Bug 328271

Can you please attach the file that leads to the crash?

Created attachment 83862 [details]
The file that causes the crash

(In reply to comment #1)
> Can you please attach the file that leads to the crash?

Here it is. I should have thought you might want it.

Hm, I cannot reproduce :/ anyone else?

@Philippe: Can you please follow http://kate-editor.org/get-it/ and build Kate from sources and tell us whether the problem persists? And if it still crashes, please paste another backtrace.

On my original version of Kate, it crashes on line 127 on the attached
file (when closing the <bar part, or typing anything afterwards).

I just built kate following the instructions on the page. (still
3.11.2 in the About menu, but the copyright is now 2000-2013 instead
of 2000-2005 on my Kubuntu 13.10 version, so I guess it worked and I'm
indeed running the head version).


I'm afraid it still segfaults :( Still at line 127, after`<bar`, when typing `<`

Here is the backtrace:


Application: Kate (kate), signal: Segmentation fault

Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".

[Current thread is 1 (Thread 0xb4e1f980 (LWP 21359))]


Thread 3 (Thread 0xb1d55b40 (LWP 21360)):

#0 0xb77be424 in __kernel_vsyscall ()

#1 0xb5f5a84b in pthread_cond_wait@@GLIBC_2.3.2 () at
../nptl/sysdeps/unix/sysv/linux/i386/i686/../i486/pthread_cond_wait.S:187

#2 0xb76e09bc in __pthread_cond_wait (cond=0xb22e58d0,
mutex=0xb22e58b8) at forward.c:149

#3 0xb21e2ef2 in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#4 0xb21e2f3f in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#5 0xb5f56d78 in start_thread (arg=0xb1d55b40) at pthread_create.c:311

#6 0xb76d301e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:131


Thread 2 (Thread 0xaeebbb40 (LWP 21411)):

#0 0xb77be424 in __kernel_vsyscall ()

#1 0xb76e64d2 in clock_gettime (clock_id=1, tp=0xaeebafc8) at
../sysdeps/unix/clock_gettime.c:115

#2 0xb614f3ec in do_gettime (frac=0xaeebafc0, sec=0xaeebafb8) at
tools/qelapsedtimer_unix.cpp:123

#3 qt_gettime () at tools/qelapsedtimer_unix.cpp:140

#4 0xb6234fd2 in updateCurrentTime (this=0xae502074) at
kernel/qeventdispatcher_unix.cpp:354

#5 QTimerInfoList::timerWait (this=0xae502074, tm=...) at
kernel/qeventdispatcher_unix.cpp:461

#6 0xb623367b in timerSourcePrepareHelper (src=<optimized out>,
timeout=0xaeebb0bc) at kernel/qeventdispatcher_glib.cpp:136

#7 0xb623370d in timerSourcePrepare (source=0xae502040,
timeout=0xaeebb0bc) at kernel/qeventdispatcher_glib.cpp:169

#8 0xb5e77143 in g_main_context_prepare () from
/lib/i386-linux-gnu/libglib-2.0.so.0

#9 0xb5e77a5f in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0

#10 0xb5e77ca8 in g_main_context_iteration () from
/lib/i386-linux-gnu/libglib-2.0.so.0

#11 0xb62338df in QEventDispatcherGlib::processEvents
(this=0xae500468, flags=...) at kernel/qeventdispatcher_glib.cpp:426

#12 0xb62029f3 in QEventLoop::processEvents
(this=this@entry=0xaeebb228, flags=...) at kernel/qeventloop.cpp:149

#13 0xb6202d19 in QEventLoop::exec (this=this@entry=0xaeebb228,
flags=...) at kernel/qeventloop.cpp:204

#14 0xb60f1e3d in QThread::exec (this=this@entry=0x9c7bb00) at
thread/qthread.cpp:542

#15 0xb61e2e14 in QInotifyFileSystemWatcherEngine::run
(this=0x9c7bb00) at io/qfilesystemwatcher_inotify.cpp:265

#16 0xb60f472f in QThreadPrivate::start (arg=0x9c7bb00) at
thread/qthread_unix.cpp:338

#17 0xb5f56d78 in start_thread (arg=0xaeebbb40) at pthread_create.c:311

#18 0xb76d301e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:131


Thread 1 (Thread 0xb4e1f980 (LWP 21359)):

[KCrash Handler]

#7 0xb241cc44 in KSharedPtr (o=..., this=<synthetic pointer>) at
/usr/include/ksharedptr.h:84

#8 KateDocument::defStyleNum (this=0x9aa9b30, line=line@entry=126,
column=column@entry=9) at
/home/philippe/kde/kate/part/document/katedocument.cpp:5485

#9 0xb244875e in KateScriptDocument::defStyleNum
(this=this@entry=0xa157cb8, line=line@entry=126,
column=column@entry=9) at
/home/philippe/kde/kate/part/script/katescriptdocument.cpp:51

#10 0xb244887b in KateScriptDocument::isString
(this=this@entry=0xa157cb8, line=126, column=column@entry=9) at
/home/philippe/kde/kate/part/script/katescriptdocument.cpp:83

#11 0xb24488cb in KateScriptDocument::isString
(this=this@entry=0xa157cb8, cursor=...) at
/home/philippe/kde/kate/part/script/katescriptdocument.cpp:89

#12 0xb23b779e in KateScriptDocument::qt_static_metacall
(_o=_o@entry=0xa157cb8, _id=_id@entry=91, _a=_a@entry=0xbfc4985c,
_c=QMetaObject::InvokeMetaMethod) at
/home/philippe/kde/kate/build/part/moc_katescriptdocument.cpp:408

#13 0xb23b8ae3 in qt_static_metacall (_a=0xbfc4985c, _id=91,
_c=QMetaObject::InvokeMetaMethod, _o=0xa157cb8) at
/home/philippe/kde/kate/build/part/moc_katescriptdocument.cpp:467

#14 KateScriptDocument::qt_metacall (this=0xa157cb8,
_c=QMetaObject::InvokeMetaMethod, _id=91, _a=0xbfc4985c) at
/home/philippe/kde/kate/build/part/moc_katescriptdocument.cpp:468

#15 0xb620ae35 in QMetaObject::metacall (object=0xa157cb8,
cl=QMetaObject::InvokeMetaMethod, idx=95, argv=0xbfc4985c) at
kernel/qmetaobject.cpp:245

#16 0xb2254e94 in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#17 0xb2256434 in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#18 0xb225672e in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#19 0xb214a3c3 in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#20 0xb21254bc in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#21 0xaf561d35 in ?? ()

#22 0xb20e0ac2 in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#23 0xb2178366 in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#24 0xb214a427 in ?? () from /usr/lib/i386-linux-gnu/libQtScript.so.4

#25 0xb2240b4a in QScriptValue::call(QScriptValue const&,
QList<QScriptValue> const&) () from
/usr/lib/i386-linux-gnu/libQtScript.so.4

#26 0xb243f72f in KateIndentScript::indent (this=0x98b1118,
view=view@entry=0x9cdf040, position=...,
typedCharacter=typedCharacter@entry=..., indentWidth=4) at
/home/philippe/kde/kate/part/script/kateindentscript.cpp:73

#27 0xb254d30d in KateAutoIndent::scriptIndent
(this=this@entry=0x993aff8, view=view@entry=0x9cdf040, position=...,
typedChar=typedChar@entry=...) at
/home/philippe/kde/kate/part/utils/kateautoindent.cpp:268

#28 0xb254d4dd in KateAutoIndent::userTypedChar (this=0x993aff8,
view=0x9cdf040, position=..., typedChar=...) at
/home/philippe/kde/kate/part/utils/kateautoindent.cpp:459

#29 0xb242b71b in KateDocument::typeChars (this=0x9aa9b30,
view=0x9cdf040, realChars=...) at
/home/philippe/kde/kate/part/document/katedocument.cpp:2653

#30 0xb24b6204 in KateViewInternal::keyPressEvent (this=0x9cf21f8,
e=0xbfc4a208) at
/home/philippe/kde/kate/part/view/kateviewinternal.cpp:2426

#31 0xb24b4cd2 in KateViewInternal::eventFilter (this=0x9cf21f8,
obj=0x9cf21f8, e=0xbfc4a208) at
/home/philippe/kde/kate/part/view/kateviewinternal.cpp:2227

#32 0xb620404e in
QCoreApplicationPrivate::sendThroughObjectEventFilters
(this=this@entry=0x9843d18, receiver=receiver@entry=0x9cf21f8,
event=event@entry=0xbfc4a208) at kernel/qcoreapplication.cpp:1056

#33 0xb6c67721 in QApplicationPrivate::notify_helper (this=0x9843d18,
receiver=0x9cf21f8, e=0xbfc4a208) at kernel/qapplication.cpp:4563

#34 0xb6c6fabc in QApplication::notify (this=0xbfc4a97c,
receiver=<optimized out>, receiver@entry=0x9cf21f8,
e=e@entry=0xbfc4a208) at kernel/qapplication.cpp:4008

#35 0xb65c4ff4 in KApplication::notify (this=0xbfc4a97c,
receiver=0x9cf21f8, event=0xbfc4a208) at
../../kdeui/kernel/kapplication.cpp:311

#36 0xb6203eda in QCoreApplication::notifyInternal (this=0xbfc4a97c,
receiver=receiver@entry=0x9cf21f8, event=event@entry=0xbfc4a208) at
kernel/qcoreapplication.cpp:946

#37 0xb6c65bcd in sendSpontaneousEvent (event=0xbfc4a208,
receiver=0x9cf21f8) at
../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:234

#38 qt_sendSpontaneousEvent (receiver=0x9cf21f8,
event=event@entry=0xbfc4a208) at kernel/qapplication.cpp:5565

#39 0xb6d19579 in QKeyMapper::sendKeyEvent
(keyWidget=keyWidget@entry=0x9cf21f8, grab=grab@entry=false,
type=QEvent::KeyPress, code=62, modifiers=..., text=...,
autorepeat=autorepeat@entry=false, count=1,
nativeScanCode=nativeScanCode@entry=94, nativeVirtualKey=62,
nativeModifiers=nativeModifiers@entry=17) at
kernel/qkeymapper_x11.cpp:1866

#40 0xb6d19968 in QKeyMapperPrivate::translateKeyEvent
(this=0x987fbd0, keyWidget=keyWidget@entry=0x9cf21f8,
event=event@entry=0xbfc4a57c, grab=grab@entry=false) at
kernel/qkeymapper_x11.cpp:1836

#41 0xb6cefae5 in QApplication::x11ProcessEvent (this=0xbfc4a97c,
event=event@entry=0xbfc4a57c) at kernel/qapplication_x11.cpp:3639

#42 0xb6d1c274 in x11EventSourceDispatch (s=0x9844f58, callback=0x0,
user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146

#43 0xb5e7783e in g_main_context_dispatch () from
/lib/i386-linux-gnu/libglib-2.0.so.0

#44 0xb5e77be8 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0

#45 0xb5e77ca8 in g_main_context_iteration () from
/lib/i386-linux-gnu/libglib-2.0.so.0

#46 0xb62338bf in QEventDispatcherGlib::processEvents
(this=this@entry=0x984a130, flags=...) at
kernel/qeventdispatcher_glib.cpp:424

#47 0xb6d1c32e in QGuiEventDispatcherGlib::processEvents
(this=0x984a130, flags=...) at kernel/qguieventdispatcher_glib.cpp:204

#48 0xb62029f3 in QEventLoop::processEvents
(this=this@entry=0xbfc4a838, flags=...) at kernel/qeventloop.cpp:149

#49 0xb6202d19 in QEventLoop::exec (this=this@entry=0xbfc4a838,
flags=...) at kernel/qeventloop.cpp:204

#50 0xb620889e in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1218

#51 0xb6c65974 in QApplication::exec () at kernel/qapplication.cpp:3828

#52 0xb77b785d in kdemain (argc=1, argv=0xbfc4aa84) at
/home/philippe/kde/kate/kate/app/katemain.cpp:380

#53 0x0804853b in main (argc=1, argv=0xbfc4aa84) at
/home/philippe/kde/kate/build/kate/app/kate_dummy.cpp:3

Hi Philippe,

what highlight are you using? Will it crash, when you use different highlight, for example "None"?

> what highlight are you using? Will it crash, when you use different highlight,
> for example "None"?

No crash with no highlighting.
Damn, I just spend 10 minutes trying to make the segfault appear
again, to no avail.

If I don't get it anymore, what should I do, close the bug report?

No, you were obviously hitting a bug. We just can't reproduce it. It might come from the highlighting system. That's why I was asking about highlighting you were using, when the crash appeared, so we can simulate the same conditions.

*** Bug 328885 has been marked as a duplicate of this bug. ***

@Philippe: Which indenter do you use?

I'm not sure what's going on here. If we knew the input was wrong in e.g. KateScriptDocument::isString() or KateScriptDocument::defStyleNum() we maybe could fix it.

> @Philippe: Which indenter do you use?
>
> I'm not sure what's going on here. If we knew the input was wrong in e.g.
> KateScriptDocument::isString() or KateScriptDocument::defStyleNum() we maybe
> could fix it.

I used the default indenter style.

But the "default" indenter should never invoke isString()... Are you sure? What do you mean by default?

I mean 'none' or something like that. Since I was editing a Markdown
file, I did not need any specific indentation. Sorry not to remember,
but that was two weeks ago, on a specific file.

Otherwise, I use the C/C++ option IIRC.

I don't have access to my own machine right now, I'll have a look in a
few hours.

Btw, there is no crash if I copy paste the symbol or if it is inserted automatically, e.g., by opening curly braces (the editor closes it with };).

> I don't have access to my own machine right now, I'll have a look in a
> few hours.

I used either 'none' or 'normal'. As I said, I cannot reproduce the crash now.

*** Bug 329023 has been marked as a duplicate of this bug. ***

@Michal:

katehighlight.h:
  KateHlContext *contextNum (int n)
  {
    if (n >= 0 && n < m_contexts.size()) return m_contexts[n];
    Q_ASSERT (0);
    return m_contexts[0];
   }

With your patch, instead of passing the contents of the last item of contextStack() to contextNum, we now pass the size()-1 of the contextStack() to contextNum. I don't think that makes sense, does it?

(In release mode, it's optimized out, so we access m_contexts[0] even though there are no elements. This should be a return 0 anyways, as now re return an arbitrary value that does not really exist.

My guess is another one:
#7 0xb241cc44 in KSharedPtr (o=..., this=...) at /usr/include/ksharedptr.h:84
#8 KateDocument::defStyleNum (this=0x9aa9b30, line=126, column=9) at part/document/katedocument.cpp:5485

Kate::TextLine is a shared pointer. And this is most probably invalid. Therefore, I'd propose to just do a validity check as we have it almost everywhere in the code:
  if( !tl )
    return -1;

Will commit this, let's see whether this changes anything for the 4.12.1 release.

(In reply to comment #16)
> *** Bug 329023 has been marked as a duplicate of this bug. ***

1. I always experience the crash even when highlighting is set to 'None', in contrast to what has been reported here.
2. In my case Kate or any other editor does not crash "after a few seconds" as posted in the original report, they crash at once when typing a colon symbol.
3. I experience the crash only in plain text files not containing any programming language source code or other markup. In source code/markup files I actually do not get any crash.

1. Can you provide a valgrind trace?

valgrind kwrite # or kate, then attache the output here

ThereWhat I don't understand is: If you have no indenter set (none or normal), no script indenter is used. However, the backtrace clearly says that a scripted indenter is active that finally calls KateScriptDocument::isString(). This indicates that the indenter is different from none or normal. Maybe it's C++/Boost style?

I'll attach a possible patch, but I'm not sure it rather fixes the blame than the source of the problem.

Potential fix: https://git.reviewboard.kde.org/r/114586/

@Dominik: Whom were you addressing in comment 19?

Git commit 52faa15fdae2479a727daad6b4aab28606c963da by Dominik Haumann.
Committed on 21/12/2013 at 16:58.
Pushed by dhaumann into branch 'master'.

fix crashes in KateDocument::defStyleNum() by adding if-guards.
REVIEW: 114586
FIXED-IN: 4.12.1

M  +35   -28   part/document/katedocument.cpp

http://commits.kde.org/kate/52faa15fdae2479a727daad6b4aab28606c963da

Git commit d992a1905baf704d1040d2e63cce4f1d937cdf5e by Dominik Haumann.
Committed on 21/12/2013 at 16:58.
Pushed by dhaumann into branch 'KDE/4.12'.

fix crashes in KateDocument::defStyleNum() by adding if-guards.
REVIEW: 114586
FIXED-IN: 4.12.1

M  +35   -28   part/document/katedocument.cpp

http://commits.kde.org/kate/d992a1905baf704d1040d2e63cce4f1d937cdf5e

*** Bug 329384 has been marked as a duplicate of this bug. ***

*** Bug 330176 has been marked as a duplicate of this bug. ***

*** Bug 330196 has been marked as a duplicate of this bug. ***

*** Bug 330350 has been marked as a duplicate of this bug. ***

*** Bug 332288 has been marked as a duplicate of this bug. ***

*** Bug 332426 has been marked as a duplicate of this bug. ***

*** Bug 334248 has been marked as a duplicate of this bug. ***

Created attachment 86857 [details]
New crash information added by DrKonqi

kdevelop (4.5.2) on KDE Platform 4.12.5 using Qt 4.8.5

- What I was doing when the application crashed:
create new document (not saving it)
type a :
crash

-- Backtrace (Reduced):
#6  KateDocument::defStyleNum (this=0x7f49770, line=<optimized out>, column=5) at /var/tmp/portage/kde-base/katepart-4.12.5/work/katepart-4.12.5/part/document/katedocument.cpp:5472
#7  0x00007f1882d40d69 in KateScriptDocument::defStyleNum (this=<optimized out>, line=<optimized out>, column=<optimized out>) at /var/tmp/portage/kde-base/katepart-4.12.5/work/katepart-4.12.5/part/script/katescriptdocument.cpp:51
#8  0x00007f1882d40e29 in KateScriptDocument::isString (this=<optimized out>, line=<optimized out>, column=<optimized out>) at /var/tmp/portage/kde-base/katepart-4.12.5/work/katepart-4.12.5/part/script/katescriptdocument.cpp:83
#9  0x00007f1882caaed6 in KateScriptDocument::qt_static_metacall (_o=0x80a57e0, _id=-1550264016, _a=0x7fff64da9940, _c=<optimized out>) at /var/tmp/portage/kde-base/katepart-4.12.5/work/katepart-4.12.5_build/part/moc_katescriptdocument.cpp:407
#10 0x00007f1882cac141 in KateScriptDocument::qt_metacall (this=0x80a57e0, _c=QMetaObject::InvokeMetaMethod, _id=<optimized out>, _a=0x7fff64da9940) at /var/tmp/portage/kde-base/katepart-4.12.5/work/katepart-4.12.5_build/part/moc_katescriptdocument.cpp:471

The true fix was commit for bug #332426 only for KDE 4.14 only 3 weeks ago.

*** This bug has been marked as a duplicate of bug 332426 ***

*** Bug 337229 has been marked as a duplicate of this bug. ***