Bug 447798

Summary:	crash on "rewrite tags" when album frame is shown in file list
Product:	[Applications] kid3	Reporter:	Reuben <reuben.kagan>
Component:	general	Assignee:	Urs Fleisch <ufleisch>
Status:	RESOLVED FIXED
Severity:	crash
Priority:	NOR
Version First Reported In:	3.9.x
Target Milestone:	---
Platform:	Arch Linux
OS:	Linux
Latest Commit:	https://invent.kde.org/multimedia/kid3/commit/516744131cbda658c835ca3a9458251738a91dce	Version Fixed/Implemented In:
Sentry Crash Report:

Description Reuben 2022-01-01 21:30:44 UTC

Application: kid3 (3.9.0)

Qt Version: 5.15.2
Frameworks Version: 5.89.0
Operating System: Linux 5.14.13-arch1-1 x86_64
Windowing System: X11
Distribution: "Arch Linux"
DrKonqi: 5.23.4 [KCrashBackend]

-- Information about the crash:
<In detail, tell us what you were doing  when the application crashed.>
1.Open an album in kid3
2.in file list, add Album frame.
3.Select all files.
4. RMB menu - select "Rewrite Tags"
-- crash

The crash can be reproduced every time.

-- Backtrace:
Application: Kid3 (kid3), signal: Segmentation fault

[KCrash Handler]
#4  0x0000000000000020 in  ()
#5  0x00007f2916c06bc1 in  () at /usr/lib/kid3/plugins/libtaglibmetadata.so
#6  0x00007f293f2be2e8 in TaggedFileSystemModel::data(QModelIndex const&, int) const () at /usr/lib/kid3/libkid3-core.so
#7  0x00007f293df115a9 in QSortFilterProxyModel::data(QModelIndex const&, int) const () at /usr/lib/libQt5Core.so.5
#8  0x00007f293ed140ba in QStyledItemDelegate::initStyleOption(QStyleOptionViewItem*, QModelIndex const&) const () at /usr/lib/libQt5Widgets.so.5
#9  0x00007f293ed17c9b in QStyledItemDelegate::sizeHint(QStyleOptionViewItem const&, QModelIndex const&) const () at /usr/lib/libQt5Widgets.so.5
#10 0x00007f293ed639cd in QTreeView::indexRowSizeHint(QModelIndex const&) const () at /usr/lib/libQt5Widgets.so.5
#11 0x00007f293ed63bb2 in QTreeViewPrivate::itemHeight(int) const () at /usr/lib/libQt5Widgets.so.5
#12 0x00007f293ed58e9b in QTreeView::dataChanged(QModelIndex const&, QModelIndex const&, QVector<int> const&) () at /usr/lib/libQt5Widgets.so.5
#13 0x00007f293df6742f in  () at /usr/lib/libQt5Core.so.5
#14 0x00007f293def35ca in QAbstractItemModel::dataChanged(QModelIndex const&, QModelIndex const&, QVector<int> const&) () at /usr/lib/libQt5Core.so.5
#15 0x00007f293f27607c in FileProxyModel::onFileModificationChanged(QModelIndex const&, bool) () at /usr/lib/kid3/libkid3-core.so
#16 0x00007f293df673e3 in  () at /usr/lib/libQt5Core.so.5
#17 0x00007f293f2d3f38 in TaggedFileSystemModel::fileModificationChanged(QModelIndex const&, bool) () at /usr/lib/kid3/libkid3-core.so
#18 0x00007f2916bf6fde in  () at /usr/lib/kid3/plugins/libtaglibmetadata.so
#19 0x00007f293f2896ab in Kid3Application::saveDirectory() () at /usr/lib/kid3/libkid3-core.so
#20 0x00007f293f2d1fcc in  () at /usr/lib/kid3/libkid3-core.so
#21 0x00007f293f2d3b6b in Kid3Application::qt_metacall(QMetaObject::Call, int, void**) () at /usr/lib/kid3/libkid3-core.so
#22 0x00007f2933e43c9e in  () at /usr/lib/libQt5Qml.so.5
#23 0x00007f2933d1ddd7 in  () at /usr/lib/libQt5Qml.so.5
#24 0x00007f2933d20f6b in QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const () at /usr/lib/libQt5Qml.so.5
#25 0x00007f2933d3e0c0 in  () at /usr/lib/libQt5Qml.so.5
#26 0x00007f2933d40dbf in  () at /usr/lib/libQt5Qml.so.5
#27 0x00007f2933cd3ed9 in  () at /usr/lib/libQt5Qml.so.5
#28 0x00007f2933cd4bc0 in  () at /usr/lib/libQt5Qml.so.5
#29 0x00007f2933d3e0c0 in  () at /usr/lib/libQt5Qml.so.5
#30 0x00007f2933d40dbf in  () at /usr/lib/libQt5Qml.so.5
#31 0x00007f2933cd3ed9 in  () at /usr/lib/libQt5Qml.so.5
#32 0x00007f2933d258ef in  () at /usr/lib/libQt5Qml.so.5
#33 0x00007f293df673e3 in  () at /usr/lib/libQt5Core.so.5
#34 0x00007f2933ec7dee in QQmlTimer::event(QEvent*) () at /usr/lib/libQt5Qml.so.5
#35 0x00007f293ea8c1a6 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#36 0x000055df87d4dd60 in  ()
#37 0x00007f293df3689a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/libQt5Core.so.5
#38 0x00007f293df37399 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () at /usr/lib/libQt5Core.so.5
#39 0x00007f293df7db88 in  () at /usr/lib/libQt5Core.so.5
#40 0x00007f293c8ff52c in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#41 0x00007f293c9537b9 in  () at /usr/lib/libglib-2.0.so.0
#42 0x00007f293c8fcc11 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#43 0x00007f293df81a8a in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt5Core.so.5
#44 0x00007f293df2ea9b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt5Core.so.5
#45 0x00007f293df3a2c7 in QCoreApplication::exec() () at /usr/lib/libQt5Core.so.5
#46 0x000055df87d43591 in  ()
#47 0x00007f293dafcb25 in __libc_start_main () at /usr/lib/libc.so.6
#48 0x000055df87d43a5e in _start ()
[Inferior 1 (process 60549) detached]

Report to https://bugs.kde.org/SUMMARY
***
NOTE: If you are reporting a crash, please try to attach a backtrace with debug symbols.
See https://community.kde.org/Guidelines_and_HOWTOs/Debugging/How_to_create_useful_crash_reports
***

Comment 1 Urs Fleisch 2022-01-02 09:28:44 UTC

Git commit 516744131cbda658c835ca3a9458251738a91dce by Urs Fleisch.
Committed on 02/01/2022 at 08:58.
Pushed by ufleisch into branch 'master'.

Fix crash when stale tags are read after being stripped

This crash can happen when standard tags are displayed in the
file list (enabled via context menu) and their values are updated
just after stripping their tag. It is enough to strip the tag
using the "Remove" button and then saving. Another way to
reproduce it is using the "Rewrite Tags" action from the file
list context menu, as described in the bug report.

Saving of the stripped tag in TagLibFile::writeTags() called
markTagUnchanged() before setting the corresponding tag to null.
This call then invoked FileProxyModel::onFileModificationChanged(),
emit dataChanged(), further TaggedFileSystemModel::data() to update
the file list and then TagLibFile::getFrame() which tried to read
from the stale tag causing the crash.

Now the state of the tag is updated before the change notification
is emitted so that the subsequent reading of the tags works correctly.

M  +7    -7    src/plugins/taglibmetadata/taglibfile.cpp

https://invent.kde.org/multimedia/kid3/commit/516744131cbda658c835ca3a9458251738a91dce

Comment 2 Urs Fleisch 2022-01-02 09:32:33 UTC

Thank you very much for reporting this bug. I have fixed it in version git20220102, which can be found in https://sourceforge.net/projects/kid3/files/kid3/development/. Could you please test if it works for you?

Comment 3 Reuben 2022-01-03 10:40:06 UTC

Fixed in git version