Bug 266116 - Crash: code browser crashes on cmake variable in "show uses" popup
Summary: Crash: code browser crashes on cmake variable in "show uses" popup
Status: RESOLVED FIXED
Alias: None
Product: kdevelop
Classification: Unclassified
Component: Build tools: CMake (show other bugs)
Version: 4.2.0
Platform: openSUSE RPMs Linux
: HI crash (vote)
Target Milestone: 4.2.0
Assignee: kdevelop-bugs-null
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-02-12 02:32 UTC by Gerhard
Modified: 2011-02-15 10:54 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:


Attachments
popup on a Cmake variable (17.38 KB, image/png)
2011-02-12 02:32 UTC, Gerhard
Details
this is the popup "show uses". Click on the variable name will crash Kdevelop (30.45 KB, image/png)
2011-02-12 02:33 UTC, Gerhard
Details
backtrace (11.68 KB, text/plain)
2011-02-12 02:38 UTC, Gerhard
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gerhard 2011-02-12 02:32:13 UTC
Created attachment 57172 [details]
popup on a Cmake variable

Version:           4.2.0 (using KDE 4.6.0) 
OS:                Linux

code browser crashes on Cmake variables in the scenario described below

Reproducible: Always

Steps to Reproduce:
1. Hover with the mouse over a cmake variable to bring up the popup (see screenshot code_browers_popup_on_cmake_var.png)
2. click on show uses, the "show uses" popup comes up
3. klick on the variable name (see code_browers_popup_on_cmake_var_show_uses.png)
4. kdevelop always crashes

Actual Results:  
crash

Expected Results:  
go back to the overview of the properties of the variable

Doesn't happen with normal C++ stuff (classes, functions, variables)

Krashlog attached
Comment 1 Gerhard 2011-02-12 02:33:37 UTC
Created attachment 57173 [details]
this is the popup "show uses". Click on the variable name will crash Kdevelop
Comment 2 Gerhard 2011-02-12 02:38:39 UTC
Created attachment 57174 [details]
backtrace
Comment 3 Milian Wolff 2011-02-12 20:28:57 UTC
reproduced:

==32601== Invalid read of size 8
==32601==    at 0xC9AF95F: KDevelop::AbstractNavigationWidget::update() (abstractnavigationwidget.cpp:142)
==32601==    by 0xC9AF783: KDevelop::AbstractNavigationWidget::setContext(KSharedPtr<KDevelop::AbstractNavigationContext>, int) (abstractnavigationwidget.cpp:119)
==32601==    by 0xC9AFE98: KDevelop::AbstractNavigationWidget::anchorClicked(QUrl const&) (abstractnavigationwidget.cpp:211)
==32601==    by 0xC9B0827: KDevelop::AbstractNavigationWidget::qt_metacall(QMetaObject::Call, int, void**) (abstractnavigationwidget.moc:115)
==32601==    by 0x91CFB26: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3280)
==32601==    by 0x9B3E0A4: QTextBrowser::anchorClicked(QUrl const&) (moc_qtextbrowser.cpp:203)
==32601==    by 0x9B3EA7A: QTextBrowserPrivate::_q_activateAnchor(QString const&) (qtextbrowser.cpp:211)
==32601==    by 0x9B4089D: QTextBrowser::qt_metacall(QMetaObject::Call, int, void**) (moc_qtextbrowser.cpp:116)
==32601==    by 0x8A9BC84: KTextBrowser::qt_metacall(QMetaObject::Call, int, void**) (ktextbrowser.moc:73)
==32601==    by 0x91CFB26: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3280)
==32601==    by 0x9901464: QTextControl::linkActivated(QString const&) (moc_qtextcontrol_p.cpp:322)
==32601==    by 0x9909300: QTextControlPrivate::activateLinkUnderCursor(QString) (qtextcontrol.cpp:2635)
==32601==    by 0x990A256: QTextControlPrivate::mouseReleaseEvent(Qt::MouseButton, QPointF const&) (qtextcontrol.cpp:1724)
==32601==    by 0x990D281: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:943)
==32601==    by 0x9903319: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:890)
==32601==    by 0x9B3CA2B: QTextEdit::mouseReleaseEvent(QMouseEvent*) (qtextedit_p.h:99)
==32601==    by 0x96F904D: QWidget::event(QEvent*) (qwidget.cpp:8187)
==32601==    by 0x9AC45E5: QFrame::event(QEvent*) (qframe.cpp:557)
==32601==    by 0x91B7506: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:847)
==32601==    by 0x96A2FAB: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:4392)
==32601==    by 0x96A930D: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3959)
==32601==    by 0x899FA35: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:311)
==32601==    by 0x91B7CDB: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:732)
==32601==    by 0x96A7DBD: QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) (qcoreapplication.h:215)
==32601==    by 0x972B344: QETWidget::translateMouseEvent(_XEvent const*) (qapplication_x11.cpp:4403)
==32601==  Address 0x22 is not stack'd, malloc'd or (recently) free'd
Comment 4 Milian Wolff 2011-02-12 20:49:03 UTC
Git commit 288c92e122776b6310b3862d02372e465fd16837 by Milian Wolff.
Committed on 12/02/2011 at 20:46.
Pushed by mwolff into branch 'master'.

don't store raw pointer to AbstractNavigationContext, use the KSharedPtr to prevent crashes

TODO: how can this be backported to 4.2 without breaking the ABI?
AbstractNavigationContext is an exported class and I changed the type of
m_previousContext... Is this OK?

BUG: 266116

M  +1    -1    language/duchain/navigation/abstractnavigationcontext.cpp     
M  +1    -1    language/duchain/navigation/abstractnavigationcontext.h     
M  +2    -2    language/duchain/navigation/navigationaction.h     

http://commits.kde.org/kdevplatform/288c92e122776b6310b3862d02372e465fd16837
Comment 5 Milian Wolff 2011-02-15 10:54:20 UTC
Git commit cdff3a767679ab4e0dc77a14677f07213db1cb66 by Milian Wolff.
Committed on 15/02/2011 at 10:51.
Pushed by mwolff into branch '1.2'.

Properly keep track of start context to prevent deletion of it while browsing

This seems to be the correct fix that does not require API changes

CCMAIL: kdevelop-devel@kdevelop.org

BUG: 266116

M  +4    -0    language/duchain/navigation/abstractnavigationwidget.cpp     

http://commits.kde.org/kdevplatform/cdff3a767679ab4e0dc77a14677f07213db1cb66