Bug 392497 - kdenlive crashing in frei0r scurves with double free
Summary: kdenlive crashing in frei0r scurves with double free
Status: RESOLVED UPSTREAM
Alias: None
Product: kdenlive
Classification: Applications
Component: Effects & Transitions (show other bugs)
Version: 17.12.3
Platform: unspecified Linux
: NOR crash
Target Milestone: ---
Assignee: Vincent PINON
URL:
Keywords: drkonqi
: 397176 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-03-29 18:06 UTC by Perry Harrington
Modified: 2018-08-31 23:20 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Perry Harrington 2018-03-29 18:06:11 UTC
Application: kdenlive (17.12.2)

Qt Version: 5.9.4
Frameworks Version: 5.44.0
Operating System: Linux 4.15.12-301.fc27.x86_64 x86_64
Distribution: "Fedora release 27 (Twenty Seven)"

-- Information about the crash:
- What I was doing when the application crashed:

Last week I created a custom set of S curves and lift/gamm/gain for color grading cine type footage.  It worked last week, then I rebooted (and added color calibration with xcalib) and now kdenlive is crashing every time.

I ran rpm -Va to check all files on my system, to ensure none were modified or missing.  I also made certain that kdenlive was using all of the libraries from the standard repos (I had previously compiled MLT with GPU support, but stopped using that).

To reproduce, I just pull in an AVCHD clip, then apply an S curve under 'color correction'.

The GDB stack trace shows what appears to be a double free, since it crashes in _int_free().

The crash is happening in thread 25 the curve plugin for frei0r.

The crash can be reproduced every time.

-- Backtrace:
Application: Kdenlive (kdenlive), signal: Aborted
Using host libthread_db library "/lib64/libthread_db.so.1".
[Current thread is 1 (Thread 0x7f356c9e6940 (LWP 18801))]

Thread 29 (Thread 0x7f349f656700 (LWP 18853)):
#0  0x00007f35605d9d66 in ppoll () at /lib64/libc.so.6
#1  0x00007f3555f4b131 in pa_mainloop_poll () at /lib64/libpulse.so.0
#2  0x00007f3555f4b740 in pa_mainloop_iterate () at /lib64/libpulse.so.0
#3  0x00007f34d915abad in PULSE_WaitAudio () at /lib64/libSDL-1.2.so.0
#4  0x00007f34d912e7fc in SDL_RunAudio () at /lib64/libSDL-1.2.so.0
#5  0x00007f34d9136e38 in SDL_RunThread () at /lib64/libSDL-1.2.so.0
#6  0x00007f34d9179579 in RunThread () at /lib64/libSDL-1.2.so.0
#7  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#8  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 28 (Thread 0x7f349fe57700 (LWP 18852)):
#0  0x00007f355eb7ab1d in __lll_lock_wait () at /lib64/libpthread.so.0
#1  0x00007f355eb73ea3 in pthread_mutex_lock () at /lib64/libpthread.so.0
#2  0x00007f356ba47fa0 in mlt_pool_alloc () at /lib64/libmlt.so.6
#3  0x00007f34d86a9b27 in convert_image () at /usr/lib64/mlt/libmltavformat.so
#4  0x00007f356ba2f78e in mlt_frame_get_image () at /lib64/libmlt.so.6
#5  0x00007f356ba459c9 in producer_get_image () at /lib64/libmlt.so.6
#6  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#7  0x00007f356ba42295 in consumer_worker_thread () at /lib64/libmlt.so.6
#8  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#9  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 27 (Thread 0x7f34a0658700 (LWP 18851)):
#0  0x00007f355eb7ab1d in __lll_lock_wait () at /lib64/libpthread.so.0
#1  0x00007f355eb73ea3 in pthread_mutex_lock () at /lib64/libpthread.so.0
#2  0x00007f356ba47fa0 in mlt_pool_alloc () at /lib64/libmlt.so.6
#3  0x00007f34d86a9b27 in convert_image () at /usr/lib64/mlt/libmltavformat.so
#4  0x00007f356ba2f78e in mlt_frame_get_image () at /lib64/libmlt.so.6
#5  0x00007f34d88c497e in filter_get_image () at /usr/lib64/mlt/libmltplus.so
#6  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#7  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#8  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#9  0x00007f34d8af7f5e in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () at /usr/lib64/mlt/libmltqt.so
#10 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#11 0x00007f356ba459c9 in producer_get_image () at /lib64/libmlt.so.6
#12 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#13 0x00007f356ba42295 in consumer_worker_thread () at /lib64/libmlt.so.6
#14 0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#15 0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 26 (Thread 0x7f34a0e59700 (LWP 18850)):
#0  0x00007f35605f11dc in __lll_lock_wait_private () at /lib64/libc.so.6
#1  0x00007f356056d3f8 in arena_get_retry () at /lib64/libc.so.6
#2  0x00007f356057110c in malloc () at /lib64/libc.so.6
#3  0x00007f356ba47fbb in mlt_pool_alloc () at /lib64/libmlt.so.6
#4  0x00007f34d86a9b27 in convert_image () at /usr/lib64/mlt/libmltavformat.so
#5  0x00007f34d95d2074 in filter_get_image () at /usr/lib64/mlt/libmltxine.so
#6  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#7  0x00007f34da172bd5 in get_image () at /usr/lib64/mlt/libmltcore.so
#8  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#9  0x00007f34da1717c9 in filter_get_image () at /usr/lib64/mlt/libmltcore.so
#10 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#11 0x00007f34da176f4d in filter_get_image () at /usr/lib64/mlt/libmltcore.so
#12 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#13 0x00007f34da177484 in filter_get_image () at /usr/lib64/mlt/libmltcore.so
#14 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#15 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#16 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#17 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#18 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#19 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#20 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#21 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#22 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#23 0x00007f34d88c497e in filter_get_image () at /usr/lib64/mlt/libmltplus.so
#24 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#25 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#26 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#27 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#28 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#29 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#30 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#31 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#32 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#33 0x00007f34d88c497e in filter_get_image () at /usr/lib64/mlt/libmltplus.so
#34 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#35 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#36 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#37 0x00007f34d8af7f5e in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () at /usr/lib64/mlt/libmltqt.so
#38 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#39 0x00007f356ba459c9 in producer_get_image () at /lib64/libmlt.so.6
#40 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#41 0x00007f356ba42295 in consumer_worker_thread () at /lib64/libmlt.so.6
#42 0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#43 0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 25 (Thread 0x7f34a165a700 (LWP 18849)):
[KCrash Handler]
#6  0x00007f3560523660 in raise () at /lib64/libc.so.6
#7  0x00007f3560524c41 in abort () at /lib64/libc.so.6
#8  0x00007f3560565f17 in __libc_message () at /lib64/libc.so.6
#9  0x00007f356056c21a in  () at /lib64/libc.so.6
#10 0x00007f356056e000 in _int_free () at /lib64/libc.so.6
#11 0x00007f34bc17888c in updateCsplineMap () at /usr/lib64/frei0r-1/curves.so
#12 0x00007f35033ed17a in process_frei0r_item () at /usr/lib64/mlt/libmltfrei0r.so
#13 0x00007f35033ecb8f in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#14 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#15 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#16 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#17 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#18 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#19 0x00007f35033ecb30 in filter_get_image () at /usr/lib64/mlt/libmltfrei0r.so
#20 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#21 0x00007f34d88c497e in filter_get_image () at /usr/lib64/mlt/libmltplus.so
#22 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#23 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#24 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#25 0x00007f34d8af7f5e in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () at /usr/lib64/mlt/libmltqt.so
#26 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#27 0x00007f356ba459c9 in producer_get_image () at /lib64/libmlt.so.6
#28 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#29 0x00007f356ba42295 in consumer_worker_thread () at /lib64/libmlt.so.6
#30 0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#31 0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 24 (Thread 0x7f34a1e5b700 (LWP 18848)):
#0  0x00007f355eb7ab1d in __lll_lock_wait () at /lib64/libpthread.so.0
#1  0x00007f355eb73ea3 in pthread_mutex_lock () at /lib64/libpthread.so.0
#2  0x00007f356ba47fa0 in mlt_pool_alloc () at /lib64/libmlt.so.6
#3  0x00007f34d86a9b27 in convert_image () at /usr/lib64/mlt/libmltavformat.so
#4  0x00007f356ba2f78e in mlt_frame_get_image () at /lib64/libmlt.so.6
#5  0x00007f34d88c497e in filter_get_image () at /usr/lib64/mlt/libmltplus.so
#6  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#7  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#8  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#9  0x00007f34d8af7f5e in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () at /usr/lib64/mlt/libmltqt.so
#10 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#11 0x00007f356ba459c9 in producer_get_image () at /lib64/libmlt.so.6
#12 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#13 0x00007f356ba42295 in consumer_worker_thread () at /lib64/libmlt.so.6
#14 0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#15 0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 23 (Thread 0x7f34a265c700 (LWP 18847)):
#0  0x00007f355eb7ab1d in __lll_lock_wait () at /lib64/libpthread.so.0
#1  0x00007f355eb73ea3 in pthread_mutex_lock () at /lib64/libpthread.so.0
#2  0x00007f356ba47fa0 in mlt_pool_alloc () at /lib64/libmlt.so.6
#3  0x00007f34d86a9b27 in convert_image () at /usr/lib64/mlt/libmltavformat.so
#4  0x00007f356ba2f78e in mlt_frame_get_image () at /lib64/libmlt.so.6
#5  0x00007f34d88c497e in filter_get_image () at /usr/lib64/mlt/libmltplus.so
#6  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#7  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#8  0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#9  0x00007f34d8af7f5e in get_image(mlt_frame_s*, unsigned char**, mlt_image_format*, int*, int*, int) () at /usr/lib64/mlt/libmltqt.so
#10 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#11 0x00007f356ba459c9 in producer_get_image () at /lib64/libmlt.so.6
#12 0x00007f356ba2f72f in mlt_frame_get_image () at /lib64/libmlt.so.6
#13 0x00007f356ba42295 in consumer_worker_thread () at /lib64/libmlt.so.6
#14 0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#15 0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 22 (Thread 0x7f34a2e5d700 (LWP 18846)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f34d93c8071 in consumer_thread () at /usr/lib64/mlt/libmltsdl.so
#2  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#3  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 21 (Thread 0x7f34affff700 (LWP 18827)):
#0  0x00007f35605d5738 in read () at /lib64/libc.so.6
#1  0x00007f3558f1a0a0 in g_wakeup_acknowledge () at /lib64/libglib-2.0.so.0
#2  0x00007f3558ed59a8 in g_main_context_check () at /lib64/libglib-2.0.so.0
#3  0x00007f3558ed5e40 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#4  0x00007f3558ed5fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#5  0x00007f356142fc4b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#6  0x00007f35613dd96a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#7  0x00007f356122e8ca in QThread::exec() () at /lib64/libQt5Core.so.5
#8  0x00007f3561232de2 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#9  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#10 0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 20 (Thread 0x7f34bcb7c700 (LWP 18826)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f3558ed5e99 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f3558ed5fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007f356142fc4b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#4  0x00007f35613dd96a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#5  0x00007f356122e8ca in QThread::exec() () at /lib64/libQt5Core.so.5
#6  0x00007f3561232de2 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#7  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#8  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 19 (Thread 0x7f34bd37d700 (LWP 18825)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 18 (Thread 0x7f34beb8e700 (LWP 18823)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f3558ed5e99 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f3558ed5fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007f356142fc4b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#4  0x00007f35613dd96a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#5  0x00007f356122e8ca in QThread::exec() () at /lib64/libQt5Core.so.5
#6  0x00007f3562558e75 in QQmlThreadPrivate::run() () at /lib64/libQt5Qml.so.5
#7  0x00007f3561232de2 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#8  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#9  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 17 (Thread 0x7f34bf7ff700 (LWP 18822)):
#0  0x00007f355eb77b5b in pthread_cond_timedwait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f3561233423 in QWaitCondition::wait(QMutex*, unsigned long) () at /lib64/libQt5Core.so.5
#2  0x00007f356122fda2 in QThreadPoolThread::run() () at /lib64/libQt5Core.so.5
#3  0x00007f3561232de2 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#4  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#5  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 16 (Thread 0x7f34c530f700 (LWP 18821)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f3558ed5e99 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f3558ed5fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007f356142fc4b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#4  0x00007f35613dd96a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#5  0x00007f356122e8ca in QThread::exec() () at /lib64/libQt5Core.so.5
#6  0x00007f3562558e75 in QQmlThreadPrivate::run() () at /lib64/libQt5Qml.so.5
#7  0x00007f3561232de2 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#8  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#9  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 15 (Thread 0x7f34dbb3b700 (LWP 18815)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f34f7ccabc1 in linux_udev_event_thread_main () at /lib64/libusb-1.0.so.0
#2  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#3  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 14 (Thread 0x7f351c80a700 (LWP 18814)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f3558ed5e99 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f3558ed5fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007f356142fc4b in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#4  0x00007f35613dd96a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#5  0x00007f356122e8ca in QThread::exec() () at /lib64/libQt5Core.so.5
#6  0x00007f3566dbc449 in QDBusConnectionManager::run() () at /lib64/libQt5DBus.so.5
#7  0x00007f3561232de2 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#8  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#9  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 13 (Thread 0x7f351effd700 (LWP 18813)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 12 (Thread 0x7f351f7fe700 (LWP 18812)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 11 (Thread 0x7f351ffff700 (LWP 18811)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 10 (Thread 0x7f352cafd700 (LWP 18810)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 9 (Thread 0x7f3534b94700 (LWP 18809)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 8 (Thread 0x7f3535395700 (LWP 18808)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 7 (Thread 0x7f3535b96700 (LWP 18807)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 6 (Thread 0x7f3536397700 (LWP 18806)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f35373e2f4b in util_queue_thread_func () at /usr/lib64/dri/radeonsi_dri.so
#2  0x00007f35373e2e67 in impl_thrd_routine () at /usr/lib64/dri/radeonsi_dri.so
#3  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#4  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 5 (Thread 0x7f353dc6f700 (LWP 18805)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f3558ed5e99 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f3558ed6232 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#3  0x00007f355a7e6b56 in gdbus_shared_thread_func () at /lib64/libgio-2.0.so.0
#4  0x00007f3558efd486 in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#6  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 4 (Thread 0x7f353e470700 (LWP 18804)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f3558ed5e99 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f3558ed5fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007f3558ed5ff1 in glib_worker_main () at /lib64/libglib-2.0.so.0
#4  0x00007f3558efd486 in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#6  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 3 (Thread 0x7f3547401700 (LWP 18803)):
#0  0x00007f35605d9c6b in poll () at /lib64/libc.so.6
#1  0x00007f355d7d3fe7 in _xcb_conn_wait () at /lib64/libxcb.so.1
#2  0x00007f355d7d5dda in xcb_wait_for_event () at /lib64/libxcb.so.1
#3  0x00007f3549563bf9 in QXcbEventReader::run() () at /lib64/libQt5XcbQpa.so.5
#4  0x00007f3561232de2 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#5  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#6  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 2 (Thread 0x7f35511ed700 (LWP 18802)):
#0  0x00007f355eb7782d in pthread_cond_wait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f3560ebce0c in std::condition_variable::wait(std::unique_lock<std::mutex>&) () at /lib64/libstdc++.so.6
#2  0x00007f35650f0bb7 in bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadRunLoop() () at /lib64/libQt5WebKit.so.5
#3  0x00007f35650f0cf9 in  () at /lib64/libQt5WebKit.so.5
#4  0x00007f3560ec314f in execute_native_thread_routine () at /lib64/libstdc++.so.6
#5  0x00007f355eb7150b in start_thread () at /lib64/libpthread.so.0
#6  0x00007f35605e416f in clone () at /lib64/libc.so.6

Thread 1 (Thread 0x7f356c9e6940 (LWP 18801)):
#0  0x00007f35605f11dc in __lll_lock_wait_private () at /lib64/libc.so.6
#1  0x00007f35605718be in realloc () at /lib64/libc.so.6
#2  0x00007f3561233859 in QArrayData::reallocateUnaligned(QArrayData*, unsigned long, unsigned long, QFlags<QArrayData::AllocationOption>) () at /lib64/libQt5Core.so.5
#3  0x00007f356129ff8a in QString::reallocData(unsigned int, bool) () at /lib64/libQt5Core.so.5
#4  0x00007f35612a0015 in QString::resize(int) () at /lib64/libQt5Core.so.5
#5  0x00007f35612a5979 in QString::vasprintf(char const*, __va_list_tag*) () at /lib64/libQt5Core.so.5
#6  0x00007f356121ed4b in qt_message(QtMsgType, QMessageLogContext const&, char const*, __va_list_tag*) () at /lib64/libQt5Core.so.5
#7  0x00007f356121fafd in QMessageLogger::warning(char const*, ...) const () at /lib64/libQt5Core.so.5
#8  0x00007f356142fab9 in socketNotifierSourceCheck(_GSource*) () at /lib64/libQt5Core.so.5
#9  0x00007f3558ed58c9 in g_main_context_check () at /lib64/libglib-2.0.so.0
#10 0x00007f3558ed5e40 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#11 0x00007f3558ed5fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#12 0x00007f356142fc2f in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#13 0x00007f35613dd96a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#14 0x00007f35613e6094 in QCoreApplication::exec() () at /lib64/libQt5Core.so.5
#15 0x000055a9e96256f1 in main ()

Reported using DrKonqi
Comment 1 Perry Harrington 2018-03-29 18:57:21 UTC
I installed debuginfos for everything (like 1.6GB worth!) and ran it in GDB, this is the backtrace:

free(): corrupted unsorted chunks

Thread 35 "kdenlive" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fff2c9c9700 (LWP 24827)]
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51	}
Missing separate debuginfos, use: dnf debuginfo-install ffmpeg-libs-3.4.2-1.fc27.x86_64 kvazaar-libs-1.2.0-1.fc27.x86_64 libavdevice-3.4.2-1.fc27.x86_64 libfdk-aac-0.1.5-7.fc27.x86_64 librtmp-2.4-8.20151223gitfa8646d.fc27.x86_64 openh264-libs-1.7.0-1.fc27.x86_64 x264-libs-0.152-13.20171224gite9a5903.fc27.x86_64 x265-libs-2.6-1.fc27.x86_64
(gdb) bt
#0  0x00007fffeba51660 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007fffeba52c41 in __GI_abort () at abort.c:79
#2  0x00007fffeba93f17 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7fffebb99677 "%s\n")
    at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007fffeba9a21a in malloc_printerr (str=str@entry=0x7fffebb9b2c8 "free(): corrupted unsorted chunks") at malloc.c:5368
#4  0x00007fffeba9c258 in _int_free (av=0x7fff14000020, p=0x7ffeec0c30a0, have_lock=<optimized out>) at malloc.c:4325
#5  0x00007fff3c455bec in updateCsplineMap (instance=0x7fff23058480) at filter/curves/curves.c:763
#6  0x00007fffa03fe17a in process_frei0r_item (service=service@entry=0x55555a43a9e0, position=position@entry=228, time=7.5999999999999996, prop=prop@entry=0x55555a43a9e0, this=this@entry=0x7fff0e847700, image=image@entry=0x7fff2c9c8a48, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44) at frei0r_helper.c:119
#7  0x00007fffa03fdb8f in filter_get_image (this=this@entry=0x7fff0e847700, image=image@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
    at filter_frei0r.c:39
#8  0x00007ffff6f5d72f in mlt_frame_get_image (self=self@entry=0x7fff0e847700, buffer=buffer@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
    at mlt_frame.c:585
#9  0x00007fffa03fdb30 in filter_get_image (this=this@entry=0x7fff0e847700, image=image@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
    at filter_frei0r.c:32
#10 0x00007ffff6f5d72f in mlt_frame_get_image (self=self@entry=0x7fff0e847700, buffer=buffer@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
    at mlt_frame.c:585
#11 0x00007fffa03fdb30 in filter_get_image (this=this@entry=0x7fff0e847700, image=image@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
    at filter_frei0r.c:32
#12 0x00007ffff6f5d72f in mlt_frame_get_image (self=self@entry=0x7fff0e847700, buffer=buffer@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
    at mlt_frame.c:585
#13 0x00007fffa03fdb30 in filter_get_image (this=this@entry=0x7fff0e847700, image=image@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=1)
    at filter_frei0r.c:32
#14 0x00007ffff6f5d72f in mlt_frame_get_image (self=self@entry=0x7fff0e847700, buffer=buffer@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=1)
    at mlt_frame.c:585
#15 0x00007fff63b2197e in filter_get_image (frame=frame@entry=0x7fff0e847700, image=image@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=1, writable@entry=0)
    at filter_lift_gamma_gain.c:174
#16 0x00007ffff6f5d72f in mlt_frame_get_image (self=self@entry=0x7fff0e847700, buffer=buffer@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
    at mlt_frame.c:585
#17 0x00007fffa03fdb30 in filter_get_image (this=this@entry=0x7fff0e847700, image=image@entry=0x7fff2c9c8a48, format=format@entry=0x7fff2c9c8cac, width=width@entry=0x7fff2c9c8a40, height=height@entry=0x7fff2c9c8a44, writable=writable@entry=0)
---Type <return> to continue, or q <return> to quit---q
 at filter_frei0r.c:32Quit

And the stack frames:

(gdb) up
#1  0x00007fffeba52c41 in __GI_abort () at abort.c:79
79	      raise (SIGABRT);
(gdb) up
#2  0x00007fffeba93f17 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7fffebb99677 "%s\n")
    at ../sysdeps/posix/libc_fatal.c:181
181	      abort ();
(gdb) up
#3  0x00007fffeba9a21a in malloc_printerr (str=str@entry=0x7fffebb9b2c8 "free(): corrupted unsorted chunks") at malloc.c:5368
5368	  __libc_message (do_abort, "%s\n", str);
(gdb) up
#4  0x00007fffeba9c258 in _int_free (av=0x7fff14000020, p=0x7ffeec0c30a0, have_lock=<optimized out>) at malloc.c:4325
4325		malloc_printerr ("free(): corrupted unsorted chunks");
(gdb) up
#5  0x00007fff3c455bec in updateCsplineMap (instance=0x7fff23058480) at filter/curves/curves.c:763
763	filter/curves/curves.c: No such file or directory.

Unfortunately, filter/curves/curves.c does not show up in whatprovides, so I'm not sure what package contains this source.
Comment 2 Perry Harrington 2018-03-29 19:52:55 UTC
OK, this is all really goofy.

I tried deleting all the kdenlive settings, because this looked like a settings issue, that didn't work.

I created a new unix user and ran kdenlive under that user without any problems.

Soo, something is borked with my environment for my normal user.

Doesn't look like an actual bug.

Sorry.
Comment 3 Perry Harrington 2018-03-29 20:00:40 UTC
Ok, just nuked ALL of my KDE configs and kdenlive works again.

Now I'll try putting my kdenlive config back.

Thanks for tolerating me!
Comment 4 Christoph Feck 2018-03-30 04:21:01 UTC
Just in case you are going to report this upstream and need the debug information: Your original backtrace said:

    updateCsplineMap () at /usr/lib64/frei0r-1/curves.so

This looks like a frei0r plugin, which might have a separate debug information package.
Comment 5 Christoph Feck 2018-08-31 23:20:14 UTC
*** Bug 397176 has been marked as a duplicate of this bug. ***