Bug 447985 - Crash when painting during extended sessions
Summary: Crash when painting during extended sessions
Status: RESOLVED FIXED
Alias: None
Product: krita
Classification: Applications
Component: General (show other bugs)
Version: 5.0.0
Platform: Appimage Linux
: NOR crash
Target Milestone: ---
Assignee: Krita Bugs
URL:
Keywords:
: 452705 452784 452881 (view as bug list)
Depends on:
Blocks:
 
Reported: 2022-01-05 17:53 UTC by tomtomtomreportingin
Modified: 2022-04-27 19:27 UTC (History)
8 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
system information (14.93 KB, text/plain)
2022-02-23 12:15 UTC, Dmitrii Utkin
Details
stdout log before crash (13.25 KB, text/x-log)
2022-03-07 11:19 UTC, Dmitrii Utkin
Details

Note You need to log in before you can comment on or make changes to this bug.
Description tomtomtomreportingin 2022-01-05 17:53:35 UTC
SUMMARY
Every 2-5 days, I come across a crash in 5.0.0 while sketching for extended periods of time. There is nothing out of the ordinary in the krita.log at the time of crash besides "KRITA DID NOT CLOSE CORRECTLY". I've never had Krita crash like this before the various fixes in the Krita 5 betas, but crashes definitely seem less common after https://bugs.kde.org/show_bug.cgi?id=444516 was fixed.

Since the crash is a bit rare and spontaneous, I cannot currently provide a backtrace. Layer structure generally isn't complex at the time of crash, usually at most a few paint layers and maybe some groups.

STEPS TO REPRODUCE
1. Draw in Krita for 1-2 hours.

OBSERVED RESULT
Krita crashes to desktop.

EXPECTED RESULT
No crash.

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Debian sid
KDE Plasma Version: 5.23.4
KDE Frameworks Version: 5.88.0
Qt Version: 5.12.12 (appimage)
Comment 1 Halla Rempt 2022-01-06 09:27:36 UTC
If you start Krita from the command line, is there any interesting output there?
Comment 2 tomtomtomreportingin 2022-01-07 00:36:34 UTC
This is full output on startup:

Bundle "/home/name/.local/share/krita/bundles/Concept_&_Illustration_v1.2.bundle" is broken. File "brushes/chalk_round_hard.png" is missing
Bundle "/home/name/.local/share/krita/bundles/Concept_&_Illustration_v1.2.bundle" is broken. File "brushes/scratches_rough.gih" is missing
Bundle "/home/name/.local/share/krita/bundles/Concept_&_Illustration_v1.2.bundle" is broken. File "paintoppresets/1)Basic_flat_diagonal_2_backup_2020-05-06-175552.kpp" is missing
Duplicated UUID "8c009e3d-13e5-4924-aa13-76bf0ad803c2" for styles "New Style" and "blah"
Could not load the resource from the bundle "paintoppresets" "paintoppresets/Special_dyna_dots.kpp" "/home/name/.local/share/krita/Krita_3_Default_Resources.bundle"
Could not load the resource from the bundle "palettes" "palettes/Pastel5x2.kpl" "/home/name/.local/share/krita/bundles/Digital_Atelier.bundle"
libpng warning: Exceeded size limit while expanding chunk
Could not load the resource from the bundle "paintoppresets" "paintoppresets/rst) Leather.kpp" "/home/name/.local/share/krita/bundles/Rakurri_Brush_Set_V2.0.bundle"
QObject::startTimer: Timers cannot have negative intervals
Could not find platform independent libraries <prefix>
Could not find platform dependent libraries <exec_prefix>
Consider setting $PYTHONHOME to <prefix>[:<exec_prefix>]
/tmp/.mount_krita-8d6kVl/usr/lib/krita-python-libs/krita added to PYTHONPATH

I do not generally have the above bundles enabled so I wouldn't think their breakage is relevant.
Comment 3 Dmitrii Utkin 2022-02-23 12:15:47 UTC
Created attachment 147072 [details]
system information

I faced the same issue. It occurs after hour-two of painting session (sometimes faster). I suspect the system uptime may affect how often it occurs. Long uptime (few days) or if the system was suspended and it occurs more often. Also probably the NVIDIA drivers could be the reason, because canvas doesn't appear right (semitransparent/incomplete) after system suspend/resume and I had to restart Krita.
On the current project it happened about 6-7 times and I had to re-draw some parts again and again (quite annoying), though auto-save is set to 2 minutes..

GDB backtrace doesn't show somewhat useful:

-------------------------------------------------------------
Thread 1 "krita" received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff529f039 in QMetaObject::cast(QObject const*) const () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#2  0x00007ffff5ed2ba9 in QMdiArea::eventFilter(QObject*, QEvent*) () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Widgets.so.5
#3  0x00007ffff529513d in QCoreApplicationPrivate::sendThroughApplicationEventFilters(QObject*, QEvent*) ()
   from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#4  0x00007ffff5d72918 in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Widgets.so.5
#5  0x00007ffff5d79f20 in QApplication::notify(QObject*, QEvent*) () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Widgets.so.5
#6  0x00007ffff7af0d92 in KisApplication::notify(QObject*, QEvent*) () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libkritaui.so.17
#7  0x00007ffff52954f8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#8  0x00007ffff52981aa in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) ()
   from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#9  0x00007ffff52ef233 in ?? () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#10 0x00007fffee96f17d in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#11 0x00007fffee96f400 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007fffee96f4a3 in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007ffff52ee81f in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#14 0x00007ffff5293a8a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#15 0x00007ffff529c804 in QCoreApplication::exec() () from /tmp/.mount_krita.9woNKY/usr/bin/../lib/libQt5Core.so.5
#16 0x0000000000407750 in main ()
-------------------------------------------------------------

I'll try with debug build, but I'm not sure if it add more info.
Comment 4 Dmitrii Utkin 2022-02-24 17:35:35 UTC
I managed to reproduce it on local build. Unfortunately the `event` variable was optimized out (release with debug info build). But at least we know it came from KisApplication.cpp:756

----------------------------------------------------------------------------------------------------------
                }
            } else {
                result = QApplication::notify(receiver, event);  <<---- this line
            }
        }

        if (!info.eventRecursionCount) {
----------------------------------------------------------------------------------------------------------

backtrace
----------------------------------------------------------------------------------------------------------
(gdb) bt
#0  0x00007ffff5e6d64c in QMetaObject::cast(QObject const*) const () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#1  0x00007ffff69ebc20 in QMdiArea::eventFilter(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#2  0x00007ffff5e643eb in QCoreApplicationPrivate::sendThroughApplicationEventFilters(QObject*, QEvent*) ()
    at /lib/x86_64-linux-gnu/libQt5Core.so.5
#3  0x00007ffff687caa0 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#4  0x00007ffff68860f0 in QApplication::notify(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#5  0x00007ffff7cddd3c in KisApplication::notify(QObject*, QEvent*)
    (this=<optimized out>, receiver=<optimized out>, event=<optimized out>)
    at /home/dem/kritadev/krita/libs/ui/KisApplication.cpp:756
#6  0x00007ffff5e6480a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#7  0x00007ffff5e67488 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) ()
    at /lib/x86_64-linux-gnu/libQt5Core.so.5
#8  0x00007ffff5ebce37 in  () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#9  0x00007ffff36ed17d in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#10 0x00007ffff36ed400 in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#11 0x00007ffff36ed4a3 in g_main_context_iteration () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007ffff5ebc435 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
    at /lib/x86_64-linux-gnu/libQt5Core.so.5
#13 0x00007ffff5e633ab in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#14 0x00007ffff5e6b116 in QCoreApplication::exec() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#15 0x000055555555d63b in main(int, char**) (argc=<optimized out>, argv=<optimized out>)
    at /home/dem/kritadev/krita/krita/main.cc:694


(gdb) select-frame 5
(gdb) info locals
guard = {m_info = 0x555556042120}
result = true
info = @0x555556042120: {eventRecursionCount = 1, postponedSynchronizationEvents = std::queue wrapping: std::deque with 0 elements}
(gdb) 

----------------------------------------------------------------------------------------------------------

Locals dumped from core file with QtCreator
----------------------------------------------------------------------------------------------------------
	Locals		
		guard		(anonymous namespace)::AppRecursionGuard
			m_info	@0x555556042120	(anonymous namespace)::AppRecursionInfo
				eventRecursionCount	1	int
				postponedSynchronizationEvents	@0x555556042128	std::queue<KisSynchronizedConnectionEvent, std::deque<KisSynchronizedConnectionEvent, std::allocator<KisSynchronizedConnectionEvent> > >
					c	<0 items>	std::deque<KisSynchronizedConnectionEvent, std::allocator<KisSynchronizedConnectionEvent> >
		info	@0x555556042120	(anonymous namespace)::AppRecursionInfo &
			eventRecursionCount	1	int
			postponedSynchronizationEvents	@0x555556042128	std::queue<KisSynchronizedConnectionEvent, std::deque<KisSynchronizedConnectionEvent, std::allocator<KisSynchronizedConnectionEvent> > >
				c	<0 items>	std::deque<KisSynchronizedConnectionEvent, std::allocator<KisSynchronizedConnectionEvent> >
		result	true	bool
	Inspector		
	Expressions		
		resource	<no such value>	 
		resource->resourceId()	<no such value>	 
		this	<no such value>	 
	Return Value		
	Tooltip		
----------------------------------------------------------------------------------------------------------


I have core file of the crash if it is helpful.
Also I'll try to reproduce it with in debug build.
Comment 5 Dmitry Kazakov 2022-02-28 12:54:14 UTC
Hi, Dmitrii and Tomtomtom!

Could you tell if you did anything of the following prior to the crash?

1) Closed the image?
2) Closed an additional view of the image?

From the backtrace by Dmitrii it looks as if Krita tries to deliver an event to an object that has just been deleted. I don't know how it could happen yet.
Comment 6 Dmitrii Utkin 2022-02-28 13:45:58 UTC
For me it happens right in the middle of the drawing process, when the Brush tool is active.

I only was doing these actions, maybe one right after another: 
 - pan and zoom in/out (sometimes above 100%)
 - changing brush size with Shift+Pen press and drag <<<<< crashes for me here
 - drawing with Freehand Brush Tool <<<<< crashes for me here
 - undo (custom hotkey)
 - Activate previously selected layer (";" hotkey)
 - Preserve alpha mode on/off
 - Set eraser mode on/off
 - Isolate layer mode (hotkey)

I use standard brushes (Ink 3 GPen, devaad 1b eraser large, devaad 3c blend and paint, Airbrush soft), guess all of these are old brushes.

Again, for me it occurs after hours of drawing, maybe 2-3 hours on a clean document (resolution is about 3072x3780), saved to file, autosave is set to 2 minutes, recorder is on. Once faced with 15-20 minutes crash after Krita re-start.

I wasn't able to reproduce it on debug build (but it was crashing on release with debug in the same git commit).

I understand it's hard to reproduce, because it takes so much time and the crash conditions aren't 100% clear. I'll try to collect more info in the next drawing session.
Comment 7 Dmitrii Utkin 2022-03-07 11:19:10 UTC
Created attachment 147342 [details]
stdout log before crash

I managed to reproduce it under debugger. 
Today it crashed while I used Flood Fill tool. The same place (KisApplication.cpp:756), the same corrupted objects.

------------------------------------------------------------------
1  QObjectData::dynamicMetaObject() const                                                                  0x7ffff56ad65f 
2  QMetaObject::cast(QObject const *) const                                                                0x7ffff568d64e 
3  QMdiArea::eventFilter(QObject *, QEvent *)                                                              0x7ffff620bc20 
4  QCoreApplicationPrivate::sendThroughApplicationEventFilters(QObject *, QEvent *)                        0x7ffff56843eb 
5  QApplicationPrivate::notify_helper(QObject *, QEvent *)                                                 0x7ffff609caa0 
6  QApplication::notify(QObject *, QEvent *)                                                               0x7ffff60a60f0 
7  KisApplication::notify                                                           KisApplication.cpp 756 0x7ffff7b4b795   <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
8  QCoreApplication::notifyInternal2(QObject *, QEvent *)                                                  0x7ffff568480a 
9  QCoreApplicationPrivate::sendPostedEvents(QObject *, int, QThreadData *)                                0x7ffff5687488 
10 ??                                                                                                      0x7ffff56dce37 
11 g_main_context_dispatch                                                                                 0x7ffff26f417d 
12 ??                                                                                                      0x7ffff26f4400 
13 g_main_context_iteration                                                                                0x7ffff26f44a3 
14 QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)                              0x7ffff56dc435 
15 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)                                                 0x7ffff56833ab 
16 QCoreApplication::exec()                                                                                0x7ffff568b116 
17 main                                                                             main.cc            694 0x55555555ce21 
------------------------------------------------------------------

Debugger showed nothing useful in exception to event type:
------------------------------------------------------------------
		event	@0x7fffc31446c0	QEvent
			[type]	QEvent::MetaCall (0x002b)	QEvent::Type
		receiver	@0x55556c310460	QObject
------------------------------------------------------------------

There are some errors claiming about inactive qpainter in stdout log (please see attach).

`receiver` points to memory area containing:
---
--- hex ---
00 00 00 00 00 00 00 00 f0 78 ca a8 ff 7f 00 00 80 77 86 5e 55 55 00 00 51 00 00 00 00 00 00 00 02 00 00 00 06 00 00 00 14 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 67 00 6f 00 6c 00 64 00 65 00 6e 00 00 00 00 00 10 97 43 6a 55 55 00 00 70 bf 94 5e 55 55 00 00 f0 63 36 64 55 55 00 00 50 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 87 f1 f5 ff 7f 00 00 80 56 76 f5 ff 7f 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 00 00 00 00 ff ff ff ff ff ff ff ff 00 bc b3 bf bd b3 a9 ba 59 d7 4d 96 41 00 00 00 00 00 00 00 01 72 4c 6a 55 55 00 00 70 67 3c 6c 55 55 00 00 00 0f 34 6c 55 55 00 00 60 23 67 6c 55 55 00 00 20 93 5a 5b 55 55 00 00 0a 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 91 00 00 00 00 00 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 b0 11 31 6c 55 55 00 00 d0 0c 31 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 30 fb 30 6c 55 55 00 00 91 00 00 00 00 00 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 f0 55 75 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 60 37 76 6c 55 55 00 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 f8 30 6c 55 55 00 00 01 00 00 00 01 00 00 00 18 00 00 00 04 00 04 00 11 00 00 00 b4 31 95 5c 01 00 00 00 6f 6e 74 00 19 54 05 00 62 56 44 04 51 00 00 00 00 00 00 00 01 00 00 00 16 00 00 00 17 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 71 00 74 00 5f 00 73 00 63 00 72 00 6f 00 6c 00 6c 00 61 00 72 00 65 00 61 00 5f 00 76 00 69 00 65 00 77 00 70 00 6f 00 72 00 74 00 00 00 da 49 41 00 00 00 00 00 00 00 21 4d 44 6c 55 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 d9 35 6c 55 55 00 00 00 57 ed 64 55 55 00 00 0a 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 31 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 e0 07 31 6c 55 55 00 00 80 56 76 f5 ff 7f 00 00 00 d0 40 76 32 6a b4 c6 31 00 00 00 00 00 00 00 50 7c 59 57 55 55 00 00 9e 0b 19 05 00 00 00 00 80 90 8c 59 55 55 00 00 b0 06 31 6c 55 55 00 00 b0 08 31 6c 55 55 00 00 41 00 00 00 00 00 00 00 01 00 00 00 0a 00 00 00 0b 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 70 00 72 00 65 00 73 00 73 00 75 00 72 00 65 00 69 00 6e 00 00 00 00 00 6d ea b6 a9 83 f7 24 d9 91 00 00 00 00 00 00 0036 64 55 55 00 00
--- ascii ---
        ðxʨÿ  w^UU  Q                           g o l d e n     CjUU  p¿^UU  ðc6dUU  P                                                                              ñõÿ  Vvõÿ          ÿÿÿ ÿÿÿ     ÿÿÿÿÿÿÿÿ ¼³¿½³©ºY×MA       rLjUU  pg<lUU   4lUU  `#glUU   Z[UU  
       @              0û0lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU  °1lUU  Ð1lUU  0û0lUU  0û0lUU  0û0lUU  0û0lUU         `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  ðUulUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  `7vlUU  A               °ø0lUU                ´1\   ont T bVDQ                           q t _ s c r o l l a r e a _ v i e w p o r t   ÚIA       !MDlUU                  PÙ5lUU   WídUU  
       @       1                   à1lUU  Vvõÿ   Ð@v2j´Æ1       P|YWUU      YUU  °1lUU  °1lUU  A          
                 p r e s s u r e i n     m궩÷$Ù       
---

the readable "golden" text is a layer group name which contains in the document and was changed in last minute, but not the last layer I filled.

Also it contains some "qt_scrollarea_viewport" and "pressurein" texts, this may be helpful. It related to "where" and "when" crash occurred.


`event` variable memory area doesn't contain any readable info:
---
58 e9 93 f5 ff 7f 00 00 00 00 00 00 00 00 00 00 2b 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 86 5e 55 55 00 00 03 00 00 00 02 00 00 00 b0 34 c2 a8 ff 7f 00 00 f0 c6 0e bc ff 7f 00 00 00 00 00 00 00 00 00 00 1a c9 bf f3 ff 7f 00 00 05 00 00 00 ff 7f 00 00 25 00 00 00 00 00 00 00 b0 74 72 c1 ff 7f 00 00 10 00 4d 0d ff 7f 00 00 20 00 00 00 00 00 00 00 65 00 00 00 00 00 00 00 c0 15 96 c1 ff 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 ff ff ff ff 20 ae 2e f7 ff 7f 00 00 25 00 00 00 00 00 00 00 70 17 20 79 ff 7f 00 00 10 00 9b 1e ff 7f 00 00 00 00 00 00 00 00 00 00 65 00 00 00 00 00 00 00 f0 6c b4 bd ff 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 48 1c 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 80 00 3e ff 7f 00 00 02 00 00 00 02 00 00 00 04 00 00 00 ff ff ff ff 20 ae 2e f7 ff 7f 00 00 25 00 00 00 00 00 00 00 40 61 3b c3 ff 7f 00 00 10 80 63 40 ff 7f 00 00 20 00 00 00 00 00 00 00 61 00 00 00 00 00 00 00 10 bd 94 c1 ff 7f 00 00 10 bf 94 c1 ff 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 ff ff ff ff 60 00 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 7d 60 c3 ff 7f 00 00
---
Xéõÿ          +              w^UU        °4¨ÿ  ðƼÿ          É¿óÿ     ÿ  %       °trÁÿ   M
ÿ          e       ÀÁÿ                      ÿÿÿÿ                                           ÿÿÿÿ ®.÷ÿ  %       p yÿ   ÿ          e       ðl´½ÿ                      H                         >ÿ           ÿÿÿÿ ®.÷ÿ  %       @a;Ãÿ  c@ÿ          a       ½Áÿ  ¿Áÿ              ÿÿÿÿ                                           ÿÿÿÿ`       $               à}`Ãÿ  
---
Comment 8 Alvin Wong 2022-04-01 11:19:54 UTC
Probably crashing at https://invent.kde.org/qt/qt/qtbase/-/blob/v5.12.12/src/widgets/widgets/qmdiarea.cpp#L2607

> `event` variable memory
> 58 e9 93 f5 ff 7f 00 00 00 00 00 00 00 00 00 00 2b 00 04 00

QEvent has these fields:

    QEventPrivate *d;
    ushort t;
    ushort posted : 1;
    ushort spont : 1;
    ushort m_accept : 1;
    ushort reserved : 13;

First 8 bytes (58 e9 93 f5 ff 7f 00 00) is probably a pointer to the vtable or rtti info of some sort. The following 8 bytes should be `d` (which is nullptr). The following 2 bytes (2b 00) should be t, which is QEvent::Type: 0x002b == QEvent::MetaCall, but that the debugger could already tell you. Remaining 2 bytes are the flags (m_accept == 1 and the rest are 0).

Unfortunately this doesn't tell much. I would take a guess and say that some code somewhere invoked a metacall or maybe a signal being fired cross-thread or through QueuedConnection, but the receiver has been deleted when the call arrives, leading to a segfault during the qobject_cast.

If you can manage to dynamic_cast the event into `QMetaCallEvent` and inspect its data, then you can perhaps inspect its sender_ and signalId_ to find out if it is triggered from a signal. If it is, then at least we may be able to figure out which connections may potentially cause the problem. You'll need to build Qt (at least QtCore, QtGui and QtWidgets) with debugging symbols.
Comment 9 Alvin Wong 2022-04-01 11:27:53 UTC
Actually, we do already have the data for `QMetaCallEvent`:

> 00 00 00 00   00 00 00 00
> 80 77 86 5e   55 55 00 00
> 03 00 00 00   02 00 00 00
> b0 34 c2 a8   ff 7f 00 00
> f0 c6 0e bc   ff 7f 00 00
> 00 00 00 00   00 00 00 00
> 1a c9 bf f3   ff 7f 00 00
> 05 00 00 00

    QtPrivate::QSlotObjectBase *slotObj_ = 00 00 00 00   00 00 00 00;
    const QObject *sender_ = 80 77 86 5e   55 55 00 00;
    int signalId_ = 03 00 00 00;
    int nargs_ = 02 00 00 00;
    int *types_ = b0 34 c2 a8   ff 7f 00 00;
    void **args_ = f0 c6 0e bc   ff 7f 00 00;
    QSemaphore *semaphore_ = 00 00 00 00   00 00 00 00;
    QObjectPrivate::StaticMetaCallFunction callFunction_ = 1a c9 bf f3   ff 7f 00 00;
    ushort method_offset_ = 05 00;
    ushort method_relative_ = 00 00;

So yes, it is probably a signal to slot connection. Problem is we don't know what type the sender is so it's not very useful anyway, unless we still have the gdb session up.
Comment 10 tomtomtomreportingin 2022-04-04 23:15:06 UTC
Possibly additional confirmation of this issue (though not really anything to help diagnose the problem): https://krita-artists.org/t/krita-5-0-is-extremely-unstable-constant-crashes/39225

Removing "rare" from the issue summary, as this would basically be a daily problem for people using Krita in production.
Comment 11 Alvin Wong 2022-04-11 11:19:41 UTC
Sorry, I've had a Krita session running for a whole week, scribbling with it occasionally, but I have not been able to get it to crash. I am afraid someone else who is able to get the crash may need to dig deeper with gdb, which is not a simple task.
Comment 12 Dmitrii Utkin 2022-04-11 11:33:22 UTC
Would core dump help with investigating? Probably I have one.
Comment 13 Alvin Wong 2022-04-11 12:48:06 UTC
I am not familiar with debugging a core dump, but I can try...
Comment 14 Andrea Montagna 2022-04-13 10:00:28 UTC
Hello, I reported the bug in the Krita forums thread in comment 10.

I have this bug daily on average every hour while working with Krita 5.0 (all versions that I've been able to try).  On a couple of occasions it crashed in ~5 minutes, but that is not common. The crash seems to happen from random actions like brush strokes or selections, and it is always caused by segfault. 

I tried running it through an ASAN build that I was provided with, but the build still segfaulted without additional information. It has been suggested that it might be a bug in the Qt library that triggers this. 

I have no experience in debugging, but if anyone needs additional information from a gdb crash and guides me through the steps required I'll be willing to work it out. Or anything else that would be required to hunt this bug down, as I basically had to go back to 4.4.8 due to the constant crashing and losing work.
Comment 15 Dmitry Kazakov 2022-04-14 12:56:14 UTC
Hi, all!

Could you please test the packages I posted on KA? 

https://krita-artists.org/t/krita-5-0-is-extremely-unstable-constant-crashes/39225/34?u=dkazakov

They are intentionally built to crash on any memory problems :)
Comment 16 Dmitry Kazakov 2022-04-15 11:25:53 UTC
Git commit 4205530a30ed9a4578b1db509ca7cdb1d1530360 by Dmitry Kazakov.
Committed on 15/04/2022 at 11:25.
Pushed by dkazakov into branch 'master'.

Fix a random crash while painting

The crash happened because KisSurrogateUndoStore emitted a queued
signal from its destructor to itself. This queued signal would be
delivered by the main GUI thread to the already destroyed object.

M  +4    -1    libs/command/kis_undo_stores.cpp
M  +6    -1    libs/ui/kis_document_undo_store.cpp

https://invent.kde.org/graphics/krita/commit/4205530a30ed9a4578b1db509ca7cdb1d1530360
Comment 17 Dmitry Kazakov 2022-04-15 11:30:08 UTC
Git commit f7aaade5524e641aa2589d092f5be810315cd61f by Dmitry Kazakov.
Committed on 15/04/2022 at 11:29.
Pushed by dkazakov into branch 'krita/5.0'.

Fix a random crash while painting

The crash happened because KisSurrogateUndoStore emitted a queued
signal from its destructor to itself. This queued signal would be
delivered by the main GUI thread to the already destroyed object.

M  +4    -1    libs/command/kis_undo_stores.cpp
M  +6    -1    libs/ui/kis_document_undo_store.cpp

https://invent.kde.org/graphics/krita/commit/f7aaade5524e641aa2589d092f5be810315cd61f
Comment 18 Lynx3d 2022-04-18 10:34:53 UTC
*** Bug 452705 has been marked as a duplicate of this bug. ***
Comment 19 tomtomtomreportingin 2022-04-20 01:59:59 UTC
*** Bug 452784 has been marked as a duplicate of this bug. ***
Comment 20 tomtomtomreportingin 2022-04-27 19:27:16 UTC
*** Bug 452881 has been marked as a duplicate of this bug. ***