| Summary: | photolayoutseditor crashes on exit | ||
|---|---|---|---|
| Product: | [Applications] digikam | Reporter: | nucleo <nucleo> |
| Component: | Plugin-Generic-PhotoLayoutEditor | Assignee: | Digikam Developers <digikam-bugs-null> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | caulier.gilles, kevin.kofler, lukasz.spas |
| Priority: | HI | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Platform: | Fedora RPMs | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | 2.3.0 | |
| Sentry Crash Report: | |||
| Attachments: | output of "valgrind photolayoutseditor" | ||
|
Description
nucleo
2011-10-04 14:43:42 UTC
Created attachment 64216 [details]
output of "valgrind photolayoutseditor"
So the source of the crash appears to be this use-after-free bug: ==1363== Invalid read of size 4 ==1363== at 0x809C41F: KIPIPhotoLayoutsEditor::AbstractPhoto::refresh() (AbstractPhoto.cpp:515) ==1363== by 0x80BB797: KIPIPhotoLayoutsEditor::PhotoEffectsGroup::emitEffectsChanged(KIPIPhotoLayoutsEditor::AbstractPhotoEffectInterface*) (PhotoEffectsGroup.cpp:369) ==1363== by 0x80BC145: KIPIPhotoLayoutsEditor::PhotoEffectsGroup::removeRows(int, int, QModelIndex const&) (PhotoEffectsGroup.cpp:360) ==1363== by 0x80E9933: KIPIPhotoLayoutsEditor::AbstractItemsListViewTool::chooserCancelled() (qabstractitemmodel.h:319) ==1363== by 0xFFFFFFFE: ??? ==1363== Address 0x7ba34a0 is 16 bytes inside a block of size 48 free'd ==1363== at 0x4029B7D: operator delete(void*) (vg_replace_malloc.c:387) ==1363== by 0x80A193A: KIPIPhotoLayoutsEditor::PhotoItem::~PhotoItem() (PhotoItem.cpp:198) ==1363== by 0x535C8E4: QGraphicsScene::clear() (in /usr/lib/libQtGui.so.4.8.0) ==1363== by 0x535C95F: QGraphicsScene::~QGraphicsScene() (in /usr/lib/libQtGui.so.4.8.0) ==1363== by 0x8082C63: KIPIPhotoLayoutsEditor::Scene::~Scene() (Scene.cpp:528) ==1363== by 0x8082CB2: KIPIPhotoLayoutsEditor::Scene::~Scene() (Scene.cpp:531) ==1363== by 0x5B01E51: QObjectPrivate::deleteChildren() (in /usr/lib/libQtCore.so.4.8.0) ==1363== by 0x4D0E32B: QWidget::~QWidget() (in /usr/lib/libQtGui.so.4.8.0) ==1363== by 0x512C14F: QFrame::~QFrame() (in /usr/lib/libQtGui.so.4.8.0) ==1363== by 0x51BFF34: QAbstractScrollArea::~QAbstractScrollArea() (in /usr/lib/libQtGui.so.4.8.0) ==1363== by 0x5392FF5: QGraphicsView::~QGraphicsView() (in /usr/lib/libQtGui.so.4.8.0) ==1363== by 0x8075DE5: KIPIPhotoLayoutsEditor::Canvas::~Canvas() (Canvas.cpp:78) Valgrind continues execution from there because it keeps freed blocks reserved so it can track use-after-free bugs, and thus the access doesn't cause a segfault right away, and the code hits a NULL pointer dereference later. But outside of Valgrind, the above is the fatal bug. Git commit c7518fe3a8fc6f005125a8c496a9334e5f08a02d by Łukasz Spas. Committed on 16/10/2011 at 15:32. Pushed by lukaszspas into branch 'master'. BUG: 283321 M +1 -1 CMakeLists.txt http://commits.kde.org/kipi-plugins/c7518fe3a8fc6f005125a8c496a9334e5f08a02d (In reply to comment #3) > Git commit c7518fe3a8fc6f005125a8c496a9334e5f08a02d by Łukasz Spas. > Committed on 16/10/2011 at 15:32. > Pushed by lukaszspas into branch 'master'. > > BUG: 283321 > > M +1 -1 CMakeLists.txt > > http://commits.kde.org/kipi-plugins/c7518fe3a8fc6f005125a8c496a9334e5f08a02d So where is actual fix of this bug at link above or this one: http://quickgit.kde.org/?p=kipi-plugins.git&a=commit&h=2b5ed81d9d378f439f51f4319d62ef69fd8c40e7 definitely this is the fix: http://quickgit.kde.org/?p=kipi-plugins.git&a=commit&h=2b5ed81d9d378f439f51f4319d62ef69fd8c40e7 The second one was my mistake which turns off some parts of kipiplugins (for compilation & testing speed): http://commits.kde.org/kipi-plugins/c7518fe3a8fc6f005125a8c496a9334e5f08a02d Sorry for this misunderstanding. |