Application: kwin (4.7.97 (4.8 RC2 (4.7.97) "release 1") KDE Platform Version: 4.7.97 (4.8 RC2 (4.7.97) "release 1" Qt Version: 4.8.0 Operating System: Linux 3.2.0-1-desktop x86_64 Distribution: "openSUSE 11.4 (x86_64)" -- Information about the crash: - start kde - kwin starts with desktop effects disabled - press shift-alt-f12 to enable desktop effects - effects enabled, everything looks fine - wait some seconds - crash The crash can be reproduced every time. -- Backtrace: Application: KWin (kwin), signal: Segmentation fault [Current thread is 1 (Thread 0x7f70ae2af7a0 (LWP 7335))] Thread 2 (Thread 0x7f7092ccf700 (LWP 7361)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162 #1 0x00007f70aa5ac264 in QTWTF::TCMalloc_PageHeap::scavengerThread (this=0x7f70aa8c6180) at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:2359 #2 0x00007f70aa5ac299 in QTWTF::TCMalloc_PageHeap::runScavengerThread (context=0x7f70aa8d4254) at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:1464 #3 0x00007f70a9d4c25a in ?? () from /usr/lib64/libGL.so.1 #4 0x00007f70a8e61a3f in start_thread (arg=0x7f7092ccf700) at pthread_create.c:297 #5 0x00007f70adb2a71d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112 #6 0x0000000000000000 in ?? () Thread 1 (Thread 0x7f70ae2af7a0 (LWP 7335)): [KCrash Handler] #6 isNull (this=0xf0) at image/qpixmapdata_p.h:131 #7 QPixmap::isNull (this=<optimized out>) at image/qpixmap.cpp:579 #8 0x00007f70a84ad58a in QPainter::drawPixmap (this=0x7fffe7d48730, r=..., pm=..., sr=...) at painting/qpainter.cpp:5407 #9 0x00007f70980df790 in drawPixmap (sh=<optimized out>, sw=32, sy=<optimized out>, sx=<optimized out>, pm=<optimized out>, y=1019, x=1146, this=<optimized out>) at /usr/include/QtGui/qpainter.h:879 #10 Oxygen::TileSet::render (this=0x9043d0, r=<optimized out>, p=<optimized out>, t=...) at /usr/src/debug/kde-workspace-4.7.97/libs/oxygen/oxygentileset.cpp:157 #11 0x00007f7093668057 in Oxygen::Client::paint (this=0xa7b890, painter=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/clients/oxygen/oxygenclient.cpp:1514 #12 0x00007f70936667e5 in Oxygen::Client::paintEvent (this=0xa7b890, event=0x7fffe7d48db0) at /usr/src/debug/kde-workspace-4.7.97/kwin/clients/oxygen/oxygenclient.cpp:1435 #13 0x00007f70abea50af in KCommonDecoration::eventFilter (this=0xa7b890, o=0xb17d20, e=0x7fffe7d48db0) at /usr/src/debug/kde-workspace-4.7.97/kwin/libkdecorations/kcommondecoration.cpp:877 #14 0x00007f7093660b18 in Oxygen::Client::eventFilter (this=0xa7b890, object=0xb17d20, event=0x7fffe7d48db0) at /usr/src/debug/kde-workspace-4.7.97/kwin/clients/oxygen/oxygenclient.cpp:1396 #15 0x00007f70a91f8eb7 in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=<optimized out>, receiver=0xb17d20, event=0x7fffe7d48db0) at kernel/qcoreapplication.cpp:986 #16 0x00007f70a83554b1 in QApplicationPrivate::notify_helper (this=0x6b4130, receiver=0xb17d20, e=0x7fffe7d48db0) at kernel/qapplication.cpp:4546 #17 0x00007f70a835db4f in QApplication::notify (this=<optimized out>, receiver=0xb17d20, e=0x7fffe7d48db0) at kernel/qapplication.cpp:4411 #18 0x00007f70ad624a86 in KApplication::notify (this=0x7fffe7d4b710, receiver=0xb17d20, event=0x7fffe7d48db0) at /usr/src/debug/kdelibs-4.7.97/kdeui/kernel/kapplication.cpp:311 #19 0x00007f70a91f8d2c in QCoreApplication::notifyInternal (this=0x7fffe7d4b710, receiver=0xb17d20, event=0x7fffe7d48db0) at kernel/qcoreapplication.cpp:876 #20 0x00007f70a83a2c72 in sendSpontaneousEvent (event=0x7fffe7d48db0, receiver=0xb17d20) at ../../src/corelib/kernel/qcoreapplication.h:234 #21 QWidgetPrivate::drawWidget (this=0xa463e0, pdev=0xb5be08, rgn=..., offset=..., flags=14, sharedPainter=0x0, backingStore=0x0) at kernel/qwidget.cpp:5584 #22 0x00007f70a83a5527 in QWidgetPrivate::render (this=0xa463e0, target=0xb5be08, targetOffset=..., sourceRegion=<optimized out>, renderFlags=..., readyToRender=<optimized out>) at kernel/qwidget.cpp:5720 #23 0x00007f70a83a57c9 in QWidget::render (this=<optimized out>, target=<optimized out>, targetOffset=<optimized out>, sourceRegion=<optimized out>, renderFlags=<optimized out>) at kernel/qwidget.cpp:5172 #24 0x00007f70ade9c46b in KWin::PaintRedirector::performPendingPaint (this=0xb5bde0) at /usr/src/debug/kde-workspace-4.7.97/kwin/paintredirector.cpp:55 #25 0x00007f70ade109e6 in KWin::Client::ensureDecorationPixmapsPainted (this=0xbd6d80) at /usr/src/debug/kde-workspace-4.7.97/kwin/client.cpp:582 #26 0x00007f70ade8a5fb in KWin::SceneOpenGL::Window::performPaint (this=0xa61930, mask=10, region=..., data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene_opengl.cpp:542 #27 0x00007f70ade732ef in KWin::Scene::finalDrawWindow (this=<optimized out>, w=<optimized out>, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene.cpp:444 #28 0x00007f70ade97da2 in KWin::EffectsHandlerImpl::drawWindow (this=<optimized out>, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:286 #29 0x00007f70abc7ea1f in KWin::Effect::drawWindow (this=<optimized out>, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/libkwineffects/kwineffects.cpp:181 #30 0x00007f70ade97d34 in KWin::EffectsHandlerImpl::drawWindow (this=0xb55c80, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:283 #31 0x00007f70abc7ea1f in KWin::Effect::drawWindow (this=<optimized out>, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/libkwineffects/kwineffects.cpp:181 #32 0x00007f70ade97d34 in KWin::EffectsHandlerImpl::drawWindow (this=0xb55c80, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:283 #33 0x00007f70ade728aa in KWin::Scene::finalPaintWindow (this=<optimized out>, w=0xa7f760, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene.cpp:435 #34 0x00007f70ade97fd2 in KWin::EffectsHandlerImpl::paintWindow (this=<optimized out>, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:249 #35 0x00007f708b98b25b in KWin::FadeEffect::paintWindow (this=0xa9b260, w=0xa7f770, mask=10, region=..., data=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects/fade/fade.cpp:140 #36 0x00007f70ade97f64 in KWin::EffectsHandlerImpl::paintWindow (this=0xb55c80, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:246 #37 0x00007f708b9b61ee in KWin::DimInactiveEffect::paintWindow (this=<optimized out>, w=0xa7f770, mask=10, region=..., data=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects/diminactive/diminactive.cpp:80 #38 0x00007f70ade97f64 in KWin::EffectsHandlerImpl::paintWindow (this=0xb55c80, w=0xa7f770, mask=10, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:246 #39 0x00007f70ade734f0 in KWin::Scene::paintWindow (this=<optimized out>, w=0xa61930, mask=10, region=..., quads=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene.cpp:391 #40 0x00007f70ade743bc in KWin::Scene::paintSimpleScreen (this=0xa93ef0, orig_mask=8, region=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene.cpp:377 #41 0x00007f70ade727da in KWin::Scene::finalPaintScreen (this=0xa93ef0, mask=8, region=<optimized out>, data=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene.cpp:198 #42 0x00007f70ade97ea8 in KWin::EffectsHandlerImpl::paintScreen (this=<optimized out>, mask=8, region=<optimized out>, data=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:222 #43 0x00007f70abc7ebbf in KWin::Effect::paintScreen (this=<optimized out>, mask=8, region=<optimized out>, data=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/libkwineffects/kwineffects.cpp:141 #44 0x00007f70ade97e47 in KWin::EffectsHandlerImpl::paintScreen (this=0xb55c80, mask=8, region=<optimized out>, data=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:219 #45 0x00007f70abc7ebbf in KWin::Effect::paintScreen (this=<optimized out>, mask=8, region=<optimized out>, data=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/libkwineffects/kwineffects.cpp:141 #46 0x00007f70ade97e47 in KWin::EffectsHandlerImpl::paintScreen (this=0xb55c80, mask=8, region=<optimized out>, data=...) at /usr/src/debug/kde-workspace-4.7.97/kwin/effects.cpp:219 #47 0x00007f70ade74e22 in KWin::Scene::paintScreen (this=0xa93ef0, mask=0x7fffe7d4a96c, region=0x7fffe7d4aa10) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene.cpp:156 #48 0x00007f70ade8b13a in KWin::SceneOpenGL::paint (this=0xa93ef0, damage=..., toplevels=<optimized out>) at /usr/src/debug/kde-workspace-4.7.97/kwin/scene_opengl_glx.cpp:459 #49 0x00007f70ade6f51c in KWin::Workspace::performCompositing (this=0x7f4450) at /usr/src/debug/kde-workspace-4.7.97/kwin/composite.cpp:417 #50 0x00007f70a920d4a9 in QObject::event (this=0x7f4450, e=<optimized out>) at kernel/qobject.cpp:1166 #51 0x00007f70a83554e4 in QApplicationPrivate::notify_helper (this=0x6b4130, receiver=0x7f4450, e=0x7fffe7d4b210) at kernel/qapplication.cpp:4550 #52 0x00007f70a835db4f in QApplication::notify (this=<optimized out>, receiver=0x7f4450, e=0x7fffe7d4b210) at kernel/qapplication.cpp:4411 #53 0x00007f70ad624a86 in KApplication::notify (this=0x7fffe7d4b710, receiver=0x7f4450, event=0x7fffe7d4b210) at /usr/src/debug/kdelibs-4.7.97/kdeui/kernel/kapplication.cpp:311 #54 0x00007f70a91f8d2c in QCoreApplication::notifyInternal (this=0x7fffe7d4b710, receiver=0x7f4450, event=0x7fffe7d4b210) at kernel/qcoreapplication.cpp:876 #55 0x00007f70a922a86c in sendEvent (event=0x7fffe7d4b210, receiver=<optimized out>) at kernel/qcoreapplication.h:231 #56 QTimerInfoList::activateTimers (this=0x6b4b28) at kernel/qeventdispatcher_unix.cpp:626 #57 0x00007f70a922afb0 in QEventDispatcherUNIX::processEvents (this=0x60fdb0, flags=...) at kernel/qeventdispatcher_unix.cpp:945 #58 0x00007f70a83fc65c in QEventDispatcherX11::processEvents (this=0x60fdb0, flags=...) at kernel/qeventdispatcher_x11.cpp:152 #59 0x00007f70a91f7e02 in QEventLoop::processEvents (this=<optimized out>, flags=...) at kernel/qeventloop.cpp:149 #60 0x00007f70a91f807d in QEventLoop::exec (this=0x7fffe7d4b600, flags=...) at kernel/qeventloop.cpp:204 #61 0x00007f70a91fc7cb in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1148 #62 0x00007f70ade26575 in kdemain (argc=<optimized out>, argv=0x7fffe7d4b770) at /usr/src/debug/kde-workspace-4.7.97/kwin/main.cpp:541 #63 0x00007f70ada75bfd in __libc_start_main (main=0x400770 <main(int, char**)>, argc=3, ubp_av=0x7fffe7d4be38, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffe7d4be28) at libc-start.c:226 #64 0x0000000000400699 in _start () at ../sysdeps/x86_64/elf/start.S:113 Reported using DrKonqi
Looks like serious memory corruption, and from Qt. The crash is inside Qt, trying to access the ::isNull method on a 0x0 Pixmap. #6 isNull (this=0xf0) at image/qpixmapdata_p.h:131 #7 QPixmap::isNull (this=<optimized out>) at image/qpixmap.cpp:579 Now, the upstream code in oxygentileset from: #10 Oxygen::TileSet::render (this=0x9043d0, r=<optimized out>, p=<optimized out>, t=...) only deals with reference to Pixmaps, and not pointers and thus has no way to pass a 0x0 QPixmap* to Qt. So the pixmap must be lost along the way, outside of oxygen. Oh and naturally I can't reproduce (here with Qt 4.8.0, nor with Qt 4.7), using kde from sources ... Nothing I can do about it :( Lets wait and see if others have similar issue. Question: the crash does _not_ happen if you don't enable desktop effects ?
Question 2: graphics card and driver ?
- no crash if desktop effects are disabled - crash immediately if desktop effects are enabled and I click on a window in the background - no difference if I change style (e.g., from oxygen to Air) - graphics card: NV43GL [Quadro FX 550] - driver: nvida 285.05.09 - kernel 3.2
The null pointer doesn't refer the QPixmap but it's internal QPixmapData. I recall that this is a dupe (i think) - i think we've the same bug with the same trace around. (it must be *somewhere* in bugzilla) It's possibly because of the raster graphicssystem and QPixmap sn't backed by a Pixmap / Picture @Olaf please run "kwin --graphicssystem native --replace &" instead and check whether the issue still occurs
@Olaf "no difference if I change style (e.g., from oxygen to Air)" You mean "desktop theme" ? Or actually "window decoration" style ? (I don't know about an "air" window decoration, but ...)
(In reply to comment #4) > please run "kwin --graphicssystem native --replace &" instead and check whether > the issue still occurs same crash.
(In reply to comment #5) > "no difference if I change style (e.g., from oxygen to Air)" > You mean "desktop theme" ? Or actually "window decoration" style ? > (I don't know about an "air" window decoration, but ...) I've tried to change a) window decoration theme b) style of applications because both are using a style called oxygen. I see no difference - but I have not tried to change a and b at the same time.
It cannot be the *same* crash since it's not the same decoration, the entrance vector MUST differ. Please - try the "KDE2" decoration (kcmshell4 kwindecoration) and - the "palstique" Qt style. - Restart kwin ("kwin --graphicssystem native --replace &") from konsole - post the output and ultimately - the backtrace from the crash that occurs with this setup (iff it does so)
- no crash for KDE2 window decorations (or some others) - crash for oxygen In my first try I changed the desktop style instead of the window decoration, sorry. Workaround for me: do not use oxygen window declaration, that helps a lot, thank you for your fast responses!
@Hugo do you possibly hand out a local var as reference, ie code like QPixmap &stuff() { QPixmap pix; doSome(pix); return pix; }
nope. Actually, won't the compiler complain about such construct ? (warning: returning reference to a temporary)
shouldn't one get a warning? "warning: reference to local variable '...' returned"? Ok, no one is looking for warnings... I played with -Werror=... but it looks like there is no switch for enabling that warning :-(, it is enabled by default, thus one cannot create an error using -Werror=...
I actually am looking at warnings at compile time. And there are none (at least with my compiler version) for the whole oxygen code.
Yes, a warning there would be. No, most ppl. don't look at them ;-) ok, the crashy code in qpixmap.cpp is bool QPixmap::isNull() const { return !data || data->isNull(); } since data apparently *is* NULL (so says the trace) "data->isNull();" should never be touched anyway => the stack is junk. @Olaf I start to suspect that the plugin or oxygen library is "the wrong one", ie. your stable copy (is there?) of (most likely the plugin) it shadows the intended (RC2) one, causing an ABI gap. -> "lsof | grep -i oxygen" - esp look for kwin3_oxygen
kwin loads: /usr/lib64/kde4/kwin3_oxygen /usr/lib64/liboxygenstyle.so.4.8.0 /usr/lib64/kde4/plugins/styles/oxygen.so kwin3_oxygen is part of the package kwin-4.7.97, the other libs are part of kdebase4-workspace-liboxygenstyle-4.7.97.
Thanks, and yes libraries looks ok. What about qt ? Do you only have Qt4.8.0 installed ? Indeed with the code pointed to by Thomas, the crash you experience should definitly _not_ happen. Meaning that there is something broken (in your system) with library symbols.
I've installed the source and attached a debugger. #0 QPixmap::isNull (this=<optimized out>) at image/qpixmap.cpp:579 579 return !data || data->isNull(); Look into registers & asm code shows: this is not null, but data is 240 => crash Question: Why is the pixmap corrupted? #1 0x00007ffe5643158a in QPainter::drawPixmap (this=0x7fff3d366ff0, r=..., pm=..., sr=...) at painting/qpainter.cpp:5407 5407 if (!d->engine || pm.isNull()) If I print pm here: (gdb) p pm $3 = (QPaintDevice &) @0x4643870: { _vptr.QPaintDevice = 0x7ffe56da4990, painters = 0 } (gdb) x 0x7ffe56da4990 0x7ffe56da4990 <_ZTV12QPaintDevice+16>: 0x56417ba0 pm is not a QPixmap anymore, it is an instance of it's base class, looks like ~QPixmap has been already run. So let's look where pm comes from. #3 Oxygen::TileSet::render (this=0xff0500, r=<optimized out>, p=<optimized out>, t=...) at /usr/src/debug/kde-workspace-4.7.97/libs/oxygen/oxygentileset.cpp:157 157 if( bits(t, Bottom|Right) ) p->drawPixmap(x2, y2, _pixmaps.at(8), _w3-wRight, _h3-hBottom, wRight, hBottom ); _pixmaps is a QVector of QPixmaps... or at least should be. (gdb) p & ((QPixmap*) &_pixmaps.p[1])[7] $24 = (QPaintDevice *) 0x4643870 which is the same address as this in frame 0 (register rdi). All other entries of the vector I checked are also no valid QPixmaps but detected as QPaintDevices. Maybe the whole vector is already destroyed? The tileset that contains the vector comes from a shadowCache() one frame above. Is the cache in memory? or are there any outdated cache files on my disk?
whoa. Thanks a lot for all the debug hunting. The cache in question is only in memory and not saved on disk. (its a QCache). So no need for you to delete any "file". Then, well, the purpose of the cache is that it gets re-filled automatically, whenever its being cleared. (meaning: there is no mecanism by Qt that you can access and entry in the cache that has been cleared). Something "else" is deleting the pixmaps, without notifying the cache (and removing the corresponding entry): There is no explicit qpixmap deletion in the code - just double checked); Nor are there any explicit deletion of the parent class (Oxygen::TileSet), since this should be dealt with by the QCache, e.g. QCache::clear ); nor are there pointers to TileSet that are kept around, and could be invalidated before use, due to a cache clear. So that I am a lost :(
sth. like Foo *bar = QCache<int, Foo>::object(i); QCache<int, Foo>::insert(i, Foo(p)); // floods cache, cache kicks oldest object, being "bar" bar->crashMe(); i.e *any* "insert" has the pot. to invalidate *any* cache pointer, therefore the above calling order is dangerous to wrong Try raising the maxCost (INT_MAX ;-) or inserting with no costs at all (0 ;-)
@Thomas Agreed. I dont 'think' I do that (being aware of the issue you mention), though I will double check cause it might be well hidden.
... nope. Only place where shadowcache is actually used (in the decoration code) is: kwin/clients/oxygen/oxygenclient.cpp l1507 or so: if( configuration().useOxygenShadows() && glowIsAnimated() && !isForcedActive() ) { tileSet = shadowCache().tileSet( key, glowIntensity() ); } else { tileSet = shadowCache().tileSet( key ); } tileSet->render( frame, &painter, TileSet::Ring); Sounds pretty safe to me.
For the record, place where maxCost is set is in kde-workspace/libs/oxygen/oxygenshadowcache.h l58. Places where cache objects are inserted is: kde-workspace/libs/oxygen/oxygenshadowcache.cpp l136 and l184 (in case Olaf wants to try one of Thomas suggestions). Here, I can't really help, since I can't reproduce.
Dear Bug Submitter, This bug has been stagnant for a long time. Could you help us out and re-test if the bug is valid in the latest version? I am setting the status to NEEDSINFO pending your response, please change the Status back to REPORTED when you respond. Thank you for helping us make KDE software even better for everyone!
Dear Bug Submitter, This bug has been in NEEDSINFO status with no change for at least 15 days. Please provide the requested information as soon as possible and set the bug status as REPORTED. Due to regular bug tracker maintenance, if the bug is still in NEEDSINFO status with no change in 30 days the bug will be closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging If you have already provided the requested information, please mark the bug as REPORTED so that the KDE team knows that the bug is ready to be confirmed. Thank you for helping us make KDE software even better for everyone!
This bug has been in NEEDSINFO status with no change for at least 30 days. The bug is now closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging Thank you for helping us make KDE software even better for everyone!