Bug 349684

Summary:	Crash when creating new credit transfer
Product:	[Applications] kmymoney	Reporter:	Thomas Baumgart <tbaumgart>
Component:	onlinebanking	Assignee:	KMyMoney Devel Mailing List <kmymoney-devel>
Status:	RESOLVED FIXED
Severity:	crash	CC:	ralf.habacker
Priority:	NOR
Version First Reported In:	git (master)
Target Milestone:	---
Platform:	Other
OS:	Linux
Latest Commit:		Version Fixed/Implemented In:	4.8.0
Sentry Crash Report:

Description Thomas Baumgart 2015-06-28 14:36:05 UTC

Details can be found in the 'steps to reproduce' section.

Reproducible: Always

Steps to Reproduce:
- Start the application
- Open the online job view
- Click 'New credit transfer'
- Click 'Abort'
- Click 'New credit transfer'
BANG: Crash

Actual Results:  
- Start the application
- Open the online job view
- Click 'New credit transfer'
- Click 'Abort'
- Click 'New credit transfer'
BANG: Crash

The crash can be reproduced every time.

-- Backtrace:
Application: KMyMoney (kmymoney), signal: Segmentation fault
Using host libthread_db library "/lib64/libthread_db.so.1".
[Current thread is 1 (Thread 0x7f6608e1c880 (LWP 26526))]

Thread 2 (Thread 0x7f65eec32700 (LWP 26527)):
#0  0x00007f65fe429ffa in ?? () from /usr/lib64/libglib-2.0.so.0
#1  0x00007f65fe42a2b9 in g_mutex_unlock () from /usr/lib64/libglib-2.0.so.0
#2  0x00007f65fe3e9790 in g_main_context_acquire () from /usr/lib64/libglib-2.0.so.0
#3  0x00007f65fe3ea4c5 in ?? () from /usr/lib64/libglib-2.0.so.0
#4  0x00007f65fe3ea70c in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
#5  0x00007f6603fd8d76 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4
#6  0x00007f6603faad0f in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4
#7  0x00007f6603fab005 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4
#8  0x00007f6603ea9fef in QThread::exec() () from /usr/lib64/libQtCore.so.4
#9  0x00007f6603f8c513 in ?? () from /usr/lib64/libQtCore.so.4
#10 0x00007f6603eac68f in ?? () from /usr/lib64/libQtCore.so.4
#11 0x00007f66073cf0db in start_thread () from /lib64/libpthread.so.0
#12 0x00007f66030c4ddd in clone () from /lib64/libc.so.6

Thread 1 (Thread 0x7f6608e1c880 (LWP 26526)):
[KCrash Handler]
#5  0x0000000000000000 in ?? ()
#6  0x00007f6607191757 in StyledItemDelegateForwarder::sizeHint (this=<optimized out>, option=..., index=...) at /home/thb/devel/kmymoney/kmymoney/widgets/styleditemdelegateforwarder.cpp:34
#7  0x00007f6604eeb64e in QTreeView::indexRowSizeHint(QModelIndex const&) const () from /usr/lib64/libQtGui.so.4
#8  0x00007f6604eedf99 in QTreeViewPrivate::itemHeight(int) const () from /usr/lib64/libQtGui.so.4
#9  0x00007f6604eeea3e in QTreeViewPrivate::updateScrollBars() () from /usr/lib64/libQtGui.so.4
#10 0x00007f6604ef8f77 in QTreeView::updateGeometries() () from /usr/lib64/libQtGui.so.4
#11 0x00007f6604ef7ae9 in QTreeView::timerEvent(QTimerEvent*) () from /usr/lib64/libQtGui.so.4
#12 0x00007f6603fc3f31 in QObject::event(QEvent*) () from /usr/lib64/libQtCore.so.4
#13 0x00007f6604a0ce4b in QWidget::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#14 0x00007f6604da9bde in QFrame::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#15 0x00007f6604e2612b in QAbstractScrollArea::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#16 0x00007f6604eb8b1b in QAbstractItemView::event(QEvent*) () from /usr/lib64/libQtGui.so.4
#17 0x00007f66049bd8ac in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#18 0x00007f66049c3e70 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#19 0x00007f66056d418a in KApplication::notify(QObject*, QEvent*) () from /usr/lib64/libkdeui.so.5
#20 0x00007f6603fac0ad in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib64/libQtCore.so.4
#21 0x00007f6603fdb83c in ?? () from /usr/lib64/libQtCore.so.4
#22 0x00007f6603fd8b21 in ?? () from /usr/lib64/libQtCore.so.4
#23 0x00007f65fe3ea316 in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#24 0x00007f65fe3ea668 in ?? () from /usr/lib64/libglib-2.0.so.0
#25 0x00007f65fe3ea70c in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
#26 0x00007f6603fd8d55 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4
#27 0x00007f6604a5a936 in ?? () from /usr/lib64/libQtGui.so.4
#28 0x00007f6603faad0f in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4
#29 0x00007f6603fab005 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4
#30 0x00007f6603fb013b in QCoreApplication::exec() () from /usr/lib64/libQtCore.so.4
#31 0x0000000000465d0a in runKMyMoney (splash=splash@entry=0x1e4b840, a=0x1c27cd0) at /home/thb/devel/kmymoney/kmymoney/main.cpp:283
#32 0x0000000000463825 in main (argc=1, argv=0x7ffe33facd28) at /home/thb/devel/kmymoney/kmymoney/main.cpp:182

Comment 1 Christian David 2015-06-28 15:53:17 UTC

Git commit 7c73d6f78dea63279abbd50714b58d372e3ec3ea by Christian Dávid.
Committed on 28/06/2015 at 15:46.
Pushed by christiand into branch 'master'.

Prevent potential use after free

Maybe there is a use after free issue. I could not trigger it but it
should be there.

M  +2    -2    kmymoney/plugins/onlinetasks/sepa/ui/sepacredittransferedit.cpp
M  +1    -1    kmymoney/views/kpayeeidentifierview.cpp

http://commits.kde.org/kmymoney/7c73d6f78dea63279abbd50714b58d372e3ec3ea

Comment 2 Christian David 2015-06-28 16:55:40 UTC

Do you have an idea why I could not reproduce this issues?

Comment 3 Thomas Baumgart 2015-06-28 17:31:55 UTC

Different Qt environment? I am on 4.8.5 here.