Bug 401733

*** Bug 401746 has been marked as a duplicate of this bug. ***

Git commit 3695e0b0dc81451f40615c00ae46bcaac6c2952d by Kai Uwe Broulik.
Committed on 07/12/2018 at 13:48.
Pushed by broulik into branch 'master'.

Initialize m_metaData

A new KFileMetaData::UserMetaData is only created when a single file is selected.
If more files are selected, we will call delete on garbage memory in the destructor and crash.
Calling delete on a nullptr is safe.

Differential Revision: https://phabricator.kde.org/D17348

M  +1    -1    src/tagsfileitemactionplugin/tagsfileitemaction.h

https://commits.kde.org/baloo-widgets/3695e0b0dc81451f40615c00ae46bcaac6c2952d

I see the same crash with the same stacktrace after an update.

Note that the fix was made to "baloo-widgets" repository, not Dolphin. Did you also rebuild that?

(In reply to Christoph Feck from comment #4)
> Note that the fix was made to "baloo-widgets" repository, not Dolphin. Did
> you also rebuild that?

Yes and killed all Dolphin processes.

Might be related: Dolphin show a few tags in the side panel, but when I click any of them that results in the empty file list.

(In reply to Eugene Shalygin from comment #6)
> Might be related: Dolphin show a few tags in the side panel, but when I
> click any of them that results in the empty file list.

Tags in the Places panel were reverted, please rebuild KIO and try again.

I recompiled all installed KDE packages, and the tags in the side panel are still shown. However, their list do not change when I tag new files. Dolphin was crashing with the same stack trace until I deleted Baloo database in the home directory. But the tags are still there.

Please check whether your ~/.local/share/user-places.xbel file contains those tags.

(In reply to Elvis Angelaccio from comment #9)
> Please check whether your ~/.local/share/user-places.xbel file contains
> those tags.

Thanks, deleted them.

Returning to the bug, I report that after enabling file file search and Baloo finished its indexing, Dolphin returned to crashing again.

(In reply to Eugene Shalygin from comment #10)
> Returning to the bug, I report that after enabling file file search and
> Baloo finished its indexing, Dolphin returned to crashing again.

Is the backtrace the same as in the first comment?

(In reply to Elvis Angelaccio from comment #11)
> Is the backtrace the same as in the first comment?

Seems to be the same. Here is it:

[KCrash Handler]
#5  KFileMetaData::UserMetaData::tags (this=<optimized out>) at /usr/src/debug/kde-frameworks/kfilemetadata-9999/kfilemetadata-9999/src/usermetadata.cpp:75
#6  0x00007f1504037bf9 in QtPrivate::QFunctorSlotObject<TagsFileItemAction::TagsFileItemAction(QObject*, QList<QVariant> const&)::{lambda(QUrl const&, KFileItemList const&)#2}, 2, QtPrivate::List<QUrl const&, KFileItemList const&>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) () from /usr/lib64/qt5/plugins/kf5/kfileitemaction/tagsfileitemaction.so
#7  0x00007f1510737f5e in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib64/libQt5Core.so.5
#8  0x00007f151212f081 in KCoreDirLister::itemsAdded(QUrl const&, KFileItemList const&) () from /usr/lib64/libKF5KIOCore.so.5
#9  0x00007f1512133b2f in KCoreDirLister::Private::emitItems() () from /usr/lib64/libKF5KIOCore.so.5
#10 0x00007f151213dd3c in KCoreDirListerCache::slotEntries(KIO::Job*, QList<KIO::UDSEntry> const&) () from /usr/lib64/libKF5KIOCore.so.5
#11 0x00007f1510737f5e in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib64/libQt5Core.so.5
#12 0x00007f15121731c4 in KIO::ListJob::entries(KIO::Job*, QList<KIO::UDSEntry> const&) () from /usr/lib64/libKF5KIOCore.so.5
#13 0x00007f151217b550 in QtPrivate::QFunctorSlotObject<KIO::ListJobPrivate::start(KIO::Slave*)::{lambda(QList<KIO::UDSEntry> const&)#2}, 1, QtPrivate::List<QList<KIO::UDSEntry> const&>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) () from /usr/lib64/libKF5KIOCore.so.5
#14 0x00007f1510737f5e in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib64/libQt5Core.so.5
#15 0x00007f151217c2f5 in KIO::SlaveInterface::listEntries(QList<KIO::UDSEntry> const&) () from /usr/lib64/libKF5KIOCore.so.5
#16 0x00007f1512185370 in KIO::SlaveInterface::dispatch(int, QByteArray const&) () from /usr/lib64/libKF5KIOCore.so.5
#17 0x00007f1512181eda in KIO::Slave::gotInput() () from /usr/lib64/libKF5KIOCore.so.5
#18 0x00007f1510737f5e in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib64/libQt5Core.so.5
#19 0x00007f15121be14b in KIO::ConnectionPrivate::dequeue() [clone .part.22] () from /usr/lib64/libKF5KIOCore.so.5
#20 0x00007f151073d9ef in QObject::event(QEvent*) () from /usr/lib64/libQt5Core.so.5
#21 0x00007f1511547171 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#22 0x00007f1511557d80 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#23 0x00007f151075cde8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib64/libQt5Core.so.5
#24 0x00007f151075cf68 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/lib64/libQt5Core.so.5
#25 0x00007f1510714bf3 in postEventSourceDispatch(_GSource*, int (*)(void*), void*) () from /usr/lib64/libQt5Core.so.5
#26 0x00007f150e068b3d in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#27 0x00007f150e069238 in g_main_context_iterate.isra () from /usr/lib64/libglib-2.0.so.0
#28 0x00007f150e0693ac in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
#29 0x00007f151070d163 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQt5Core.so.5
#30 0x00007f151075d3cb in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQt5Core.so.5
#31 0x00007f15113ff7c1 in QMenu::exec(QPoint const&, QAction*) () from /usr/lib64/libQt5Widgets.so.5
#32 0x00007f1512ce01c7 in DolphinMainWindow::openContextMenu(QPoint const&, KFileItem const&, QUrl const&, QList<QAction*> const&) () from /usr/lib64/libkdeinit5_dolphin.so
#33 0x00007f1510737f5e in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib64/libQt5Core.so.5
#34 0x00007f151262d92d in DolphinView::requestContextMenu(QPoint const&, KFileItem const&, QUrl const&, QList<QAction*> const&) () from /usr/lib64/libdolphinprivate.so.5
#35 0x00007f151264660e in DolphinView::slotItemContextMenuRequested(int, QPointF const&) () from /usr/lib64/libdolphinprivate.so.5
#36 0x00007f1510737f5e in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib64/libQt5Core.so.5
#37 0x00007f1512622056 in KItemListController::itemContextMenuRequested(int, QPointF const&) () from /usr/lib64/libdolphinprivate.so.5
#38 0x00007f151268469b in KItemListController::mousePressEvent(QGraphicsSceneMouseEvent*, QTransform const&) () from /usr/lib64/libdolphinprivate.so.5
#39 0x00007f1512686589 in KItemListController::processEvent(QEvent*, QTransform const&) () from /usr/lib64/libdolphinprivate.so.5
#40 0x00007f1512686656 in KItemListView::event(QEvent*) () from /usr/lib64/libdolphinprivate.so.5
#41 0x00007f1511547171 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#42 0x00007f1511557d80 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#43 0x00007f151075cde8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib64/libQt5Core.so.5
#44 0x00007f151127c068 in QGraphicsScenePrivate::sendEvent(QGraphicsItem*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#45 0x00007f151127c8df in QGraphicsScenePrivate::sendMouseEvent(QGraphicsSceneMouseEvent*) () from /usr/lib64/libQt5Widgets.so.5
#46 0x00007f151128763b in QGraphicsScenePrivate::mousePressEventHandler(QGraphicsSceneMouseEvent*) () from /usr/lib64/libQt5Widgets.so.5
#47 0x00007f1511267a09 in QGraphicsScene::mousePressEvent(QGraphicsSceneMouseEvent*) () from /usr/lib64/libQt5Widgets.so.5
#48 0x00007f151126f15f in QGraphicsScene::event(QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#49 0x00007f1511547171 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#50 0x00007f1511557d80 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#51 0x00007f151075cde8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib64/libQt5Core.so.5
#52 0x00007f151125419b in QGraphicsView::mousePressEvent(QMouseEvent*) () from /usr/lib64/libQt5Widgets.so.5
#53 0x00007f15115339ef in QWidget::event(QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#54 0x00007f1511489fae in QFrame::event(QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#55 0x00007f15112563db in QGraphicsView::viewportEvent(QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#56 0x00007f151075a9db in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) () from /usr/lib64/libQt5Core.so.5
#57 0x00007f1511547161 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#58 0x00007f1511558028 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#59 0x00007f151075cde8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib64/libQt5Core.so.5
#60 0x00007f151155ac47 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool, bool) () from /usr/lib64/libQt5Widgets.so.5
#61 0x00007f151150baaa in QWidgetWindow::event(QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#62 0x00007f1511547171 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#63 0x00007f1511557d80 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
#64 0x00007f151075cde8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib64/libQt5Core.so.5
#65 0x00007f1510c64fcc in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) () from /usr/lib64/libQt5Gui.so.5
#66 0x00007f1510f8d985 in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) () from /usr/lib64/libQt5Gui.so.5
#67 0x00007f1510f8dbba in QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQt5Gui.so.5
#68 0x00007f1508389d3a in xcbSourceDispatch(_GSource*, int (*)(void*), void*) [clone .lto_priv.464] () from /usr/lib64/libQt5XcbQpa.so.5
#69 0x00007f150e068b3d in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#70 0x00007f150e069238 in g_main_context_iterate.isra () from /usr/lib64/libglib-2.0.so.0
#71 0x00007f150e0693ac in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
#72 0x00007f151070d163 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQt5Core.so.5
#73 0x00007f151075d3cb in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQt5Core.so.5
#74 0x00007f151075d9f2 in QCoreApplication::exec() () from /usr/lib64/libQt5Core.so.5
#75 0x00007f1512ce6be9 in kdemain () from /usr/lib64/libkdeinit5_dolphin.so
#76 0x00007f15127034eb in __libc_start_main () from /lib64/libc.so.6
#77 0x0000561f17dff09a in _start ()

Hmm, it looks like you are still running the old tagsfileitemaction.so plugin (without the fix).

Please check again that the tagsfileitemaction.so library that dolphin loads is exactly the same you built from baloo-widgets master (you can check with strace).

(In reply to Elvis Angelaccio from comment #13)
> Hmm, it looks like you are still running the old tagsfileitemaction.so
> plugin (without the fix).
I have no idea how that could be possible.

> 
> Please check again that the tagsfileitemaction.so library that dolphin loads
> is exactly the same you built from baloo-widgets master (you can check with
> strace).

There are no other files with this name in my system except the one, belonging to the baloo-widgets package. Its git repo contain the commit 3695e0b0dc81451f40615c00ae46bcaac6c2952d by Kai Uwe Broulik.

Last question (then I'm out of ideas): please provide a valgrind log as described here: https://community.kde.org/Dolphin/FAQ/Crashes

(In reply to Elvis Angelaccio from comment #15)
> Last question (then I'm out of ideas): please provide a valgrind log as
> described here: https://community.kde.org/Dolphin/FAQ/Crashes

I build packages with -march=native and valgrind crashes on an unrecognized instruction. I will try to debug the issue myself. Thank you for the help!

*** Bug 406071 has been marked as a duplicate of this bug. ***

We got another crash report with this stacktrace. 

@Nicolas: could you have a look please?

(In reply to Elvis Angelaccio from comment #18)
> We got another crash report with this stacktrace. 
> 
> @Nicolas: could you have a look please?

I (OP of the duplicate) have rebuilt some packages with debugging enabled so this new log https://pastebin.com/EkF8M1xt should provide more info.

(In reply to mthw0 from comment #19)
> (In reply to Elvis Angelaccio from comment #18)
> > We got another crash report with this stacktrace. 
> > 
> > @Nicolas: could you have a look please?
> 
> I (OP of the duplicate) have rebuilt some packages with debugging enabled so
> this new log https://pastebin.com/EkF8M1xt should provide more info.

Please also rebuild kfilemetadata and baloo-widgets.

A valgrind log would also help.

kfilemetadata and baloo-widget rebuilt, log: https://pastebin.com/Gd6WFTAg
valgrind log: https://pastebin.com/XBztBRY1 and https://pastebin.com/JHfxV7eR 
I never used valgrind before so it might not be what you wanted

(In reply to mthw0 from comment #21)
> kfilemetadata and baloo-widget rebuilt, log: https://pastebin.com/Gd6WFTAg
> valgrind log: https://pastebin.com/XBztBRY1 and
> https://pastebin.com/JHfxV7eR 
> I never used valgrind before so it might not be what you wanted

This is useful, thanks. Relevant stacktrace:

Invalid read of size 8
==17208==    at 0x6E9C544: toLocal8Bit (qstring.h:554)
==17208==    by 0x6E9C544: encodeName (qfile.h:90)
==17208==    by 0x6E9C544: k_getxattr (xattr_p.h:58)
==17208==    by 0x6E9C544: KFileMetaData::UserMetaData::tags() const (usermetadata.cpp:75)
==17208==    by 0x15B7E502: operator() (tagsfileitemaction.cpp:53)
==17208==    by 0x15B7E502: call (qobjectdefs_impl.h:146)
==17208==    by 0x15B7E502: call<QtPrivate::List<const QUrl&, const KFileItemList&>, void> (qobjectdefs_impl.h:256)
==17208==    by 0x15B7E502: QtPrivate::QFunctorSlotObject<TagsFileItemAction::TagsFileItemAction(QObject*, QList<QVariant> const&)::{lambda(QUrl const&, KFileItemList const&)#2}, 2, QtPrivate::List<QUrl const&, KFileItemList const&>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (qobjectdefs_impl.h:439)
==17208==    by 0x15B801DF: ??? (in /usr/lib/qt/plugins/kf5/kfileitemaction/tagsfileitemaction.so)
==17208==    by 0x24954B9BE5C853FF: ???
==17208==    by 0x1101: ???
==17208==    by 0x24954B9BE5C853FF: ???
==17208==    by 0x1FFEFFD86F: ???
==17208==    by 0x1076A98F: ???
==17208==    by 0x1FFEFFD94F: ???
==17208==    by 0x13ED395F: ???
==17208==    by 0x108E8A5F: ???
==17208==    by 0x13F0164F: ???
==17208==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

Git commit 96505aed6d59ecfa61691baa76376ae88f609116 by Nicolas Fella.
Committed on 07/04/2019 at 17:10.
Pushed by nicolasfella into branch 'Applications/19.04'.

[tagsaction] Don't crash on multiple files

Summary:
Tagging multiple files is not supported and thus we never create m_metadata for it. However, we start the tags listing  and as soon as tags are found m_metadata is accesses which results in a crash.

This patch delays the tags listing until m_metadata has been initialized

Test Plan: Select multiple files in Dolphin, right click -> no crash

Reviewers: elvisangelaccio

Reviewed By: elvisangelaccio

Subscribers: #baloo

Tags: #baloo

Differential Revision: https://phabricator.kde.org/D20361

M  +1    -1    src/tagsfileitemactionplugin/tagsfileitemaction.cpp

https://commits.kde.org/baloo-widgets/96505aed6d59ecfa61691baa76376ae88f609116