260, e=0x7ffff00c7cc0) at /home/kdab/src/kde/calligra/libs/main/KoMainWindow.cpp:1058
#36 0x00007fe01574785e in QWidget::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#37 0x00007fe015b0ddcb in QMainWindow::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#38 0x00007fe01640d463 in KXmlGuiWindow::event(QEvent*) () from /usr/lib64/libkdeui.so.5
#39 0x00007fe0156f5cd4 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#40 0x00007fe0156fe1ca in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#41 0x00007fe016361ec6 in KApplication::notify(QObject*, QEvent*) () from /usr/lib64/libkdeui.so.5
#42 0x00007fe014871e2c in QCoreApplication::notifyInternal (this=0x7ffff00c8720, receiver=0x824260, event=0x7ffff00c7cc0) at kernel/qcoreapplication.cpp:732
#43 0x00007fe015742231 in QWidgetPrivate::close_helper(QWidgetPrivate::CloseMode) () from /usr/lib64/libQtGui.so.4
#44 0x00007fe0157755e6 in QApplication::x11ClientMessage(QWidget*, _XEvent*, bool) () from /usr/lib64/libQtGui.so.4
#45 0x00007fe015773a6b in QApplication::x11ProcessEvent(_XEvent*) () from /usr/lib64/libQtGui.so.4
#46 0x00007fe01579b212 in ?? () from /usr/lib64/libQtGui.so.4
#47 0x00007fe00f03ea93 in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#48 0x00007fe00f03f270 in ?? () from /usr/lib64/libglib-2.0.so.0
#49 0x00007fe00f03f510 in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
#50 0x00007fe01489ca8f in QEventDispatcherGlib::processEvents (this=0x649780, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:422
#51 0x00007fe01579aeae in ?? () from /usr/lib64/libQtGui.so.4
#52 0x00007fe014871262 in QEventLoop::processEvents (this=<value optimized out>, flags=...) at kernel/qeventloop.cpp:149
#53 0x00007fe014871475 in QEventLoop::exec (this=0x7ffff00c86c0, flags=...) at kernel/qeventloop.cpp:201
#54 0x00007fe0148758db in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1009
#55 0x00007fe01992c875 in kdemain (argc=2, argv=0x7ffff00c88e8) at /home/kdab/src/kde/calligra/words/part/main.cpp:38
#56 0x0000000000400966 in main (argc=2, argv=0x7ffff00c88e8) at /home/kdab/src/build/calligra/words/part/words_dummy.cpp:3


Reproducible: Didn't try
Comment 1 Sebastian Sauer 2011-02-04 20:27:21 UTC
That happens btw if I load the ODF 1.1 specs and close words (so crash on exit).

...ond if I do

diff --git a/libs/flake/KoTosContainerModel.cpp b/libs/flake/KoTosContainerModel.cpp
index 831228a..bd52c8c 100644
--- a/libs/flake/KoTosContainerModel.cpp
+++ b/libs/flake/KoTosContainerModel.cpp
@@ -45,7 +45,7 @@ void KoTosContainerModel::add(KoShape *shape)
 
 void KoTosContainerModel::remove(KoShape *shape)
 {
-    Q_ASSERT(shape == m_textShape);
+    //Q_ASSERT(shape == m_textShape);
     if (shape == m_textShape) {
         m_textShape = 0;
     }

I earn

Application: Words (words), signal: Segmentation fault
[Current thread is 1 (Thread 0x7f4eb68ab7a0 (LWP 32239))]

Thread 2 (Thread 0x7f4e9557d710 (LWP 32240)):
#0  0x00007f4eb034ae13 in select () from /lib64/libc.so.6
#1  0x00007f4eb13fd27d in QProcessManager::run (this=0x7f4eb174ff80) at io/qprocess_unix.cpp:245
#2  0x00007f4eb1331a1e in QThreadPrivate::start (arg=0x7f4eb174ff80) at thread/qthread_unix.cpp:285
#3  0x00007f4eaf6749a3 in ?? () from /usr/lib64/libGL.so.1
#4  0x00007f4eb10a2a4f in start_thread () from /lib64/libpthread.so.0
#5  0x00007f4eb035182d in clone () from /lib64/libc.so.6
#6  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7f4eb68ab7a0 (LWP 32239)):
[KCrash Handler]
#6  0x00007f4eb5848a0e in KoShape::d_func (this=0x0) at /home/kdab/src/kde/calligra/libs/flake/KoShape.h:1077
#7  0x00007f4eb583efdc in KoShape::setParent (this=0x0, parent=0x0) at /home/kdab/src/kde/calligra/libs/flake/KoShape.cpp:561
#8  0x00007f4eb584f239 in KoShapeContainer::~KoShapeContainer (this=0x4083cb0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoShapeContainer.cpp:64
#9  0x00007f4eb58c1846 in KoTosContainer::~KoTosContainer (this=0x4083cb0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoTosContainer.cpp:49
#10 0x00007f4eb5820ad8 in KoPathShape::~KoPathShape (this=0x4083cb0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoPathShape.cpp:104
#11 0x00007f4eb587741c in KoParameterShape::~KoParameterShape (this=0x4083cb0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/libs/flake/KoParameterShape.cpp:37
#12 0x00007f4e9ade1f2a in EllipseShape::~EllipseShape (this=0x4083cb0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/plugins/pathshapes/ellipse/EllipseShape.cpp:50
#13 0x00007f4e9ade1f5c in EllipseShape::~EllipseShape (this=0x4083cb0, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/plugins/pathshapes/ellipse/EllipseShape.cpp:52
#14 0x00007f4ea1557917 in KWFrameSet::~KWFrameSet (this=0x4083d50, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/frames/KWFrameSet.cpp:36
#15 0x00007f4ea15579f0 in KWFrameSet::~KWFrameSet (this=0x4083d50, __in_chrg=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/frames/KWFrameSet.cpp:37
#16 0x00007f4ea1511530 in qDeleteAll<QList<KWFrameSet*>::const_iterator> (begin=..., end=...) at /usr/include/QtCore/qalgorithms.h:322
#17 0x00007f4ea150f8db in qDeleteAll<QList<KWFrameSet*> > (c=...) at /usr/include/QtCore/qalgorithms.h:330
#18 0x00007f4ea1507da2 in KWDocument::~KWDocument (this=0x89a1c0, __in_chrg=<value optimized out>, __vtt_parm=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/KWDocument.cpp:184
#19 0x00007f4ea1507e96 in KWDocument::~KWDocument (this=0x89a1c0, __in_chrg=<value optimized out>, __vtt_parm=<value optimized out>) at /home/kdab/src/kde/calligra/words/part/KWDocument.cpp:185
#20 0x00007f4eb61d6a19 in KoMainWindow::setRootDocument (this=0x78dcf0, doc=0x0) at /home/kdab/src/kde/calligra/libs/main/KoMainWindow.cpp:497
#21 0x00007f4eb61da6ab in KoMainWindow::closeEvent (this=0x78dcf0, e=0x7fffa15f55d0) at /home/kdab/src/kde/calligra/libs/main/KoMainWindow.cpp:1058
#22 0x00007f4eb22f285e in QWidget::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#23 0x00007f4eb26b8dcb in QMainWindow::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#24 0x00007f4eb2fb8463 in KXmlGuiWindow::event(QEvent*) () from /usr/lib64/libkdeui.so.5
#25 0x00007f4eb22a0cd4 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#26 0x00007f4eb22a91ca in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#27 0x00007f4eb2f0cec6 in KApplication::notify(QObject*, QEvent*) () from /usr/lib64/libkdeui.so.5
#28 0x00007f4eb141ce2c in QCoreApplication::notifyInternal (this=0x7fffa15f6030, receiver=0x78dcf0, event=0x7fffa15f55d0) at kernel/qcoreapplication.cpp:732
#29 0x00007f4eb22ed231 in QWidgetPrivate::close_helper(QWidgetPrivate::CloseMode) () from /usr/lib64/libQtGui.so.4
#30 0x00007f4eb23205e6 in QApplication::x11ClientMessage(QWidget*, _XEvent*, bool) () from /usr/lib64/libQtGui.so.4
#31 0x00007f4eb231ea6b in QApplication::x11ProcessEvent(_XEvent*) () from /usr/lib64/libQtGui.so.4
#32 0x00007f4eb2346212 in ?? () from /usr/lib64/libQtGui.so.4
#33 0x00007f4eabbe9a93 in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#34 0x00007f4eabbea270 in ?? () from /usr/lib64/libglib-2.0.so.0
#35 0x00007f4eabbea510 in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
#36 0x00007f4eb1447a8f in QEventDispatcherGlib::processEvents (this=0x649780, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:422
#37 0x00007f4eb2345eae in ?? () from /usr/lib64/libQtGui.so.4
#38 0x00007f4eb141c262 in QEventLoop::processEvents (this=<value optimized out>, flags=...) at kernel/qeventloop.cpp:149
#39 0x00007f4eb141c475 in QEventLoop::exec (this=0x7fffa15f5fd0, flags=...) at kernel/qeventloop.cpp:201
#40 0x00007f4eb14208db in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1009
#41 0x00007f4eb64d7875 in kdemain (argc=2, argv=0x7fffa15f61f8) at /home/kdab/src/kde/calligra/words/part/main.cpp:38
#42 0x0000000000400966 in main (argc=2, argv=0x7fffa15f61f8) at /home/kdab/src/build/calligra/words/part/words_dummy.cpp:3
Comment 2 Sebastian Sauer 2011-02-04 20:29:11 UTC
assigned to Zagge cause 

diff --git a/libs/flake/KoTosContainerModel.cpp b/libs/flake/KoTosContainerModel.cpp
index 831228a..bd52c8c 100644
--- a/libs/flake/KoTosContainerModel.cpp
+++ b/libs/flake/KoTosContainerModel.cpp
@@ -45,7 +45,7 @@ void KoTosContainerModel::add(KoShape *shape)
 
 void KoTosContainerModel::remove(KoShape *shape)
 {
-    Q_ASSERT(shape == m_textShape);
+    //Q_ASSERT(shape == m_textShape);
     if (shape == m_textShape) {
         m_textShape = 0;
     }

fixes it and git blame libs/flake/KoTosContainer.cpp says it's Zagge's code :)
Comment 3 T Zachmann 2011-02-05 05:23:52 UTC
Git commit 7bcabb955b4726248483aa96a7aa32a428f3dfb2 by Thorsten Zachmann.
Committed on 05/02/11 at 05:17.
Pushed by zachmann into branch 'master'.

Fix Bug 265449 Crash in TOS

Thanks to Sebastian for pointing out the problem. I even found an additional problem
when debugging it.

The remove function is called twice which results in the text shape to be already 0.

BUG: 265449

M  +4    -2    libs/flake/KoTosContainerModel.cpp     

http://commits.kde.org/calligra/7bcabb955b4726248483aa96a7aa32a428f3dfb2