| Summary: | Dolphin crash on tag or comment edit [ QApplication::x11ProcessEvent ] | ||
|---|---|---|---|
| Product: | [Unmaintained] nepomuk | Reporter: | nightwing666 |
| Component: | widgets - TagWidget | Assignee: | Nepomuk Bugs Coordination <nepomuk-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | frank78ac, kyledevans |
| Priority: | NOR | ||
| Version: | git master | ||
| Target Milestone: | --- | ||
| Platform: | Ubuntu | ||
| OS: | Linux | ||
| Latest Commit: | http://commits.kde.org/nepomuk-widgets/7aea36dd860938db4a928a81503f33017a3ad272 | Version Fixed In: | 4.11.2 |
| Sentry Crash Report: | |||
|
Description
nightwing666
2011-12-09 20:20:30 UTC
I'll confirm that dolphin crashes when trying to tag. I believe I've found out how to reproduce it: 1) Select large (or a lot) of files. 2) Try to tag (or rate, or comment) before the information pane has a chance to update the number of items selected or the size. Currently tagging crashes dolphin. Ratings will go away once the information pane has updated. Adding a comment will simply make the edit comment dialog vanish(no crash). This happens to me on Fedora 17 (KDE 4.8.4) and whatever version of openSuse comes with the KDE Plasma Daily virtual machine image (http://susestudio.com/a/tAWYe6/kde-plasma-daily) from June 20th 2012. Resetting assignee to default as per bug #305719 Can you still reproduce this crash in more recent versions? I just tried it again on my Fedora 18 system and it still crashes. Though my system is still on KDE SC 4.9.5. I'll update to 4.10 tonight but it'll take a while to download all of the updates. I looked into the code a while ago to find the problem and I'm about 90% certain I've found the cause. Unfortunately I don't have the source code downloaded anymore to point out the exact files in questions. However the problem is in KDE libs in the information widget. Each time a user selects files / folders there is a delay while the system fetches the information from disc for the selection. If you click on one of those links (outlined in my previous comment) during this scanning period then the system will still be holding a list pointers for the objects from your previous selection. However those objects are deleted as soon as the system finishes scanning the new selection. At this point there are dangling pointers to the elements that were previously selected. A little more on reproducing this: 1) Create a bunch of large files (large enough that will slow down the information widget when it scans your current selection). I had 20 GiB of garbage files, but it seems recent performance improvements might make this harder to reproduce. 2) Don't select anything in the folder. 3) Hover your mouse over the "Add Tags..." link in the information panel. 4) Press CTRL + A 5) Immediately click on "Add Tags..." 6) Crash. I hope my explanation on what i believe is going on made sense. But again I'm fairly certain this is an issue of deleting pointers that are still in use. I could not reproduce a crash using the steps from comment #4 on today's master. Can you confirm it is fixed in KDE 4.10.x? This still happens on 4.10.4. The key is to click on "Add Tags..." after selecting items but before the information panel is updated. Thanks for the update. I can reproduce in current master. The Valgrind log looks like it might be a Nepumuk issue. ==20490== Invalid read of size 8 ==20490== at 0x86C02A4: QWidget::internalWinId() const (qwidget.h:241) ==20490== by 0x875A43E: QApplication::x11ProcessEvent(_XEvent*) (qapplication_x11.cpp:3614) ==20490== by 0x879473F: x11EventSourceDispatch(_GSource*, int (*)(void*), void*) (qguieventdispatcher_glib.cpp:146) ==20490== by 0xF5CC7D4: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xF5CCB07: ??? (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xF5CCBC3: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xA39DDC2: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:424) ==20490== by 0x8794ADF: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204) ==20490== by 0xA35F06B: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149) ==20490== by 0xA35F1F5: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:204) ==20490== by 0xA3621B1: QCoreApplication::exec() (qcoreapplication.cpp:1187) ==20490== by 0x86BA73D: QApplication::exec() (qapplication.cpp:3812) ==20490== Address 0x1fc01a30 is 32 bytes inside a block of size 48 free'd ==20490== at 0x4C2AA9C: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==20490== by 0x637FEDF: Nepomuk2::TagWidget::~TagWidget() (tagwidget.cpp:288) ==20490== by 0x6387C02: Nepomuk2::FileMetaDataWidget::Private::deleteRows() (filemetadatawidget.cpp:122) ==20490== by 0x6387CAF: Nepomuk2::FileMetaDataWidget::Private::slotLoadingFinished() (filemetadatawidget.cpp:130) ==20490== by 0x6389093: Nepomuk2::FileMetaDataWidget::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (filemetadatawidget.moc:66) ==20490== by 0xA37FEF9: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3547) ==20490== by 0x638E28A: Nepomuk2::FileMetaDataProvider::loadingFinished() (filemetadataprovider_p.moc:109) ==20490== by 0x638C656: Nepomuk2::FileMetaDataProvider::Private::insertBasicData() (filemetadataprovider.cpp:300) ==20490== by 0x638E163: Nepomuk2::FileMetaDataProvider::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (filemetadataprovider_p.moc:61) ==20490== by 0xA379876: QMetaCallEvent::placeMetaCall(QObject*) (qobject.cpp:525) ==20490== by 0xA37AAFC: QObject::event(QEvent*) (qobject.cpp:1195) ==20490== by 0x86BD517: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4551) ==20490== ==20490== Invalid read of size 8 ==20490== at 0x86C02A8: QWidget::internalWinId() const (qwidget.h:241) ==20490== by 0x875A43E: QApplication::x11ProcessEvent(_XEvent*) (qapplication_x11.cpp:3614) ==20490== by 0x879473F: x11EventSourceDispatch(_GSource*, int (*)(void*), void*) (qguieventdispatcher_glib.cpp:146) ==20490== by 0xF5CC7D4: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xF5CCB07: ??? (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xF5CCBC3: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xA39DDC2: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:424) ==20490== by 0x8794ADF: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204) ==20490== by 0xA35F06B: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:149) ==20490== by 0xA35F1F5: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:204) ==20490== by 0xA3621B1: QCoreApplication::exec() (qcoreapplication.cpp:1187) ==20490== by 0x86BA73D: QApplication::exec() (qapplication.cpp:3812) ==20490== Address 0x1fc01bc8 is 328 bytes inside a block of size 496 free'd ==20490== at 0x4C2AA9C: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==20490== by 0x870DB11: QWidgetPrivate::~QWidgetPrivate() (qwidget.cpp:362) ==20490== by 0xA322817: QScopedPointerDeleter<QObjectData>::cleanup(QObjectData*) (qscopedpointer.h:62) ==20490== by 0xA382944: QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::~QScopedPointer() (qscopedpointer.h:100) ==20490== by 0xA37A54B: QObject::~QObject() (qobject.cpp:817) ==20490== by 0x87100D7: QWidget::~QWidget() (qwidget.cpp:1552) ==20490== by 0x637FE98: Nepomuk2::TagWidget::~TagWidget() (tagwidget.cpp:285) ==20490== by 0x637FED3: Nepomuk2::TagWidget::~TagWidget() (tagwidget.cpp:288) ==20490== by 0x6387C02: Nepomuk2::FileMetaDataWidget::Private::deleteRows() (filemetadatawidget.cpp:122) ==20490== by 0x6387CAF: Nepomuk2::FileMetaDataWidget::Private::slotLoadingFinished() (filemetadatawidget.cpp:130) ==20490== by 0x6389093: Nepomuk2::FileMetaDataWidget::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (filemetadatawidget.moc:66) ==20490== by 0xA37FEF9: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3547) ==20490== ==20490== Invalid read of size 8 ==20490== at 0x86AE3DE: QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::operator->() const (qscopedpointer.h:112) ==20490== by 0x86AE1AB: QObject::parent() const (qobject.h:273) ==20490== by 0x86C0445: QWidget::parentWidget() const (qwidget.h:1033) ==20490== by 0x8716A89: QWidget::window() const (qwidget.cpp:4343) ==20490== by 0x86B83EA: QApplicationPrivate::dispatchEnterLeave(QWidget*, QWidget*) (qapplication.cpp:2745) ==20490== by 0x875A48E: QApplication::x11ProcessEvent(_XEvent*) (qapplication_x11.cpp:3621) ==20490== by 0x879473F: x11EventSourceDispatch(_GSource*, int (*)(void*), void*) (qguieventdispatcher_glib.cpp:146) ==20490== by 0xF5CC7D4: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xF5CCB07: ??? (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xF5CCBC3: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.3400.3) ==20490== by 0xA39DDC2: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:424) ==20490== by 0x8794ADF: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:204) ==20490== Address 0x1fc01a18 is 8 bytes inside a block of size 48 free'd ==20490== at 0x4C2AA9C: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==20490== by 0x637FEDF: Nepomuk2::TagWidget::~TagWidget() (tagwidget.cpp:288) ==20490== by 0x6387C02: Nepomuk2::FileMetaDataWidget::Private::deleteRows() (filemetadatawidget.cpp:122) ==20490== by 0x6387CAF: Nepomuk2::FileMetaDataWidget::Private::slotLoadingFinished() (filemetadatawidget.cpp:130) ==20490== by 0x6389093: Nepomuk2::FileMetaDataWidget::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (filemetadatawidget.moc:66) ==20490== by 0xA37FEF9: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3547) ==20490== by 0x638E28A: Nepomuk2::FileMetaDataProvider::loadingFinished() (filemetadataprovider_p.moc:109) ==20490== by 0x638C656: Nepomuk2::FileMetaDataProvider::Private::insertBasicData() (filemetadataprovider.cpp:300) ==20490== by 0x638E163: Nepomuk2::FileMetaDataProvider::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (filemetadataprovider_p.moc:61) ==20490== by 0xA379876: QMetaCallEvent::placeMetaCall(QObject*) (qobject.cpp:525) ==20490== by 0xA37AAFC: QObject::event(QEvent*) (qobject.cpp:1195) ==20490== by 0x86BD517: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4551) ==20490== ASSERT: "d" in file ../../include/QtCore/../../src/corelib/tools/qscopedpointer.h, line 112 KCrash: crashing... crashRecursionCounter = 2 KCrash: Application Name = dolphin path = /home/kde-devel/kde/bin pid = 20490 KCrash: Arguments: /home/kde-devel/kde/bin/dolphin --nocrashhandler KCrash: Attempting to start /home/kde-devel/kde/lib/kde4/libexec/drkonqi from kdeinit Git commit 7aea36dd860938db4a928a81503f33017a3ad272 by Simeon Bird. Committed on 11/09/2013 at 05:48. Pushed by sbird into branch 'master'. Fix crash if you clicked "add tag" too fast, due to the widget getting deleted from under you. Fixed by using deleteLater(). I could only reproduce this under valgrind - everything else was faster than I could click. FIXED-IN: 4.11.2 M +1 -1 ui/filemetadatawidget.cpp http://commits.kde.org/nepomuk-widgets/7aea36dd860938db4a928a81503f33017a3ad272 |