Bug 301051

It crash in rotation code from DImg component when image is loaded in editor. It's autorotation stuff accordingly with Exif flag.

But it's really strange. At end, crash stop to libc to a corruption memory :

8  0x00007fc341883e2e in __libc_message (do_abort=2, fmt=0x7fc34198c0d0 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:201
#9  0x00007fc34188e626 in malloc_printerr (action=3, str=0x7fc34198c230 "double free or corruption (out)", ptr=<optimized out>) at malloc.c:5007

Can you run digiKam into valgrind from a console, and reproduce the crash, and report the console trace here ?

Look here for details about valgrind :

https://projects.kde.org/projects/extragear/graphics/digikam/repository/revisions/master/entry/HACKING#L281

Gilles Caulier

*** Bug 285319 has been marked as a duplicate of this bug. ***

*** Bug 300843 has been marked as a duplicate of this bug. ***

Created attachment 71520 [details]
Valgrind output when Digikam crashes

Thanks a lot for your help… you're much quicker than kmail guys :)

I made further tests, which may be useless with Valgrind output. In a specific album I need to first double click on a thumbnail to open a preview of a portrait picture, then open the image editor on that picture, move forward and Digikam crashes on the third portrait picture. 

I didn't succeed to reproduce the bug in other albums.

Also, Digikam doesn't crash if I don't first preview the picture. If I open the image editor first, close it, preview the picture, and then re-open the image editor, it won't crash.

Valgrind output is in attachment. I launched the command given in the URL above. However, let me suggest to add file redirection to the command: when Digikam crashes, valgrind complains about lots of memory blocks that have been lost. There are so many lines that I lost the beginning of the output. So I had to relaunch valgrind, with redirections this time.

The digikam.supp file I used was the latest from the git repository. The output is compressed in attachment. Let me pinpoint the important part in the output. When I click on a thumbnail to get a preview, valgrind detects an “Invalid read of size 8” at 0x95DB52A. Opening the image editor does not produce any error. It is only when I load the third portrait picture that I get a seemingly fatal “Invalid read of size 4” at 0x7337108.

This is the trace relevant of crash from Valgrind :

==27428== Invalid read of size 4
==27428==    at 0x7337108: Digikam::DImg::rotate(Digikam::DImg::ANGLE) (dimg.cpp:2294)
==27428==    by 0x7337256: Digikam::DImg::rotateAndFlip(int) (dimg.cpp:2636)
==27428==    by 0x76062A5: Digikam::DImgInterface::slotImageLoaded(Digikam::LoadingDescription const&, Digikam::DImg const&) (dimginterface.cpp:433)
==27428==    by 0xA74D445: QObject::event(QEvent*) (qobject.cpp:1195)
==27428==    by 0x95E3893: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4559)
==27428==    by 0x95E8712: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4420)
==27428==    by 0x8FE5BB5: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:311)
==27428==    by 0xA733E9B: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:876)
==27428==    by 0xA737C69: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.h:231)
==27428==    by 0xA762F92: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (qcoreapplication.h:236)
==27428==    by 0x12017C99: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.1)
==27428==    by 0x1201805F: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.1)
==27428==  Address 0x60940d84 is not stack'd, malloc'd or (recently) free'd
==27428== 
KCrash: Application 'digikam' crashing...
KCrash: Attempting to start /usr/lib/kde4/libexec/drkonqi from kdeinit
==27428== Invalid read of size 4
==27428==    at 0x9046F80: startFromKdeinit(int, char const**) (kcrash.cpp:781)
==27428==    by 0x9047470: startProcessInternal(int, char const**, bool, bool) (kcrash.cpp:537)
==27428==    by 0x9047BD9: KCrash::startProcess(int, char const**, bool) (kcrash.cpp:524)
==27428==    by 0x9047FA6: KCrash::defaultCrashHandler(int) (kcrash.cpp:435)
==27428==    by 0xB54E4BF: ??? (in /lib/x86_64-linux-gnu/libc-2.15.so)
==27428==    by 0x7337107: Digikam::DImg::rotate(Digikam::DImg::ANGLE) (dimg.cpp:2290)
==27428==    by 0x7337256: Digikam::DImg::rotateAndFlip(int) (dimg.cpp:2636)
==27428==    by 0x76062A5: Digikam::DImgInterface::slotImageLoaded(Digikam::LoadingDescription const&, Digikam::DImg const&) (dimginterface.cpp:433)
==27428==    by 0xA74D445: QObject::event(QEvent*) (qobject.cpp:1195)
==27428==    by 0x95E3893: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4559)
==27428==    by 0x95E8712: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4420)
==27428==    by 0x8FE5BB5: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:311)
==27428==  Address 0x31aa5e10 is 0 bytes inside a block of size 3 alloc'd
==27428==    at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==27428==    by 0x9046EE7: startFromKdeinit(int, char const**) (kcrash.cpp:660)
==27428==    by 0x9047470: startProcessInternal(int, char const**, bool, bool) (kcrash.cpp:537)
==27428==    by 0x9047BD9: KCrash::startProcess(int, char const**, bool) (kcrash.cpp:524)
==27428==    by 0x9047FA6: KCrash::defaultCrashHandler(int) (kcrash.cpp:435)
==27428==    by 0xB54E4BF: ??? (in /lib/x86_64-linux-gnu/libc-2.15.so)
==27428==    by 0x7337107: Digikam::DImg::rotate(Digikam::DImg::ANGLE) (dimg.cpp:2290)
==27428==    by 0x7337256: Digikam::DImg::rotateAndFlip(int) (dimg.cpp:2636)
==27428==    by 0x76062A5: Digikam::DImgInterface::slotImageLoaded(Digikam::LoadingDescription const&, Digikam::DImg const&) (dimginterface.cpp:433)
==27428==    by 0xA74D445: QObject::event(QEvent*) (qobject.cpp:1195)
==27428==    by 0x95E3893: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4559)
==27428==    by 0x95E8712: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:4420)

Gilles Caulier

Do you identified with image crash digiKam. If yes, please share this file to try to reproduce it here...

Gilles Caulier

Contrarily to what I said in my first message, Digikam does not crash on a specific image. If I first preview any portrait picture (a picture whose orientation is portrait), then open the image editor on that picture, Digikam will crash after loading the third portrait picture, whatever the picture is. However other conditions must be fulfilled to ensure the crash! The pictures must not have been modified either by Digikam's editor or an external editor. The crash never occurs neither on a modified picture nor a landscape picture.

I succeeded to reproduce the bug on another album. I selected sub-sample of the pictures so that the crash still occurs. So that you can better understand (if you succeed to reproduce the bug), I also included landscape pictures and modified pictures (with versioning).

A last important point. These pictures were recovered using testdisk because I had troubles with my memory card. I didn't succeed to reproduce the bug on albums that were not recovered using testdisk (the original buggy album is also made of pictures recovered with testdisk).

The album is available here: http://dl.free.fr/qAaWlptsn

Created attachment 71539 [details]
New crash information added by DrKonqi

digikam (2.5.0) on KDE Platform 4.8.3 (4.8.3) using Qt 4.8.1

- What I was doing when the application crashed:

Hello,
I reported this as a separate bug a week ago (id # 300843), but as Gilles suggested, is is probably the same as this one, and has now happened a second time. It happened (perhaps the first time as well, I cannot recall for sure) while browsing to other photos in the image editor window. However, my photos were never recovered using testdisk, which Mikael suspected as a factor. As far as I know they never experienced any file corruption or disk issues. However, I can say that some of the ones I was browsing back and forth on had been edited by the digikam/kipi editing tools, and some had not been edited.

-- Backtrace (Reduced):
#6  Digikam::DImg::rotate (this=0x38dfe20, angle=<optimized out>) at /build/buildd/digikam-2.5.0/core/libs/dimg/dimg.cpp:2429
#7  0x00007f16c42ca282 in Digikam::DImg::rotateAndFlip (this=0x38dfe20, orientation=<optimized out>) at /build/buildd/digikam-2.5.0/core/libs/dimg/dimg.cpp:2647
#8  0x00007f16c45992a6 in Digikam::DImgInterface::slotImageLoaded (this=0x38cf690, loadingDescription=..., img=...) at /build/buildd/digikam-2.5.0/core/utilities/imageeditor/canvas/dimginterface.cpp:433
#9  0x00007f16c11e4446 in QObject::event (this=0x38cf690, e=<optimized out>) at kernel/qobject.cpp:1195
#10 0x00007f16c1bc0894 in notify_helper (e=0x7f163c09de00, receiver=0x38cf690, this=0x205d980) at kernel/qapplication.cpp:4559

As current git's dimg.cpp line numbers are different to 2.5.0, here the translation of relevant lines:
2436: delete [] m_priv->data;
2294: *to = *from++;
2429: *to = *from++;

From valgrind we learn that the read is invalid (in the line when reading from source and writing to destination), and we have one crash when deleting source, which in conclusion means that source data is invalid.
(side note to myself: move image rotation to a thread)

Unfortunately, I cannot reproduce with your sample pictures (I took the three original images and showed opened them in a row in the editor)

Created attachment 71797 [details]
New crash information added by DrKonqi

digikam (2.5.0) on KDE Platform 4.8.3 (4.8.3) using Qt 4.8.1

- What I was doing when the application crashed:

I had opened a preview of the first image in one of my albums. Then I opened that image in the editor, zoomed and panned around a bit, opened and closed the thumbnail bar, and then hit PgDn to go to the next image in the album. That's when Digikam crashed. Both images were portrait.

-- Backtrace (Reduced):
#7  Digikam::DImg::rotate (this=0xaa36a24, angle=Digikam::DImg::ROT90) at /build/buildd/digikam-2.5.0/core/libs/dimg/dimg.cpp:2294
#8  0x015ecac8 in Digikam::DImg::rotateAndFlip (this=0xaa36a24, orientation=6) at /build/buildd/digikam-2.5.0/core/libs/dimg/dimg.cpp:2636
#9  0x018fd4ac in Digikam::DImgInterface::slotImageLoaded (this=0xa927fe0, loadingDescription=..., img=...) at /build/buildd/digikam-2.5.0/core/utilities/imageeditor/canvas/dimginterface.cpp:433
#10 0x01906bbe in qt_static_metacall (_a=0x9726dfa8, _id=9, _o=0xa927fe0, _c=<optimized out>) at /build/buildd/digikam-2.5.0/obj-i686-linux-gnu/core/digikam/dimginterface.moc:90
#11 Digikam::DImgInterface::qt_static_metacall (_o=0xa927fe0, _c=QMetaObject::InvokeMetaMethod, _id=9, _a=0x9726dfa8) at /build/buildd/digikam-2.5.0/obj-i686-linux-gnu/core/digikam/dimginterface.moc:75

Note that I'm not able to reproduce this crash based on my description above (using the same photos), so there must've been some other contributing factor that I am forgetting.

Created attachment 71798 [details]
New crash information added by DrKonqi

digikam (2.5.0) on KDE Platform 4.8.3 (4.8.3) using Qt 4.8.1

- What I was doing when the application crashed:

Just hit this crash again. The only common factor with before was that I was in the image editor and hit PgDn to go to the next image. Otherwise I can't think of any commonalities (different photos, different orientations, in the middle of the album, etc.).

-- Backtrace (Reduced):
#7  Digikam::DImg::rotate (this=0xaa01244, angle=Digikam::DImg::ROT90) at /build/buildd/digikam-2.5.0/core/libs/dimg/dimg.cpp:2294
#8  0x025afac8 in Digikam::DImg::rotateAndFlip (this=0xaa01244, orientation=6) at /build/buildd/digikam-2.5.0/core/libs/dimg/dimg.cpp:2636
#9  0x02792271 in Digikam::LoadSaveThread::exifRotate (image=..., filePath=...) at /build/buildd/digikam-2.5.0/core/libs/threadimageio/loadsavethread.cpp:276
#10 0x027a992e in Digikam::PreviewLoadingTask::execute (this=0xaa010c8) at /build/buildd/digikam-2.5.0/core/libs/threadimageio/previewtask.cpp:185
#11 0x02791938 in Digikam::LoadSaveThread::run (this=0x9377378) at /build/buildd/digikam-2.5.0/core/libs/threadimageio/loadsavethread.cpp:118

Try 2.6.0 just release. It's probably fixed...

Gilles Caulier

Official digiKam 2.6.0 release is out since few days now :

http://www.digikam.org/drupal/node/656

Please, check if this entry still valid, or update report accordingly.

Thanks in advance.

Gilles Caulier

I don't have time at the moment to compile a new version from source, but I'll try out 2.6.0 once it lands in Ubuntu. Looks like it just made it to Debian's testing repo, so hopefully it'll show up in the Ubuntu 12.10 repo in the near future.

i am using digikam 2.6 pulled from philip's ppa. i have not encountered a crash yet. it seems to be fixed.
thank you!

Thanks Gus,

Gary, if you e,coured this problem again, please reopen this file...

Gilles Caulier

Created attachment 72251 [details]
New crash information added by DrKonqi

digikam (2.7.0) on KDE Platform 4.8.3 (4.8.3) using Qt 4.8.1

- What I was doing when the application crashed:
when switching through pictures in the editor, digikam always crashes at the same files

- Custom settings of the application:
well it's a git version (2.7.0). I'm using the git version because of a bug which caused
digikam to crash when saving an edited file.

Maybe both bugs are relating to each other...

PS: I know that this report is still closed, but... I'm using 2.7.0 ...

-- Backtrace (Reduced):
#7  __GI___libc_free (mem=0x7c89a008) at malloc.c:2968
[...]
#10 0xb68b3ffa in Digikam::DImg::rotate (this=0xb7c2b2c, angle=Digikam::DImg::ROT90) at /build/buildd/digikam-git-2.5.99/libs/dimg/dimg.cpp:2307
#11 0xb68b44d8 in Digikam::DImg::rotateAndFlip (this=0xb7c2b2c, orientation=6) at /build/buildd/digikam-git-2.5.99/libs/dimg/dimg.cpp:2642
#12 0xb6bd25e3 in Digikam::DImgInterface::slotImageLoaded (this=0xaf04728, loadingDescription=..., img=...) at /build/buildd/digikam-git-2.5.99/utilities/imageeditor/canvas/dimginterface.cpp:454
#13 0xb6bdbc0e in qt_static_metacall (_a=0x99199490, _id=9, _o=0xaf04728, _c=<optimized out>) at /build/buildd/digikam-git-2.5.99/obj-i686-linux-gnu/digikam/dimginterface.moc:90

"digikam always crashes at the same files" sounds promising: You know a file with which you can always reproduce this crash when opening it? Which sort of file is this?

Hello,
I found that the crash while browsing through images in the editor window, has occurred again in version 2.6. 
I can say, however, that it seems like you have to browse through more images than in order for it to crash than in version 2.5.
It seems like it crashed on files that have been edited, but I am not sure about that.

Hi there,

same problem here with vers. 2.6.0 (from Debian Sid) -- On some photos, DigiKam crashes when hitting PgUp oder PgDown. ValGrind output attached.

Created attachment 74197 [details]
Valgrind Crash Info on PgUp/PgDown with DigiKam 2.6.0

==10758== Thread 8:
==10758== Invalid read of size 1
==10758==    at 0x4D0182B: Digikam::ImageHistogram::calculate() (in /usr/lib/libdigikamcore.so.2.0.0)
==10758==    by 0x4D014DC: Digikam::ImageHistogram::run() (in /usr/lib/libdigikamcore.so.2.0.0)
==10758==    by 0x4E0E6E9: Digikam::DynamicThread::DynamicThreadPriv::run() (in /usr/lib/libdigikamcore.so.2.0.0)
==10758==    by 0x6BCB913: QThreadPoolThread::run() (in /usr/lib/i386-linux-gnu/libQtCore.so.4.8.2)
==10758==    by 0x6BD8EFF: QThreadPrivate::start(void*) (in /usr/lib/i386-linux-gnu/libQtCore.so.4.8.2)
==10758==    by 0x8FF2C38: start_thread (pthread_create.c:304)
==10758==    by 0x70D123D: clone (clone.S:130)


If this is the crash location, sounds like one of those ever-reoccurring crashes with the histogram code.

Marcel,

I can confirm that those crashes only occur if the "Colors" tab is selected on the right-hand image information panel. When selecting other tabs (e.g. "Properties", "Metadata", or "Caption/Tags"), selecting the next/previous image from within the image editor works just fine.

*** This bug has been marked as a duplicate of bug 274555 ***