| Summary: | Crash on a dangling m_model pointer in AbstractItemView [use dummy models similar to those in Qt] | ||
|---|---|---|---|
| Product: | [Unmaintained] plasma4 | Reporter: | Nicholas Parsons <nicholas.parsons> |
| Component: | widget-folderview | Assignee: | Ignat Semenov <i.semenov.kde> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | afiestas, alex.williams, cfeck, deanguan, ivypes, jefquebec, plasma-bugs, steve_atty, titibanjekistan, troyrileys8709, wodencafe |
| Priority: | NOR | ||
| Version: | 4.8.4 | ||
| Target Milestone: | --- | ||
| Platform: | Ubuntu | ||
| OS: | Linux | ||
| Latest Commit: | http://commits.kde.org/kde-baseapps/dd284695a2b28f91f310d1caeac09dc81ef63c39 | Version Fixed In: | 4.9.5 |
| Sentry Crash Report: | |||
| Attachments: | New crash information added by DrKonqi | ||
|
Description
Nicholas Parsons
2012-04-30 04:49:50 UTC
*** Bug 299531 has been marked as a duplicate of this bug. *** Did you have a folder view applet in a panel? Was it collapsed when you chaged the theme? Also, do you have all the debug packages installed? The first 6 lines of the bt are missing. Does the DrKOnqui dialog complain about any packages missing or give other info? *** Bug 302011 has been marked as a duplicate of this bug. *** Confirmed by duplicates *** Bug 303681 has been marked as a duplicate of this bug. *** *** Bug 303123 has been marked as a duplicate of this bug. *** (In reply to comment #2) > Did you have a folder view applet in a panel? Was it collapsed when you > chaged the theme? > > Also, do you have all the debug packages installed? The first 6 lines of the > bt are missing. Does the DrKOnqui dialog complain about any packages missing > or give other info? I have the quick access applet in the panel. The bug window segnalation appeared to me for the first time then i installed the missing packages for the backtrace....i don't know... *** Bug 303770 has been marked as a duplicate of this bug. *** Ignat, in folderview.cpp:1251 the m_listView is created in constraintsEvent() depending on the form factor. In line 1216 the m_listView variable is set to 0, but the actual list view is never deleted. I guess this crash comes from dangling (leaking) list views, which still have an m_model attached. The FrameSvg in the list view calls into the list view's updateSizeHint() method, but the m_model is no longer valid for the dangling list views. In other words, to reproduce the crash, it is probably required to switch from "list view" mode (panel icon?) to "planar" mode, then do whatever is needed to set a new model (change folders?), then change plasma theme. If I recall correctly, I was fixing this crash a bit different. THere are dangling model pointers in AbstractItemView, and I implemented a solution similar to what Qt uses (actually, it was you who had proposed doing that on irc :)) While doing that, I came across the need for a certain refactoring to be able to use the dummy model solution. Once we decide how to refactor, I'll push. Actually, I concluded that it was the model pointer since in ListView::updateSizeHInt() the model pointer is the only variable that can be invalid. THank you for the proposal, I'll check that out as well. What you propose is indeed broader than my solution, not just the model pointer, but the whole view pointer is invalid. Actually, folderview.cpp:1303 m_dialog->setGraphicsWidget(m_listView); // Ownership is transferred to the scene in the dialog so we do not need to delete the list view explicitly if the m_dialog is deleted. Git commit f9ec7cf53d6516bfa3df2ca418f23859b6fbe93e by Ignat Semenov. Committed on 22/10/2012 at 16:37. Pushed by isemenov into branch 'KDE/4.9'. delete m_listView in constraintsEvent() M +1 -0 plasma/applets/folderview/folderview.cpp http://commits.kde.org/kde-baseapps/f9ec7cf53d6516bfa3df2ca418f23859b6fbe93e Created attachment 75502 [details]
New crash information added by DrKonqi
plasma-desktop (0.4) on KDE Platform 4.9.80 using Qt 4.8.4
- What I was doing when the application crashed:
Same crash while changing the plasma theme
-- Backtrace (Reduced):
#6 0x00007fea28b91674 in ListView::updateSizeHint (this=0x48ff2b0) at /home/afiestas/kdesrc/kde/kde-baseapps/plasma/applets/folderview/listview.cpp:209
[...]
#8 0x00007fea4689b73f in themeChanged (this=0x48ff450) at /home/afiestas/kdesrc/kde/kdelibs/plasma/svg.cpp:618
#9 Plasma::SvgPrivate::themeChanged (this=0x48ff450) at /home/afiestas/kdesrc/kde/kdelibs/plasma/svg.cpp:601
#10 0x00007fea4689b999 in qt_static_metacall (_a=<optimized out>, _id=<optimized out>, _o=<optimized out>, _c=<optimized out>) at /home/afiestas/kdesrc/build/kde/kdelibs/plasma/svg.moc:114
#11 Plasma::Svg::qt_static_metacall (_o=0x0, _c=1011010944, _id=-169936, _a=0x7fff3c42cef0) at /home/afiestas/kdesrc/build/kde/kdelibs/plasma/svg.moc:106
Alex, was the folderview widget in a panel or on the desktop? Did you drag the widget from the panel to the desktop or vice versa? Not necessarily right before the cash, but during the whole lifecycle of this exact folderview instance? Please, provide as many details as possible, your input is really valuable with this mysterious crash! Also, is the folderview (kde-baseapps repo) compiled fr4om sources from the current trunk? *** Bug 311661 has been marked as a duplicate of this bug. *** *** Bug 312084 has been marked as a duplicate of this bug. *** *** Bug 312084 has been marked as a duplicate of this bug. *** Git commit d0262729cc7c507a91a7d2463291acb5092a3301 by Ignat Semenov. Committed on 23/12/2012 at 20:09. Pushed by isemenov into branch 'KDE/4.9'. fix crash: delete the Dialog and its child ListView in the applet dtor The ListView object ownership is transferred to Dialog upon creation, so not deleting the Dialog object in the applet dtor results in a leaked ListView. However, when the leaked ListView receives a repaint signal on plasma theme change, the model pointer in that view is already invalid, which leads to the crash in m_model->rowCount(). FIXED-IN:4.9.5 M +2 -0 plasma/applets/folderview/folderview.cpp http://commits.kde.org/kde-baseapps/d0262729cc7c507a91a7d2463291acb5092a3301 Git commit 0df2b730ea986e6f6b8c05c0c678e9329d3d4416 by Ignat Semenov. Committed on 23/12/2012 at 20:09. Pushed by isemenov into branch 'KDE/4.10'. fix crash: delete the Dialog and its child ListView in the applet dtor The ListView object ownership is transferred to Dialog upon creation, so not deleting the Dialog object in the applet dtor results in a leaked ListView. However, when the leaked ListView receives a repaint signal on plasma theme change, the model pointer in that view is already invalid, which leads to the crash in m_model->rowCount(). FIXED-IN:4.9.5 M +2 -0 plasma/applets/folderview/folderview.cpp http://commits.kde.org/kde-baseapps/0df2b730ea986e6f6b8c05c0c678e9329d3d4416 Git commit dd284695a2b28f91f310d1caeac09dc81ef63c39 by Ignat Semenov. Committed on 23/12/2012 at 20:09. Pushed by isemenov into branch 'master'. fix crash: delete the Dialog and its child ListView in the applet dtor The ListView object ownership is transferred to Dialog upon creation, so not deleting the Dialog object in the applet dtor results in a leaked ListView. However, when the leaked ListView receives a repaint signal on plasma theme change, the model pointer in that view is already invalid, which leads to the crash in m_model->rowCount(). FIXED-IN:4.9.5 M +2 -0 plasma/applets/folderview/folderview.cpp http://commits.kde.org/kde-baseapps/dd284695a2b28f91f310d1caeac09dc81ef63c39 *** Bug 315831 has been marked as a duplicate of this bug. *** |