Bug 507923

Created attachment 183821 [details]
New crash information added by DrKonqi

DrKonqi auto-attaching complete backtrace.

Created attachment 183839 [details]
Valgrind log for RKWard crash

I ran RKWard under valgrind and reproduced the crash. There were many uses of uninitialized variables and "Mismatched new/delete size value: 1" involving qtwebengine. The valgrind log at the time of the crash showed an invalid read at the address 0x10.

==5582== Thread 1:
==5582== Invalid read of size 8
==5582==    at 0x1122323E: UnknownInlinedFun (unique_ptr.h:193)
==5582==    by 0x1122323E: UnknownInlinedFun (unique_ptr.h:473)
==5582==    by 0x1122323E: UnknownInlinedFun (unique_ptr.h:466)
==5582==    by 0x1122323E: KXMLGUIFactory::container(QString const&, KXMLGUIClient*, bool) (kxmlguifactory.cpp:450)
==5582==    by 0x41AED7F: TwinTable::contextMenu(int, int, QPoint const&) (twintable.cpp:325)
==5582==    by 0x13A437B9: call (qobjectdefs_impl.h:461)
==5582==    by 0x13A437B9: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4146)
==5582==    by 0x41AE835: UnknownInlinedFun (qobjectdefs.h:306)
==5582==    by 0x41AE835: UnknownInlinedFun (moc_twintablemember.cpp:162)
==5582==    by 0x41AE835: TwinTableMember::handleContextMenuRequest(QPoint const&) (twintablemember.cpp:160)
==5582==    by 0x13A437B9: call (qobjectdefs_impl.h:461)
==5582==    by 0x13A437B9: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4146)
==5582==    by 0x117CF631: activate<void, QPoint> (qobjectdefs.h:306)
==5582==    by 0x117CF631: QWidget::customContextMenuRequested(QPoint const&) (moc_qwidget.cpp:603)
==5582==    by 0x117F39C1: QWidget::event(QEvent*) (qwidget.cpp:9174)
==5582==    by 0x1184D0F5: QFrame::event(QEvent*) (qframe.cpp:521)
==5582==    by 0x139D7CA9: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:1243)
==5582==    by 0x1178996E: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3297)
==5582==    by 0x117954CA: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:2921)
==5582==    by 0x139D7F37: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1106)
==5582==  Address 0x10 is not stack'd, malloc'd or (recently) free'd
==5582== 
==5582== 
==5582== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==5582==    at 0x1437709C: __pthread_kill_implementation (pthread_kill.c:44)
==5582==    by 0x1431DA7D: raise (raise.c:26)
==5582==    by 0x110FF532: KCrash::defaultCrashHandler(int) (in /usr/lib64/libKF6Crash.so.6.16.0)
==5582==    by 0x1431DBAF: ??? (in /usr/lib64/libc.so.6)
==5582==    by 0x1122323D: KXMLGUIFactory::container(QString const&, KXMLGUIClient*, bool) (kxmlguifactory.cpp:449)
==5582==    by 0x41AED7F: TwinTable::contextMenu(int, int, QPoint const&) (twintable.cpp:325)
==5582==    by 0x13A437B9: call (qobjectdefs_impl.h:461)
==5582==    by 0x13A437B9: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4146)
==5582==    by 0x41AE835: UnknownInlinedFun (qobjectdefs.h:306)
==5582==    by 0x41AE835: UnknownInlinedFun (moc_twintablemember.cpp:162)
==5582==    by 0x41AE835: TwinTableMember::handleContextMenuRequest(QPoint const&) (twintablemember.cpp:160)
==5582==    by 0x13A437B9: call (qobjectdefs_impl.h:461)
==5582==    by 0x13A437B9: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4146)
==5582==    by 0x117CF631: activate<void, QPoint> (qobjectdefs.h:306)
==5582==    by 0x117CF631: QWidget::customContextMenuRequested(QPoint const&) (moc_qwidget.cpp:603)
==5582==    by 0x117F39C1: QWidget::event(QEvent*) (qwidget.cpp:9174)
==5582==    by 0x1184D0F5: QFrame::event(QEvent*) (qframe.cpp:521)
==5582== 

In another normal RKWard run, I created a new data.frame as above, wrote the letter a in the R console, selected the a, right-clicked on it, then selected Copy selection literally in the context menu. RKWard crashed with the same type of trace. So the problem can happen with copying and pasting.

Hmm. I cannot immediately reproduce this with frameworks version 6.14.0.

I am also rather baffled by this crash. The immediate cause is factory(), returning a nullptr, of course, and this could easily be checked for. However, TwinTableMember is a widget in the dataeditor, and I do not see, why it should receive a context menu request event at all for something happening in a different widget. That's also the reason why factory() is null: it simply isn't the active window at the time of the event.

Git commit bee78f2bf042dbc4a0cad59d7ecd9b32f12ffca3 by Thomas Friedrichsmeier.
Committed on 07/08/2025 at 19:25.
Pushed by tfry into branch 'master'.

Improve context menu event handling in console

M  +3    -8    rkward/rkconsole.cpp

https://invent.kde.org/education/rkward/-/commit/bee78f2bf042dbc4a0cad59d7ecd9b32f12ffca3

Ok, I may have found the culprit. However, as I could not reproduce the actual crash, here, it would be much appreciated, if you could test, again.

Thanks. The problem didn't happen with rkward-master-1898-linux-gcc-x86_64.appimage which had the patch and Qt 6.8.3 and KF 6.16.0 and the previous rkward-master-1891-linux-gcc-x86_64.appimage which had Qt 6.8.3 and KF 6.15.0 from July 10. I couldn't tell if the problem was fixed by the patch that way since they both weren't affected. I built the Fedora rkward rpm with the patch, and the problem didn't happen with this build. The patch seemed to fix the problem. If you want to reproduce the crash, you could try it in a Fedora 42 KDE edition installation updated with the updates-testing repo enabled which uses Qt 6.9.1 and KF 6.16.0.

Since I used Enter new data to create a new data frame, the data editor was shown. I selected R console at the bottom left, and the console was shown in the bottom part while the data editor was in the top part. When I right-clicked in the console, the context menu partly overlapped with the data editor. When I didn't use Enter new data before the R console so the data editor wasn't shown, the crash didn't happen.