Bug 381284 - Double-delete in KateScriptActionMenu::cleanup()
Summary: Double-delete in KateScriptActionMenu::cleanup()
Status: RESOLVED FIXED
Alias: None
Product: frameworks-ktexteditor
Classification: Frameworks and Libraries
Component: general (other bugs)
Version First Reported In: unspecified
Platform: Other Linux
: NOR crash
Target Milestone: ---
Assignee: KWrite Developers
URL:
Keywords: regression
Depends on:
Blocks:
 
Reported: 2017-06-16 14:44 UTC by Kevin Funk
Modified: 2017-07-23 07:51 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kevin Funk 2017-06-16 14:44:35 UTC
KDevelop master, Qt 5.8, KF5 master.

This doesn't seem to be a problem with my other combo: KDevelop 5.1, Qt 5.7, KF5 5.34. So something must have changed/regressed.

Howto reproduce:
valgrind --track-origins=yes ./plugins/quickopen/tests/test_quickopen testProjectFileFilter 

Valgrind trace:
==24170== Invalid read of size 8
==24170==    at 0x8B9E298: QObject::~QObject() (qobject.cpp:934)
==24170==    by 0x8B9E82B: QObject::~QObject() (qobject.cpp:1049)
==24170==    by 0x6644130: void qDeleteAll<QList<QMenu*>::const_iterator>(QList<QMenu*>::const_iterator, QList<QMenu*>::const_iterator) (qalgorithms.h:320)
==24170==    by 0x66438C5: void qDeleteAll<QList<QMenu*> >(QList<QMenu*> const&) (qalgorithms.h:328)
==24170==    by 0x6643622: KateScriptActionMenu::cleanup() (katescriptaction.cpp:90)
==24170==    by 0x66435C6: KateScriptActionMenu::~KateScriptActionMenu() (katescriptaction.cpp:84)
==24170==    by 0x6643678: KateScriptActionMenu::~KateScriptActionMenu() (katescriptaction.cpp:83)
==24170==    by 0x8BA0259: QObjectPrivate::deleteChildren() (qobject.cpp:1970)
==24170==    by 0x7ACCBF0: QWidget::~QWidget() (qwidget.cpp:1694)
==24170==    by 0x67630BE: KTextEditor::View::~View() (ktexteditor.cpp:163)
==24170==    by 0x66D3F99: KTextEditor::ViewPrivate::~ViewPrivate() (kateview.cpp:272)
==24170==    by 0x66D4078: KTextEditor::ViewPrivate::~ViewPrivate() (kateview.cpp:247)
==24170==  Address 0x2c44f2e0 is 80 bytes inside a block of size 888 free'd
==24170==    at 0x4C2F25B: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24170==    by 0x7C9369A: QMenuPrivate::~QMenuPrivate() (qmenu_p.h:288)
==24170==    by 0x8BAB7E9: QScopedPointerDeleter<QObjectData>::cleanup(QObjectData*) (qscopedpointer.h:60)
==24170==    by 0x8BA9C6E: QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::~QScopedPointer() (qscopedpointer.h:107)
==24170==    by 0x8B9E7F2: QObject::~QObject() (qobject.cpp:900)
==24170==    by 0x7ACCCBA: QWidget::~QWidget() (qwidget.cpp:1555)
==24170==    by 0x7C89C2A: QMenu::~QMenu() (qmenu.cpp:1583)
==24170==    by 0x7C89C63: QMenu::~QMenu() (qmenu.cpp:1600)
==24170==    by 0x8BA0259: QObjectPrivate::deleteChildren() (qobject.cpp:1970)
==24170==    by 0x7ACCBF0: QWidget::~QWidget() (qwidget.cpp:1694)
==24170==    by 0x7C89C2A: QMenu::~QMenu() (qmenu.cpp:1583)
==24170==    by 0x7C89C63: QMenu::~QMenu() (qmenu.cpp:1600)
==24170==  Block was alloc'd at
==24170==    at 0x4C2E19F: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24170==    by 0x7C89958: QMenu::QMenu(QWidget*) (qmenu.cpp:1549)
==24170==    by 0x7C89A00: QMenu::QMenu(QString const&, QWidget*) (qmenu.cpp:1565)
==24170==    by 0x7C89F50: QMenu::addMenu(QString const&) (qmenu.cpp:1807)
==24170==    by 0x664324C: KateScriptActionMenu::repopulate() (katescriptaction.cpp:138)
==24170==    by 0x6642DCB: KateScriptActionMenu::KateScriptActionMenu(KTextEditor::ViewPrivate*, QString const&) (katescriptaction.cpp:75)
==24170==    by 0x66CC2E7: KTextEditor::ViewPrivate::setupActions() (kateview.cpp:494)
==24170==    by 0x66CB71E: KTextEditor::ViewPrivate::ViewPrivate(KTextEditor::DocumentPrivate*, QWidget*, KTextEditor::MainWindow*) (kateview.cpp:204)
==24170==    by 0x65F5FD5: KTextEditor::DocumentPrivate::createView(QWidget*, KTextEditor::MainWindow*) (katedocument.cpp:419)
==24170==    by 0x4F38C55: KDevelop::TextDocument::createViewWidget(QWidget*) (textdocument.cpp:346)
==24170==    by 0x4F3AD1D: KDevelop::TextView::createWidget(QWidget*) (textdocument.cpp:592)
==24170==    by 0x41AAB97: Sublime::View::widget(QWidget*) (view.cpp:76)
Comment 1 Christoph Cullmann 2017-07-21 17:41:36 UTC
I think that is a destruction order issue.
Will prepare a patch.
The ActionMenu cleans up some objects that have the view as parent, too, and if we have bad luck, they already got destroyed.
Comment 2 Christoph Cullmann 2017-07-21 17:45:08 UTC
See

https://phabricator.kde.org/D6817

For me it doesn't crash, if you can reproduce, please try.
Comment 3 Christoph Cullmann 2017-07-23 07:51:51 UTC
Fixed via https://phabricator.kde.org/D6817