Bug 419111 - krita crashes whith looping calls to setPixelData
Summary: krita crashes whith looping calls to setPixelData
Status: RESOLVED FIXED
Alias: None
Product: krita
Classification: Applications
Component: Scripting (show other bugs)
Version: nightly build (please specify the git hash!)
Platform: macOS (DMG) macOS
: NOR crash
Target Milestone: ---
Assignee: Halla Rempt
URL:
Keywords: triaged
Depends on:
Blocks:
 
Reported: 2020-03-22 14:33 UTC by Manga Tengu
Modified: 2021-12-14 11:34 UTC (History)
1 user (show)

See Also:
Latest Commit: https://invent.kde.org/graphics/krita/commit/68d4ec3e86bc283506626b6a21d542cb4c35b98d
Version Fixed In:
Sentry Crash Report:

Attachments
A very nice script (1.57 KB, text/x-python-script)
2020-03-22 14:33 UTC, Manga Tengu 		Details
View All Add an attachment

Note You need to log in before you can comment on or make changes to this bug.
Description Manga Tengu 2020-03-22 14:33:49 UTC 
Created attachment 126943 [details]
A very nice script

I made a script batch some png in a folder and output corresponding kra files with a white background and a disabled desaturation filter on top

Opening a lot of those png files at once works fine.
Opening 2 or 3 of those files with a loop call to Node.setPixelData to fill a paint layer crashes krita.

STEPS TO REPRODUCE
1. Have a root folder with png subfolder containing 5 A3 300dpi png files and a kra destination like so:
testFoler/
|_png/
|_kra/

2. Adapt the paths in the script (3 of them line 3, 4, 38)
3. Run the script

OBSERVED RESULT
Krita crashes

EXPECTED RESULT
1. Corona virus is destroyed...
2. All png files have an equivalent kra file with a white background and a disabled desaturate 3rd mode desaturation filter and the drawing layer active.

SOFTWARE/OS VERSIONS
Krita 4.3.0-prealpha git 9dffafb but also krita 4.2.8
macOS: Catalina 10.15.3 (19D76)

ADDITIONAL INFORMATION
The script is attached
Comment 1 Halla Rempt 2020-05-06 14:21:48 UTC 
I can confirm the crash:

hread 1 (Thread 0x7f2448db3800 (LWP 28983)):
[KCrash Handler]
#6  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:332
#7  0x00007f24461b2b81 in memcpy (__len=<optimized out>, __src=0x7f239806de28, __dest=0x7f23926ec810) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
#8  KisTiledDataManager::writeBytesBody (this=0x55f142fabb50, data=0x7f2394e71028 '\377' <repeats 200 times>..., x=0, y=<optimized out>, width=6000, height=<optimized out>, dataRowStride=24000) at /home/boud/dev/4.3/libs/image/tiles3/kis_tiled_data_manager_p.h:73
#9  0x00007f24461b30c3 in KisTiledDataManager::writeBytes (this=this@entry=0x55f142fabb50, data=data@entry=0x7f2394e71028 '\377' <repeats 200 times>..., x=x@entry=0, y=y@entry=0, width=width@entry=6000, height=height@entry=4250, dataRowStride=-1) at /home/boud/dev/4.3/libs/image/tiles3/kis_tiled_data_manager.cc:698
#10 0x00007f2446426e4b in KisDataManager::writeBytes (dataRowStride=-1, h=4250, w=6000, y=0, x=0, data=0x7f2394e71028 '\377' <repeats 200 times>..., this=0x55f142fabb50) at /home/boud/dev/4.3/libs/image/kis_datamanager.h:277
#11 KisPaintDevice::Private::KisPaintDeviceStrategy::writeBytesImpl (this=0x55f13a07ec90, data=0x7f2394e71028 '\377' <repeats 200 times>..., rect=..., dataRowStride=-1) at /home/boud/dev/4.3/libs/image/kis_paint_device_strategies.h:173
#12 0x00007f24464143e5 in KisPaintDevice::writeBytes (this=<optimized out>, data=<optimized out>, x=x@entry=0, y=y@entry=0, w=w@entry=6000, h=h@entry=4250) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qrect.h:184
#13 0x00007f23f74d399f in Node::setPixelData (this=<optimized out>, value=..., x=0, y=0, w=6000, h=4250) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qarraydata.h:61
#14 0x00007f23f6c9f8f7 in meth_Node_setPixelData (sipSelf=<optimized out>, sipArgs=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qrefcount.h:60
#15 0x00007f23f793a77b in _PyCFunction_FastCallDict () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#16 0x00007f23f78a344c in ?? () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#17 0x00007f23f78a9563 in _PyEval_EvalFrameDefault () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#18 0x00007f23f78a2c6f in ?? () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#19 0x00007f23f78a372e in PyEval_EvalCodeEx () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#20 0x00007f23f78a44ab in PyEval_EvalCode () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#21 0x00007f23f78af7bd in ?? () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#22 0x00007f23f793a77b in _PyCFunction_FastCallDict () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#23 0x00007f23f78a344c in ?? () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#24 0x00007f23f78a9563 in _PyEval_EvalFrameDefault () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#25 0x00007f23f78a1a63 in ?? () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#26 0x00007f23f78a3085 in _PyFunction_FastCallDict () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#27 0x00007f23f798e211 in _PyObject_FastCallDict () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#28 0x00007f23f798e93d in _PyObject_Call_Prepend () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#29 0x00007f23f798e9a8 in PyObject_Call () from /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0
#30 0x00007f23f695fc80 in ?? () from /usr/lib/python3/dist-packages/PyQt5/QtCore.cpython-36m-x86_64-linux-gnu.so
#31 0x00007f23f6960158 in ?? () from /usr/lib/python3/dist-packages/PyQt5/QtCore.cpython-36m-x86_64-linux-gnu.so
#32 0x00007f23f69603e0 in ?? () from /usr/lib/python3/dist-packages/PyQt5/QtCore.cpython-36m-x86_64-linux-gnu.so
#33 0x00007f23f6960e67 in ?? () from /usr/lib/python3/dist-packages/PyQt5/QtCore.cpython-36m-x86_64-linux-gnu.so
#34 0x00007f24441e50c9 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#35 0x00007f244508d3a2 in QAction::triggered(bool) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#36 0x00007f244508fa0c in QAction::activate(QAction::ActionEvent) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#37 0x00007f2445180adb in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#38 0x00007f2445180d3d in QAbstractButton::mouseReleaseEvent(QMouseEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#39 0x00007f24452727aa in QToolButton::mouseReleaseEvent(QMouseEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#40 0x00007f24450d47f8 in QWidget::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#41 0x00007f2445272844 in QToolButton::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#42 0x00007f24450938bc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#43 0x00007f244509b908 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#44 0x00007f2447a539a9 in KisApplication::notify (this=<optimized out>, receiver=0x55f136cb8b30, event=0x7ffdf41da7b0) at /home/boud/dev/4.3/libs/ui/KisApplication.cpp:680
#45 0x00007f24441a9db8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#46 0x00007f2445099f8f in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool, bool) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#47 0x00007f24450eeeb1 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#48 0x00007f24450f1d1a in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#49 0x00007f24450938bc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#50 0x00007f244509aac0 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#51 0x00007f2447a539a9 in KisApplication::notify (this=<optimized out>, receiver=0x55f13aaeb400, event=0x7ffdf41dacb0) at /home/boud/dev/4.3/libs/ui/KisApplication.cpp:680
#52 0x00007f24441a9db8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#53 0x00007f24447a5f95 in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5
#54 0x00007f24447a70c5 in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5
#55 0x00007f244478001b in QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5
#56 0x00007f2434728c8a in ?? () from /usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#57 0x00007f243b78c417 in g_main_context_dispatch () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#58 0x00007f243b78c650 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#59 0x00007f243b78c6dc in g_main_context_iteration () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#60 0x00007f24442090bc in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#61 0x00007f24441a863a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#62 0x00007f24441b1db0 in QCoreApplication::exec() () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#63 0x000055f128803b47 in main (argc=<optimized out>, argv=0x7ffdf41db378) at /home/boud/dev/4.3/krita/main.cc:593
[Inferior 1 (process 28983) detached]
Comment 2 Halla Rempt 2021-12-14 11:33:44 UTC 
Git commit 3ef8bd460582773fb1a6b6739e798b0017989c1f by Halla Rempt.
Committed on 14/12/2021 at 11:14.
Pushed by rempt into branch 'master'.

Check whether there is enough data before writing to the paint device

The script in bug 419111 created a byte array that was w * h, instead
of w * h * pixelsize, so that caused a crash, but Node::setPixelData
should check whether there is enough data before starting to write.

M  +8    -3    libs/libkis/Node.cpp
M  +2    -1    libs/libkis/Node.h

https://invent.kde.org/graphics/krita/commit/3ef8bd460582773fb1a6b6739e798b0017989c1f
Comment 3 Halla Rempt 2021-12-14 11:34:05 UTC 
Git commit 68d4ec3e86bc283506626b6a21d542cb4c35b98d by Halla Rempt.
Committed on 14/12/2021 at 11:33.
Pushed by rempt into branch 'krita/5.0'.

Check whether there is enough data before writing to the paint device

The script in bug 419111 created a byte array that was w * h, instead
of w * h * pixelsize, so that caused a crash, but Node::setPixelData
should check whether there is enough data before starting to write.
(cherry picked from commit 3ef8bd460582773fb1a6b6739e798b0017989c1f)

M  +8    -3    libs/libkis/Node.cpp
M  +2    -1    libs/libkis/Node.h

https://invent.kde.org/graphics/krita/commit/68d4ec3e86bc283506626b6a21d542cb4c35b98d