Bug 383127

Created attachment 109128 [details]
New crash information added by DrKonqi

ktorrent (5.1.0) using Qt 5.9.2

- What I was doing when the application crashed:

Once the torrent list was emptied, I quit KTorrent from the File Menu. The crash is reproducible sometimes.

-- Backtrace (Reduced):
#6  bt::TorrentInterface::getDisplayName (this=0x556d28d53640) at /usr/include/KF5/libktorrent/interfaces/torrentinterface.h:426
#7  kt::QueueManagerModel::data (this=<optimized out>, index=..., role=<optimized out>) at /usr/src/debug/ktorrent-5.1.0/ktorrent/tools/queuemanagermodel.cpp:235
#8  0x00007f5347063776 in QStyledItemDelegate::initStyleOption(QStyleOptionViewItem*, QModelIndex const&) const () from /usr/lib64/libQt5Widgets.so.5
#9  0x00007f5347062cd9 in QStyledItemDelegate::sizeHint(QStyleOptionViewItem const&, QModelIndex const&) const () from /usr/lib64/libQt5Widgets.so.5
#10 0x00007f53470a32ca in QTreeView::indexRowSizeHint(QModelIndex const&) const () from /usr/lib64/libQt5Widgets.so.5

*** Bug 387669 has been marked as a duplicate of this bug. ***

*** Bug 384476 has been marked as a duplicate of this bug. ***

*** Bug 387754 has been marked as a duplicate of this bug. ***

*** Bug 385766 has been marked as a duplicate of this bug. ***

*** Bug 385543 has been marked as a duplicate of this bug. ***

Created attachment 109528 [details]
New crash information added by DrKonqi

ktorrent (5.1.0) using Qt 5.9.3

- What I was doing when the application crashed:

Removed the torrent that had finished downloading and closed the application via the tray icon context menu.

-- Backtrace (Reduced):
#7  0x00007f9ee8597136 in QModelIndex::data (arole=0, this=0x7fff546863e0) at ../../include/QtCore/../../src/corelib/itemmodels/qabstractitemmodel.h:432
#8  QStyledItemDelegate::initStyleOption (this=0x1440a20, option=0x7fff54686270, index=...) at itemviews/qstyleditemdelegate.cpp:345
#9  0x00007f9ee85965ef in QStyledItemDelegate::sizeHint (this=0x1440a20, option=..., index=...) at itemviews/qstyleditemdelegate.cpp:410
#10 0x00007f9ee85dbf31 in QTreeView::indexRowSizeHint (this=this@entry=0x13f6bb0, index=...) at itemviews/qtreeview.cpp:2987
#11 0x00007f9ee85dc946 in QTreeViewPrivate::layout (this=this@entry=0x142b3b0, i=i@entry=-1, recursiveExpanding=recursiveExpanding@entry=false, afterIsUninitialized=afterIsUninitialized@entry=false) at itemviews/qtreeview.cpp:3321

*** Bug 387945 has been marked as a duplicate of this bug. ***

*** Bug 387927 has been marked as a duplicate of this bug. ***

*** Bug 385761 has been marked as a duplicate of this bug. ***

Created attachment 109780 [details]
New crash information added by DrKonqi

ktorrent (5.1.0) using Qt 5.10.0

- Unusual behavior I noticed:
- Everytime I close ktorrent
- For every update of the app

-- Backtrace (Reduced):
#6  0x00007f575972c43d in QVariant::QVariant(QString const&) () from /usr/lib64/libQt5Core.so.5
#7  0x00005603f82dbf9c in kt::ViewModel::Item::data (this=0x5603f92bf480, col=<optimized out>) at /usr/src/debug/ktorrent-5.1.0/ktorrent/view/viewmodel.cpp:255
#8  0x00005603f82dde0d in kt::ViewModel::data (this=<optimized out>, index=..., role=<optimized out>) at /usr/src/debug/ktorrent-5.1.0/ktorrent/view/viewmodel.cpp:648
#9  0x00007f575a6ba7c6 in QStyledItemDelegate::initStyleOption(QStyleOptionViewItem*, QModelIndex const&) const () from /usr/lib64/libQt5Widgets.so.5
#10 0x00007f575a6b9d29 in QStyledItemDelegate::sizeHint(QStyleOptionViewItem const&, QModelIndex const&) const () from /usr/lib64/libQt5Widgets.so.5

*** Bug 390157 has been marked as a duplicate of this bug. ***

*** Bug 389915 has been marked as a duplicate of this bug. ***

Created attachment 111024 [details]
New crash information added by DrKonqi

ktorrent (5.1.0) using Qt 5.10.0

I originally reported the bug and am now supplying a more detailed backtrace which includes the Qt libraries.

-- Backtrace (Reduced):
#6  bt::TorrentInterface::getDisplayName (this=0x564f7f4b1510) at /usr/include/KF5/libktorrent/interfaces/torrentinterface.h:426
#7  kt::QueueManagerModel::data (this=<optimized out>, index=..., role=<optimized out>) at /usr/src/debug/ktorrent-5.1.0-2.1.x86_64/ktorrent/tools/queuemanagermodel.cpp:235
#8  0x00007f23a491bdb6 in QModelIndex::data (arole=0, this=0x7fff95c6f570) at ../../include/QtCore/../../src/corelib/itemmodels/qabstractitemmodel.h:432
#9  QStyledItemDelegate::initStyleOption (this=0x564f7ebd3390, option=0x7fff95c6f400, index=...) at itemviews/qstyleditemdelegate.cpp:345
#10 0x00007f23a491b319 in QStyledItemDelegate::sizeHint (this=0x564f7ebd3390, option=..., index=...) at itemviews/qstyleditemdelegate.cpp:410

Created attachment 111054 [details]
New crash information added by DrKonqi

ktorrent (5.1.0) using Qt 5.10.0

And once more, with apparently a slightly different backtrace.

-- Backtrace (Reduced):
#6  _mm_movemask_epi8(long long __vector(2)) (__A=...) at /usr/lib64/gcc/x86_64-suse-linux/7/include/emmintrin.h:1396
#7  findChar (str=0xab24726070d0, len=<optimized out>, ch=..., from=from@entry=0, cs=cs@entry=Qt::CaseSensitive) at tools/qstring.cpp:866
#8  0x00007f63d852bc48 in QString::indexOf (this=<optimized out>, ch=..., from=from@entry=0, cs=cs@entry=Qt::CaseSensitive) at tools/qstring.cpp:3369
#9  0x00007f63d852bc87 in QString::replace (this=this@entry=0x7fff7814ce60, before=before@entry=..., after=after@entry=..., cs=cs@entry=Qt::CaseSensitive) at tools/qstring.cpp:2817
#10 0x00007f63d965f7ad in QAbstractItemDelegatePrivate::textForRole (this=<optimized out>, role=role@entry=Qt::DisplayRole, value=..., locale=..., precision=precision@entry=6) at itemviews/qabstractitemdelegate.cpp:597

Created attachment 111449 [details]
New crash information added by DrKonqi

ktorrent (5.1.0) using Qt 5.10.0

Another backtrace.
Again, the output keeps on changing.

-- Backtrace (Reduced):
#6  QChar::isSurrogate (this=<optimized out>) at ../../../include/QtCore/../../src/corelib/tools/qchar.h:460
#7  QStringIterator::next (invalidAs=65533, this=<synthetic pointer>, this=<synthetic pointer>) at ../../../include/QtCore/5.10.0/QtCore/private/../../../../../src/corelib/tools/qstringiterator_p.h:168
#8  QFontEngineFT::stringToCMap (this=0x55c36bb8a080, str=<optimized out>, len=<optimized out>, glyphs=0x7ffc3f858710, nglyphs=0x7ffc3f8586fc, flags=...) at freetype/qfontengine_ft.cpp:1733
#9  0x00007fad2e7f76e2 in QFontEngineMulti::stringToCMap (this=0x55c36b966620, str=0x56326c978af5, len=3, glyphs=0x7ffc3f858710, nglyphs=0x7ffc3f8586fc, flags=...) at text/qfontengine.cpp:1896
#10 0x00007fad2e81849c in QTextEngine::shapeText (this=this@entry=0x55c36b8bcc30, item=item@entry=13) at text/qtextengine.cpp:1050

*** This bug has been confirmed by popular vote. ***

*** Bug 393572 has been marked as a duplicate of this bug. ***

*** Bug 393785 has been marked as a duplicate of this bug. ***

*** Bug 392831 has been marked as a duplicate of this bug. ***

*** Bug 394111 has been marked as a duplicate of this bug. ***

*** Bug 395907 has been marked as a duplicate of this bug. ***

Created attachment 114174 [details]
New crash information added by DrKonqi

ktorrent (5.1.0) using Qt 5.10.1

- What I was doing when the application crashed:
I was closeing Ktorrent from system Plasma tray

-- Backtrace (Reduced):
#6  0x00007f3901601d93 in findChar(QChar const*, int, QChar, int, Qt::CaseSensitivity) () from /lib64/libQt5Core.so.5
#7  0x00007f39016065da in QString::replace(QChar, QChar, Qt::CaseSensitivity) () from /lib64/libQt5Core.so.5
#8  0x00007f390227b029 in QAbstractItemDelegatePrivate::textForRole(Qt::ItemDataRole, QVariant const&, QLocale const&, int) const () from /lib64/libQt5Widgets.so.5
#9  0x00007f39022822b3 in QStyledItemDelegate::displayText(QVariant const&, QLocale const&) const () from /lib64/libQt5Widgets.so.5
#10 0x00007f3902283c6e in QStyledItemDelegate::initStyleOption(QStyleOptionViewItem*, QModelIndex const&) const () from /lib64/libQt5Widgets.so.5

To anyone still having this issue, do you use "scan folders" plugin and does disabling it fix the crash on exit (or it crashes ktorrent too when you disable the plugin)?

*** Bug 397327 has been marked as a duplicate of this bug. ***

(In reply to Valeriy Malov from comment #24)
> To anyone still having this issue, do you use "scan folders" plugin and does
> disabling it fix the crash on exit (or it crashes ktorrent too when you
> disable the plugin)?

Not using the Scan Folder plugin, and getting crashes on shutdown with the exact same stack trace of comment #23.

*** Bug 398145 has been marked as a duplicate of this bug. ***

*** Bug 399330 has been marked as a duplicate of this bug. ***

*** Bug 399411 has been marked as a duplicate of this bug. ***

*** Bug 400392 has been marked as a duplicate of this bug. ***

*** Bug 403016 has been marked as a duplicate of this bug. ***

Created attachment 118516 [details]
New crash information added by DrKonqi

ktorrent (5.1.1) using Qt 5.11.3

Worth mention:
Connecting through local OpenVPN server running on BananaPiM!+ with 4096 encryption.
Torrents are set to be moved to NAS running on RaspberryPi3+ mounted with sshfs to local machine where error accured using using the same OVPN connection..

When a large file is moved between RPI NAS and local machine through OVPN its very slow and it sometimes make all the KDE slow when seraching files or browsig folders in Dolphin. To boost local machine i trid to close Ktorrent from the task bar => close. At the time 3 files where copied.

-- Backtrace (Reduced):
#6  _mm_movemask_epi8(long long __vector(2)) (__A=...) at /usr/lib/gcc/x86_64-linux-gnu/8/include/emmintrin.h:1305
#7  findChar (str=0xaacf3c584430, len=<optimized out>, ch=..., from=from@entry=0, cs=cs@entry=Qt::CaseSensitive) at tools/qstring.cpp:1049
#8  0x00007f5c42b77328 in QString::indexOf (this=<optimized out>, ch=..., from=from@entry=0, cs=cs@entry=Qt::CaseSensitive) at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:206
#9  0x00007f5c42b77367 in QString::replace (this=this@entry=0x7ffc6dccd850, before=before@entry=..., after=after@entry=..., cs=cs@entry=Qt::CaseSensitive) at tools/qstring.cpp:3031
#10 0x00007f5c4388ad4f in QAbstractItemDelegatePrivate::textForRole (this=<optimized out>, role=role@entry=Qt::DisplayRole, value=..., locale=..., precision=precision@entry=6) at ../../include/QtCore/../../src/corelib/tools/qchar.h:88

Created attachment 118522 [details]
New crash information added by DrKonqi

ktorrent (5.1.1) using Qt 5.11.3

Ktorrent crushed while closing but just before I closed it i removed a couple of finished torrents from the list.

-- Backtrace (Reduced):
#13 0x00007f08b42c8b28 in QTextEngine::itemize() const () from /lib/x86_64-linux-gnu/libQt5Gui.so.5
#14 0x00007f08b42d006c in QTextLayout::beginLayout() () from /lib/x86_64-linux-gnu/libQt5Gui.so.5
#15 0x00007f08b482c21f in viewItemTextLayout (textLayout=..., lineWidth=8388607) at styles/qcommonstyle.cpp:850
#16 0x00007f08b482f6e2 in QCommonStylePrivate::viewItemSize (this=this@entry=0x55c263558660, option=option@entry=0x7ffdf4b0c240, role=role@entry=0) at styles/qcommonstyle.cpp:909
#17 0x00007f08b482ffb8 in QCommonStylePrivate::viewItemLayout (this=0x55c263558660, opt=opt@entry=0x7ffdf4b0c240, checkRect=checkRect@entry=0x7ffdf4b0c180, pixmapRect=pixmapRect@entry=0x7ffdf4b0c160, textRect=textRect@entry=0x7ffdf4b0c170, sizehint=sizehint@entry=true) at styles/qcommonstyle.cpp:1006

*** Bug 404670 has been marked as a duplicate of this bug. ***

*** Bug 405407 has been marked as a duplicate of this bug. ***

Created attachment 119080 [details]
New crash information added by DrKonqi

ktorrent (5.1.1) using Qt 5.12.2

- What I was doing when the application crashed:

I clicked File->Quit from the main window. The app appeared to exit properly. 5-10 seconds later the KCrash report appeared.

Application state:
~9 torrents seeding
~2 torrents downloading
~5 torrents in queue to download
Speed limit Download: No Limit
Speed limit Upload: 30 KiB/s
Plugins enabled: UPnP (connected by wifi, static ip, no ipv6, dns: 1.1.1.1/1.0.0.1, netgear R8000 router)

Fresh install of OpenSUSE Tumbleweed yesterday.

I am willing to help test/debug this. Feel free to send me a note if I can be of service. In the mean time, I'm going to start following the stack traces around the source.

-- Backtrace (Reduced):
#6  std::__atomic_base<int>::load (__m=std::memory_order_relaxed, this=0x74746366) at /usr/include/c++/8/bits/atomic_base.h:390
#7  QAtomicOps<int>::load<int> (_q_value=...) at ../../include/QtCore/../../src/corelib/thread/qatomic_cxx11.h:227
#8  QBasicAtomicInteger<int>::load (this=0x74746366) at ../../include/QtCore/../../src/corelib/thread/qbasicatomic.h:103
[...]
#10 QString::QString (other=..., this=0x7ffc597c3f50) at ../../include/QtCore/../../src/corelib/tools/qstring.h:958
#11 v_construct_helper<QString> (t=..., x=0x7ffc597c3f50) at ../../include/QtCore/5.12.2/QtCore/private/../../../../../src/corelib/kernel/qvariant_p.h:123

*** Bug 406026 has been marked as a duplicate of this bug. ***

*** Bug 408406 has been marked as a duplicate of this bug. ***

*** Bug 408759 has been marked as a duplicate of this bug. ***

*** Bug 410334 has been marked as a duplicate of this bug. ***

Created attachment 121845 [details]
New crash information added by DrKonqi

ktorrent (5.1.1) using Qt 5.13.0

- What I was doing when the application crashed:

I had several torrents opened and I quited KTorrent. Then CPU usage peaked to 90% and KTorrent crashed.

-- Backtrace (Reduced):
#7  0x00007ffacf7a5749 in memcpy (__len=65524, __src=<optimized out>, __dest=<optimized out>) at /usr/include/bits/string_fortified.h:34
#8  QString::reallocData (this=0x7ffdb5308b90, alloc=<optimized out>, grow=<optimized out>) at tools/qstring.cpp:2382
[...]
#10 QString::replace (this=this@entry=0x7ffdb5308b90, before=before@entry=..., after=after@entry=..., cs=cs@entry=Qt::CaseSensitive) at tools/qstring.cpp:3282
#11 0x00007ffad05a4667 in QAbstractItemDelegatePrivate::textForRole (this=<optimized out>, role=role@entry=Qt::DisplayRole, value=..., locale=..., precision=precision@entry=6) at ../../include/QtCore/../../src/corelib/tools/qchar.h:88
#12 0x00007ffad05abc20 in QStyledItemDelegate::displayText (this=<optimized out>, value=..., locale=...) at itemviews/qstyleditemdelegate.h:99

*** Bug 411222 has been marked as a duplicate of this bug. ***

*** Bug 411002 has been marked as a duplicate of this bug. ***

Git commit b819ef6a35495e12a204cbb241cdb2502c4cd11e by Valerii Malov.
Committed on 29/09/2019 at 20:31.
Pushed by valeriymalov into branch '5.1'.

Cleanup ViewModel a bit and try to fix crash on exit

Summary:
removeTorrent makes changes to torrent list we are currently iterating
on per-item basis, this causees heap-use-after-free in onExit
Just call removeRows which should be functionally the same, but should
delete all items in one batch

Compact ViewModel::Item::update
Fix a few warnings (0 as nullptr, c-style casts)
Remove useless ViewModel::torrentFromIndex variant
Remove unused headers
add CMakeLists.txt.user to gitignore

Test Plan: build with asan, run & exit, see asan stacktrace before changing onExit

Reviewers: stikonas

Differential Revision: https://phabricator.kde.org/D24149

M  +1    -0    .gitignore
M  +1    -0    ktorrent/CMakeLists.txt
M  +51   -146  ktorrent/view/viewmodel.cpp
M  +10   -11   ktorrent/view/viewmodel.h

https://commits.kde.org/ktorrent/b819ef6a35495e12a204cbb241cdb2502c4cd11e

Would anybody be able to compile this and check if crash on exit is fixed?

I was never able to reproduce it.

I can confirm that this bug has been fixed.

Built from master, there are no crashes.
Built from master with the above patch reverted, the crash occurs again.

When trying to reproduce the bug, I noticed that it occurs if the .local/share/ktorrent/ directory contains at least three subdirectories starting with "tor", e.g. "tor0", "tor1", "tor2".

*** Bug 392256 has been marked as a duplicate of this bug. ***

*** Bug 405610 has been marked as a duplicate of this bug. ***

*** Bug 415247 has been marked as a duplicate of this bug. ***

*** Bug 415645 has been marked as a duplicate of this bug. ***

*** Bug 416518 has been marked as a duplicate of this bug. ***

For me the bug is fixed, no crash when closing ktorrent (version 5.1.2). 

Operating System: Gentoo Linux 
KDE Plasma Version: 5.18.4
KDE Frameworks Version: 5.69.0
Qt Version: 5.14.1
Kernel Version: 5.6.5-gentoo-nvidia
OS Type: 64-bit

Thanks for the update; changing status.

The fix is not in v5.1.2, but might have been backported by the distribution. See comment 44 for the commit.

(In reply to Christoph Feck from comment #53)
> Thanks for the update; changing status.
> 
> The fix is not in v5.1.2, but might have been backported by the
> distribution. See comment 44 for the commit.

Maybe it's time to schedule KTorrent 5.2? I think it also was ported away from QtWebkit.

*** Bug 422071 has been marked as a duplicate of this bug. ***

*** Bug 423523 has been marked as a duplicate of this bug. ***

Created attachment 135931 [details]
New crash information added by DrKonqi

ktorrent (20.12.2) using Qt 5.15.2

- What I was doing when the application crashed:

After pressing Ctrl+Q to exit it, I got notified of the crash.

-- Backtrace (Reduced):
#5  0x000055da6cae7fe6 in kt::ViewModel::Item::color (this=0x55da6dc46550, col=<optimized out>) at ./ktorrent/view/viewmodel.cpp:238
#6  0x000055da6cae999d in kt::ViewModel::data (this=<optimized out>, index=..., role=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qabstractitemmodel.h:63
#7  0x00007ff7174b05d7 in QModelIndex::data (arole=9, this=0x7ffc2d577180) at ../../include/QtCore/../../src/corelib/itemmodels/qabstractitemmodel.h:460
#8  QStyledItemDelegate::initStyleOption (this=0x55da7252c3d0, option=0x7ffc2d577010, index=...) at itemviews/qstyleditemdelegate.cpp:291
#9  0x00007ff7174afcf7 in QStyledItemDelegate::sizeHint (this=0x55da7252c3d0, option=..., index=...) at itemviews/qstyleditemdelegate.cpp:410