Bug 373911 - After upgrading to 2.20.90 from version 2.20.3, umbrello crash when I try to open model created with 2.20.3
Summary: After upgrading to 2.20.90 from version 2.20.3, umbrello crash when I try to ...
Status: RESOLVED FIXED
Alias: None
Product: umbrello
Classification: Applications
Component: general (show other bugs)
Version: 2.20.90 (KDE Applications 16.11.90)
Platform: Microsoft Windows Microsoft Windows
: NOR crash
Target Milestone: ---
Assignee: Umbrello Development Group
URL:
Keywords:
Depends on: 374378
Blocks:
  Show dependency treegraph
 
Reported: 2016-12-19 20:09 UTC by chrisdo74
Modified: 2017-01-04 13:31 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In: 2.21.1 (KDE Applications 16.12.1)
Sentry Crash Report:


Attachments
attachment-14709-0.html (2.11 KB, text/html)
2016-12-30 09:01 UTC, chrisdo74
Details
umbrelloCrashTrace.txt (11.18 KB, text/plain)
2016-12-30 21:12 UTC, chrisdo74
Details
dbgview.log (1.69 KB, application/octet-stream)
2016-12-30 21:12 UTC, chrisdo74
Details
ErrorMsg1.png (16.30 KB, image/png)
2017-01-01 17:50 UTC, chrisdo74
Details
ErrorMsg2.png (14.23 KB, image/png)
2017-01-01 17:50 UTC, chrisdo74
Details
testModel2.xmi (26.07 KB, application/octet-stream)
2017-01-01 17:50 UTC, chrisdo74
Details

Note You need to log in before you can comment on or make changes to this bug.
Description chrisdo74 2016-12-19 20:09:43 UTC
The whole program completely disappear without any exception messagebox.  My OS is 64bit Win7 Pro.
Comment 1 Ralf Habacker 2016-12-20 23:05:27 UTC
A new windows release 2.21.0 containing a fix has been staged for releasing.
It will be available at http://download.kde.org/stable/umbrello/ until the release happens windows binaries could be downloaded from ftp://upload.kde.org/incoming/.

*** This bug has been marked as a duplicate of bug 373900 ***
Comment 2 chrisdo74 2016-12-30 09:01:36 UTC
Created attachment 103085 [details]
attachment-14709-0.html

I've downloaded and installed 2.21.0 but the problem still occurs.  Is
there any option I can use to start Umbrello so that it will generate logs
that I can forward to you

Thanks,
Chris

On Tue, Dec 20, 2016 at 3:05 PM, Ralf Habacker <bugzilla_noreply@kde.org>
wrote:

> https://bugs.kde.org/show_bug.cgi?id=373911
>
> Ralf Habacker <ralf.habacker@freenet.de> changed:
>
>            What    |Removed                     |Added
> ------------------------------------------------------------
> ----------------
>              Status|UNCONFIRMED                 |RESOLVED
>          Resolution|---                         |DUPLICATE
>                  CC|                            |ralf.habacker@freenet.de
>
> --- Comment #1 from Ralf Habacker <ralf.habacker@freenet.de> ---
> A new windows release 2.21.0 containing a fix has been staged for
> releasing.
> It will be available at http://download.kde.org/stable/umbrello/ until the
> release happens windows binaries could be downloaded from
> ftp://upload.kde.org/incoming/.
>
> *** This bug has been marked as a duplicate of bug 373900 ***
>
> --
> You are receiving this mail because:
> You reported the bug.
> You are on the CC list for the bug.
Comment 3 Ralf Habacker 2016-12-30 17:11:25 UTC
(In reply to chrisdo74 from comment #2)
> Created attachment 103085 [details]
> attachment-14709-0.html
> 
> I've downloaded and installed 2.21.0 but the problem still occurs.  Is
> there any option I can use to start Umbrello so that it will generate logs
> that I can forward to you
1. You can start dbgview from https://technet.microsoft.com/en-us/sysinternals/debugview.aspx before to get an indication on which processing umbrello crashes.
2. You can download drmingw from https://github.com/jrfonseca/drmingw/releases and install it with drmingw -i as post mortem debugger. After starting umbrello you should get a backtrace in crash case.



> 
> Thanks,
> Chris
> 
> On Tue, Dec 20, 2016 at 3:05 PM, Ralf Habacker <bugzilla_noreply@kde.org>
> wrote:
> 
> > https://bugs.kde.org/show_bug.cgi?id=373911
> >
> > Ralf Habacker <ralf.habacker@freenet.de> changed:
> >
> >            What    |Removed                     |Added
> > ------------------------------------------------------------
> > ----------------
> >              Status|UNCONFIRMED                 |RESOLVED
> >          Resolution|---                         |DUPLICATE
> >                  CC|                            |ralf.habacker@freenet.de
> >
> > --- Comment #1 from Ralf Habacker <ralf.habacker@freenet.de> ---
> > A new windows release 2.21.0 containing a fix has been staged for
> > releasing.
> > It will be available at http://download.kde.org/stable/umbrello/ until the
> > release happens windows binaries could be downloaded from
> > ftp://upload.kde.org/incoming/.
> >
> > *** This bug has been marked as a duplicate of bug 373900 ***
> >
> > --
> > You are receiving this mail because:
> > You reported the bug.
> > You are on the CC list for the bug.
Comment 4 chrisdo74 2016-12-30 21:12:18 UTC
Created attachment 103099 [details]
umbrelloCrashTrace.txt

I've done both steps and attaching debug information.  Hope this will help
debugging the issue.

Thanks,
Chris

On Fri, Dec 30, 2016 at 9:11 AM, Ralf Habacker <bugzilla_noreply@kde.org>
wrote:

> https://bugs.kde.org/show_bug.cgi?id=373911
>
> --- Comment #3 from Ralf Habacker <ralf.habacker@freenet.de> ---
> (In reply to chrisdo74 from comment #2)
> > Created attachment 103085 [details]
> > attachment-14709-0.html
> >
> > I've downloaded and installed 2.21.0 but the problem still occurs.  Is
> > there any option I can use to start Umbrello so that it will generate
> logs
> > that I can forward to you
> 1. You can start dbgview from
> https://technet.microsoft.com/en-us/sysinternals/debugview.aspx before to
> get
> an indication on which processing umbrello crashes.
> 2. You can download drmingw from https://github.com/jrfonseca/
> drmingw/releases
> and install it with drmingw -i as post mortem debugger. After starting
> umbrello
> you should get a backtrace in crash case.
>
>
>
> >
> > Thanks,
> > Chris
> >
> > On Tue, Dec 20, 2016 at 3:05 PM, Ralf Habacker <bugzilla_noreply@kde.org
> >
> > wrote:
> >
> > > https://bugs.kde.org/show_bug.cgi?id=373911
> > >
> > > Ralf Habacker <ralf.habacker@freenet.de> changed:
> > >
> > >            What    |Removed                     |Added
> > > ------------------------------------------------------------
> > > ----------------
> > >              Status|UNCONFIRMED                 |RESOLVED
> > >          Resolution|---                         |DUPLICATE
> > >                  CC|                            |
> ralf.habacker@freenet.de
> > >
> > > --- Comment #1 from Ralf Habacker <ralf.habacker@freenet.de> ---
> > > A new windows release 2.21.0 containing a fix has been staged for
> > > releasing.
> > > It will be available at http://download.kde.org/stable/umbrello/
> until the
> > > release happens windows binaries could be downloaded from
> > > ftp://upload.kde.org/incoming/.
> > >
> > > *** This bug has been marked as a duplicate of bug 373900 ***
> > >
> > > --
> > > You are receiving this mail because:
> > > You reported the bug.
> > > You are on the CC list for the bug.
>
> --
> You are receiving this mail because:
> You are on the CC list for the bug.
> You reported the bug.
Comment 5 chrisdo74 2016-12-30 21:12:18 UTC
Created attachment 103100 [details]
dbgview.log
Comment 6 Ralf Habacker 2016-12-31 00:40:40 UTC
From the backtrace it looks to be a dynamic_cast of a zero pointer probably casting to a class UMLDatatype or UMLComponent. Would it be possible to add the related xmi file to this bug to be able to check the crash on a development machine ?
Comment 7 Ralf Habacker 2016-12-31 00:42:13 UTC
Comment on attachment 103100 [details]
dbgview.log

This is already included into the drmingw log.
Comment 8 Ralf Habacker 2016-12-31 00:55:22 UTC
Git commit b8609d3449616fef331fa6f5cd038cce60dc2c38 by Ralf Habacker.
Committed on 31/12/2016 at 00:55.
Pushed by habacker into branch 'Applications/16.12'.

Check dynamic_cast return value to avoid zero pointer access.

M  +2    -2    umbrello/umlscene.cpp

https://commits.kde.org/umbrello/b8609d3449616fef331fa6f5cd038cce60dc2c38
Comment 9 Ralf Habacker 2016-12-31 00:55:22 UTC
Git commit f31d1f02653c146be2bd79ea0d157ff4844677c4 by Ralf Habacker.
Committed on 31/12/2016 at 00:55.
Pushed by habacker into branch 'Applications/16.12'.

Fix zero pointer guard not using correct variable name.

M  +1    -1    umbrello/umlmodel/classifier.cpp

https://commits.kde.org/umbrello/f31d1f02653c146be2bd79ea0d157ff4844677c4
Comment 10 Ralf Habacker 2016-12-31 09:01:56 UTC
Git commit 2bc929da135c7cf8a41c988375436ada7675874a by Ralf Habacker.
Committed on 31/12/2016 at 09:01.
Pushed by habacker into branch 'Applications/16.12'.

Fix potential crash cause in cpp writer.

M  +1    -0    umbrello/codegenerators/cpp/cppwriter.cpp

https://commits.kde.org/umbrello/2bc929da135c7cf8a41c988375436ada7675874a
Comment 11 chrisdo74 2017-01-01 17:50:52 UTC
Created attachment 103126 [details]
ErrorMsg1.png

I'm attaching a simple test model that will generate the crash.  Also, I
didn't mentioned it in the original bug report, but when I save a new model
for the first time or do a "save as" in 2.20.3, I get a couple of error
messages.  The error messages did not seem to affect the model file as far
as I could tell, but it may be related to the cash when I open these models
in newer version of umbrello.

On Fri, Dec 30, 2016 at 4:40 PM, Ralf Habacker <bugzilla_noreply@kde.org>
wrote:

> https://bugs.kde.org/show_bug.cgi?id=373911
>
> Ralf Habacker <ralf.habacker@freenet.de> changed:
>
>            What    |Removed                     |Added
> ------------------------------------------------------------
> ----------------
>      Ever confirmed|0                           |1
>          Resolution|DUPLICATE                   |---
>              Status|RESOLVED                    |REOPENED
>
> --- Comment #6 from Ralf Habacker <ralf.habacker@freenet.de> ---
> From the backtrace it looks to be a dynamic_cast of a zero pointer probably
> casting to a class UMLDatatype or UMLComponent. Would it be possible to
> add the
> related xmi file to this bug to be able to check the crash on a development
> machine ?
>
> --
> You are receiving this mail because:
> You reported the bug.
> You are on the CC list for the bug.
>
Comment 12 chrisdo74 2017-01-01 17:50:53 UTC
Created attachment 103127 [details]
ErrorMsg2.png
Comment 13 chrisdo74 2017-01-01 17:50:53 UTC
Created attachment 103128 [details]
testModel2.xmi
Comment 14 Ralf Habacker 2017-01-02 10:31:22 UTC
Thanks for this testcase. After installing libstdc++ symbols from the mingw32-gcc-debug package I was able to create a more detailed backtrace:

Program received signal SIGSEGV, Segmentation fault.
__cxxabiv1::__dynamic_cast (src_ptr=0x0, src_type=0x7ef444 <_fu5995___ZTVN10__cxxabiv120__si_class_type_infoE>,
    dst_type=0x7eeac0 <_fu6273___ZTVN10__cxxabiv120__si_class_type_infoE>, src2dst=0) at ../../../../libstdc++-v3/libsupc++/dyncast.cc:50
50      ../../../../libstdc++-v3/libsupc++/dyncast.cc: No such file or directory.
(gdb) bt
#0  __cxxabiv1::__dynamic_cast (src_ptr=0x0, src_type=0x7ef444 <_fu5995___ZTVN10__cxxabiv120__si_class_type_infoE>,
    dst_type=0x7eeac0 <_fu6273___ZTVN10__cxxabiv120__si_class_type_infoE>, src2dst=0) at ../../../../libstdc++-v3/libsupc++/dyncast.cc:50
#1  0x00607523 in UMLObject::asUMLUniqueConstraint (this=<optimized out>) at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/umlobject.cpp:1255
#2  0x005e9db7 in UMLEntity::setAsPrimaryKey (this=this@entry=0x6a4fe38, uconstr=uconstr@entry=0x6a50838)
    at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/entity.cpp:527
#3  0x0060e813 in _fu4155___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/uniqueconstraint.cpp:186
#4  0x006092bb in _fu4109___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/umlobject.cpp:1113
#5  0x005e94df in UMLEntity::load (this=0x6a4fe38, element=...) at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/entity.cpp:489
#6  0x006092bb in _fu4109___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/umlobject.cpp:1113
#7  0x005f3895 in _fu3978___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/folder.cpp:571
#8  0x005f318c in _fu3976___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/folder.cpp:497
#9  0x006092bb in _fu4109___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umlmodel/umlobject.cpp:1113
#10 0x0041e226 in _fu1185___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umldoc.cpp:2628
#11 0x0041e1c7 in _fu1185___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umldoc.cpp:2648
#12 0x00427754 in _fu1200___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umldoc.cpp:2377
#13 0x0042997b in _fu1216___ZN7QString11shared_nullE () at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/umldoc.cpp:715
#14 0x0040ba65 in UMLApp::slotFileOpen (this=0x3f82848) at /home/abuild/rpmbuild/BUILD/umbrello-2.21.0.ec4653c/umbrello/uml.cpp:1349
#15 0x6e426d82 in ?? () from C:\Users\admin\Downloads\umbrello-2.21.0.ec4653c\bin\QtCore4.dll
#16 0x6790f2cb in ?? () from C:\Users\admin\Downloads\umbrello-2.21.0.ec4653c\bin\QtGui4.dll

According to http://stackoverflow.com/questions/14243854/c-dynamic-cast-causes-a-segfault-even-when-the-object-that-is-casted-is-not-n there may be several reasons for a dynamic_cast crash. Unfortunally I cannot see yet why calling dynamic_cast(0) could fail: http://stackoverflow.com/questions/5155820/portably-safe-to-pass-null-zero-to-dynamic-cast mentions that it should be possible.
Comment 15 Ralf Habacker 2017-01-03 11:25:50 UTC
(In reply to Ralf Habacker from comment #14)
> Unfortunally I cannot see yet why calling dynamic_cast(0) could fail:
> http://stackoverflow.com/questions/5155820/portably-safe-to-pass-null-zero-
> to-dynamic-cast mentions that it should be possible.

It turned out that this a windows only gcc issue.

For the following method 

    UMLClassifier* UMLObject::asUMLClassifier() { return dynamic_cast<UMLClassifier*>(this); }

the following assembler code is created on linux:

_ZN9UMLObject15asUMLClassifierEv:
        testq   %rdi, %rdi 
        je      .L152
        xorl    %ecx, %ecx
        movl    $_ZTI13UMLClassifier, %edx
        movl    $_ZTI9UMLObject, %esi
        jmp     __dynamic_cast
.L152:
        xorl    %eax, %eax
        ret

The first codes in method checks against null pointer parameter. 
>        testq   %rdi, %rdi 
>        je      .L152

on windows: 

__ZN9UMLObject15asUMLClassifierEv:
        subl    $28, %esp
        movl    $0, 12(%esp)
        movl    $__ZTI13UMLClassifier, 8(%esp)
        movl    $__ZTI9UMLObject, 4(%esp)
        movl    %ecx, (%esp)
        call    ___dynamic_cast
        addl    $28, %esp
        ret

-> there is no null pointer check
Comment 16 Ralf Habacker 2017-01-03 13:14:15 UTC
Git commit 5b81af759c24895892d8c628fd610ff43f16fd2c by Ralf Habacker.
Committed on 03/01/2017 at 12:47.
Pushed by habacker into branch 'Applications/16.12'.

Make UMLObject::asUMLxxx() methods able to handle zero pointer as parameter on windows.

gcc implementation of dynamic_cast consists of an inline part and a
function performing the real cast.

On linux (and may be other platforms) the inline part checks against
null pointer parameter. This check is missing in the related windows
implementation (at least with gcc 6.2) and results into a segfault
on accessing the virtual table in the casting function.

The fix is done using a gcc asm statement to prevent removing by the
optimizer because 'this' parameter is marked as 'notnull' by default.

This patch includes also a few dynamic_cast checks added to the unit
tests.
FIXED-IN:2.21.1 (KDE Applications 16.12.1)

M  +43   -28   umbrello/umlmodel/umlobject.cpp
M  +17   -0    unittests/testbasictypes.cpp
M  +11   -0    unittests/testumlobject.cpp
M  +1    -0    unittests/testumlobject.h

https://commits.kde.org/umbrello/5b81af759c24895892d8c628fd610ff43f16fd2c
Comment 17 Ralf Habacker 2017-01-04 11:09:05 UTC
(In reply to Ralf Habacker from comment #15)
> on windows: 
> 
> __ZN9UMLObject15asUMLClassifierEv:
>         subl    $28, %esp
>         movl    $0, 12(%esp)
>         movl    $__ZTI13UMLClassifier, 8(%esp)
>         movl    $__ZTI9UMLObject, 4(%esp)
>         movl    %ecx, (%esp)
>         call    ___dynamic_cast
>         addl    $28, %esp
>         ret
> 
> -> there is no null pointer check
The reason why there is no null pointer check with cross-gcc 6.2 is probably because 'this' pointer is marked as to be "notnull". 

https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#Common-Function-Attributes states: 
"... The nonnull attribute specifies that some function parameters should be non-null pointers. .... The compiler may also choose to make optimizations based on the knowledge that certain function arguments will never be null. ..."

In the opposite gcc 5.x on linux adds this check
Comment 18 Ralf Habacker 2017-01-04 13:31:35 UTC
Git commit 21bcc9a769bb0813f313955586f5fe8572e0c228 by Ralf Habacker.
Committed on 04/01/2017 at 13:31.
Pushed by habacker into branch 'Applications/16.12'.

Fix 'Crash when adding message to sequence diagram'.

To support gcc 6.2 on linux it is required to guard
the dynamic_cast's there too.
Related: bug 374530
FIXED-IN:2.21.1 (KDE Applications 16.12.1)

M  +0    -4    umbrello/umlmodel/umlobject.cpp

https://commits.kde.org/umbrello/21bcc9a769bb0813f313955586f5fe8572e0c228