| Summary: | kbibtex crashes when editing element | ||
|---|---|---|---|
| Product: | [Applications] KBibTeX | Reporter: | Cor Blom <cornelis> |
| Component: | General | Assignee: | Thomas Fischer <fischer> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | Keywords: | drkonqi |
| Priority: | NOR | ||
| Version: | 0.8.1 | ||
| Target Milestone: | --- | ||
| Platform: | openSUSE | ||
| OS: | Linux | ||
| Latest Commit: | https://commits.kde.org/kbibtex/bddb06c5cec1d5b6e22b423f2485825261ad8f49 | Version Fixed In: | 0.8.2 |
|
Description
Cor Blom
2018-09-01 22:00:33 UTC
KBibTeX does not crash for me, but an analysis with Valgrind revealed some invalid memory accesses. This requires some deeper investigation ... 113 errors in context 2069 of 2772: Thread 1 kbibtex: Invalid read of size 8 at 0x145AFB14: operator<(QString const&, QString const&) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x9177814: bool qMapLessThanKey<QString>(QString const&, QString const&) (qmap.h:71) by 0x917804F: QMapNode<QString, Value>::lowerBound(QString const&) (qmap.h:155) by 0x9177AEF: QMapData<QString, Value>::findNode(QString const&) const (qmap.h:287) by 0x91772A4: QMap<QString, Value>::remove(QString const&) (qmap.h:937) by 0x9175490: Entry::remove(QString const&) (entry.cpp:174) by 0x50D7013: EntryConfiguredWidget::apply(QSharedPointer<Element>) const (elementwidgets.cpp:111) by 0x50D2990: ElementEditor::ElementEditorPrivate::switchTo(QWidget*) (elementeditor.cpp:422) by 0x50CF0C2: ElementEditor::tabChanged() (elementeditor.cpp:591) by 0x50D68C0: QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (ElementEditor::*)()>::call(void (ElementEditor::*)(), ElementEditor*, void**) (qobjectdefs_impl.h:136) by 0x50D61CF: void QtPrivate::FunctionPointer<void (ElementEditor::*)()>::call<QtPrivate::List<>, void>(void (ElementEditor::*)(), ElementEditor*, void**) (qobjectdefs_impl.h:169) by 0x50D5784: QtPrivate::QSlotObject<void (ElementEditor::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (qobject_impl.h:120) by 0x1470B16D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x138CEC4D: QTabWidget::currentChanged(int) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138D1046: ??? (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x1470AE18: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x138B02CD: QTabBar::currentChanged(int) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138B4A74: QTabBar::setCurrentIndex(int) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138B71AF: QTabBar::mousePressEvent(QMouseEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x137419FE: QWidget::event(QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138B5622: QTabBar::event(QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x13701D6B: QApplicationPrivate::notify_helper(QObject*, QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x1370A436: QApplication::notify(QObject*, QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x146E2259: QCoreApplication::notifyInternal2(QObject*, QEvent*) (in /usr/lib64/libQt5Core.so.5.9.6) Address 0x46587998 is 24 bytes inside a block of size 48 free'd at 0x4C2E13B: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) by 0x1459871A: QMapDataBase::freeNodeAndRebalance(QMapNodeBase*) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x9177B8E: QMapData<QString, Value>::deleteNode(QMapNode<QString, Value>*) (qmap.h:280) by 0x91772C5: QMap<QString, Value>::remove(QString const&) (qmap.h:938) by 0x9175490: Entry::remove(QString const&) (entry.cpp:174) by 0x50D7013: EntryConfiguredWidget::apply(QSharedPointer<Element>) const (elementwidgets.cpp:111) by 0x50D2990: ElementEditor::ElementEditorPrivate::switchTo(QWidget*) (elementeditor.cpp:422) by 0x50CF0C2: ElementEditor::tabChanged() (elementeditor.cpp:591) by 0x50D68C0: QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (ElementEditor::*)()>::call(void (ElementEditor::*)(), ElementEditor*, void**) (qobjectdefs_impl.h:136) by 0x50D61CF: void QtPrivate::FunctionPointer<void (ElementEditor::*)()>::call<QtPrivate::List<>, void>(void (ElementEditor::*)(), ElementEditor*, void**) (qobjectdefs_impl.h:169) by 0x50D5784: QtPrivate::QSlotObject<void (ElementEditor::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (qobject_impl.h:120) by 0x1470B16D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x138CEC4D: QTabWidget::currentChanged(int) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138D1046: ??? (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x1470AE18: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x138B02CD: QTabBar::currentChanged(int) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138B4A74: QTabBar::setCurrentIndex(int) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138B71AF: QTabBar::mousePressEvent(QMouseEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x137419FE: QWidget::event(QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x138B5622: QTabBar::event(QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x13701D6B: QApplicationPrivate::notify_helper(QObject*, QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x1370A436: QApplication::notify(QObject*, QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x146E2259: QCoreApplication::notifyInternal2(QObject*, QEvent*) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x13708B5C: QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) (in /usr/lib64/libQt5Widgets.so.5.9.6) Block was alloc'd at at 0x4C2CF0F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) by 0x145989C0: QMapDataBase::createNode(int, int, QMapNodeBase*, bool) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x9177A59: QMapData<QString, Value>::createNode(QString const&, Value const&, QMapNode<QString, Value>*, bool) (qmap.h:225) by 0x91770B8: QMap<QString, Value>::insert(QString const&, Value const&) (qmap.h:716) by 0x9174EB4: Entry::operator=(Entry const&) (entry.cpp:113) by 0x9174CD6: Entry::Entry(Entry const&) (entry.cpp:92) by 0x50D1E57: ElementEditor::ElementEditorPrivate::reset(QSharedPointer<Element const>) (elementeditor.cpp:340) by 0x50D1C9A: ElementEditor::ElementEditorPrivate::reset() (elementeditor.cpp:322) by 0x50CEC41: ElementEditor::setElement(QSharedPointer<Element>, File const*) (elementeditor.cpp:531) by 0x50B71CC: FileView::editElement(QSharedPointer<Element>) (fileview.cpp:131) by 0x45A35E5B: QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QSharedPointer<Element> >, void, bool (FileView::*)(QSharedPointer<Element>)>::call(bool (FileView::*)(QSharedPointer<Element>), FileView*, void**) (qobjectdefs_impl.h:136) by 0x45A35039: void QtPrivate::FunctionPointer<bool (FileView::*)(QSharedPointer<Element>)>::call<QtPrivate::List<QSharedPointer<Element> >, void>(bool (FileView::*)(QSharedPointer<Element>), FileView*, void**) (qobjectdefs_impl.h:169) by 0x45A34090: QtPrivate::QSlotObject<bool (FileView::*)(QSharedPointer<Element>), QtPrivate::List<QSharedPointer<Element> >, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (qobject_impl.h:120) by 0x1470B16D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x512C89F: FileView::elementExecuted(QSharedPointer<Element>) (moc_fileview.cpp:284) by 0x50B7D36: FileView::itemActivated(QModelIndex const&) (fileview.cpp:286) by 0x50BADCF: QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QModelIndex const&>, void, void (FileView::*)(QModelIndex const&)>::call(void (FileView::*)(QModelIndex const&), FileView*, void**) (qobjectdefs_impl.h:136) by 0x50BA9A6: void QtPrivate::FunctionPointer<void (FileView::*)(QModelIndex const&)>::call<QtPrivate::List<QModelIndex const&>, void>(void (FileView::*)(QModelIndex const&), FileView*, void**) (qobjectdefs_impl.h:169) by 0x50BA166: QtPrivate::QSlotObject<void (FileView::*)(QModelIndex const&), QtPrivate::List<QModelIndex const&>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (qobject_impl.h:120) by 0x1470B16D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQt5Core.so.5.9.6) by 0x13949594: QAbstractItemView::doubleClicked(QModelIndex const&) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x139BD4F7: QTreeView::mouseDoubleClickEvent(QMouseEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x137419B6: QWidget::event(QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) by 0x137E6FDD: QFrame::event(QEvent*) (in /usr/lib64/libQt5Widgets.so.5.9.6) I think I have fixed the problem, at least Valgrind no longer reports a memory issue in this context. Please test and confirm yourself. The code is in my personal clone of the KBibTeX repository, not (yet) in the official one: https://commits.kde.org/clones/kbibtex/thomasfischer/kbibtex/bddb06c5cec1d5b6e22b After applying the patch kbibtex works fine and does not crash. Thanks. Git commit bddb06c5cec1d5b6e22b423f2485825261ad8f49 by Thomas Fischer. Committed on 11/09/2018 at 21:04. Pushed by thomasfischer into branch 'kbibtex/0.8'. Fixing conflict btwn iterating over QMap and removing element Iterating over a QMap<K,V> object and then for one selected element stopping the iteration and removing this element using the key, i.e. QMap<K,V>::remove(key) interferes with the map's internal memory management and may lead to crashes. To avoid interference, better to remove the selected element using the iterator directly, i.e. QMap<K,V>::erase(it). FIXED-IN: 0.8.2 M +5 -3 src/data/entry.cpp M +1 -0 src/test/CMakeLists.txt https://commits.kde.org/kbibtex/bddb06c5cec1d5b6e22b423f2485825261ad8f49 Git commit 6a7de90d7bbe84be71f7195f513bb78350954265 by Thomas Fischer. Committed on 12/09/2018 at 18:02. Pushed by thomasfischer into branch 'master'. Fixing conflict btwn iterating over QMap and removing element Iterating over a QMap<K,V> object and then for one selected element stopping the iteration and removing this element using the key, i.e. QMap<K,V>::remove(key) interferes with the map's internal memory management and may lead to crashes. To avoid interference, better to remove the selected element using the iterator directly, i.e. QMap<K,V>::erase(it). M +5 -3 src/data/entry.cpp M +25 -0 src/test/CMakeLists.txt A +61 -0 src/test/kbibtexdatatest.cpp [License: GPL (v2+)] https://commits.kde.org/kbibtex/6a7de90d7bbe84be71f7195f513bb78350954265 |