Bug 474476 - [Crash] Random crash while drawing (QObject::killTimer: Timers cannot be stopped from another thread)
Summary: [Crash] Random crash while drawing (QObject::killTimer: Timers cannot be stop...
Status: RESOLVED FIXED
Alias: None
Product: krita
Classification: Applications
Component: * Unknown (show other bugs)
Version: nightly build (please specify the git hash!)
Platform: Appimage Linux
: NOR crash
Target Milestone: ---
Assignee: Dmitry Kazakov
URL:
Keywords: release_blocker
Depends on:
Blocks:
 
Reported: 2023-09-13 08:21 UTC by Protoniv
Modified: 2023-10-02 07:43 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
gdb output with thread apply all bt command (40.89 KB, text/plain)
2023-09-24 00:10 UTC, Protoniv
Details
thread apply all bt from test package (46.53 KB, text/plain)
2023-09-27 00:17 UTC, Protoniv
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Protoniv 2023-09-13 08:21:51 UTC
SUMMARY
While drawing for a while, sometimes krita crash unexpectively.
Don't know how to reproduce it, but here are the new lines found in terminal after krita crash.
***
QObject::killTimer: Timers cannot be stopped from another thread
QObject::~QObject: Timers cannot be stopped from another thread
***

SOFTWARE/OS VERSIONS
Linux/KDE Plasma:  OpenSUSE Leap 15.5

ADDITIONAL INFORMATION
krita-5.3.0-prealpha-005a010257, but also happened in earlier 5.3.0 build, not tested 5.2.0 yet.
When the crash happened, it is in "Canvas only mode" and using "Brush tool - pixel brush engine",
Comment 1 Dmitry Kazakov 2023-09-13 09:26:22 UTC
Hi, Protoniv!

Could you try running the appimage under GDB and, when the crash happens, get the full backtrace from it with `thread apply all bt` command?

When generating this backtrace it is very important that you add the exact version of the appimage (with sha1) to the report, so I could decrypt the backtrace with local symbols.
Comment 2 Protoniv 2023-09-24 00:10:09 UTC
Created attachment 161838 [details]
gdb output with thread apply all bt command

 Hi, Dmitry!
After some recent OS packages update, the crash seems not easily appear again on my laptop, but have some chance to enconter the crash again (and again) with my home desktop (I can only access it on my holiday), sorry for the late reply.

The crash also happen on 5.2.0-RC1 appimage, so here is the gdb output from it.
5.2.0-RC1 appimage SHA1: 4bd0f522c22f41e504bf1e9ced540fa11ed5ec53

Output from gdb when krita crash:
```
QObject::killTimer: Timers cannot be stopped from another thread
QObject::~QObject: Timers cannot be stopped from another thread

Thread 1 "krita" received signal SIGSEGV, Segmentation fault.
0x00007ffff5aafebc in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libQt5Core.so.5
```

Output with gdb "bt" command:
```
#0  0x00007ffff5aafebc in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libQt5Core.so.5
#1  0x00007ffff5b08d8b in QTimerInfoList::activateTimers() () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libQt5Core.so.5
#2  0x00007ffff5b0968c in ?? () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libQt5Core.so.5
#3  0x00007ffff2c9c17d in g_main_context_dispatch () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libglib-2.0.so.0
#4  0x00007ffff2c9c400 in ?? () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libglib-2.0.so.0
#5  0x00007ffff2c9c4a3 in g_main_context_iteration () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libglib-2.0.so.0
#6  0x00007ffff5b09a58 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libQt5Core.so.5
#7  0x00007ffff5aae85b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libQt5Core.so.5
#8  0x00007ffff5ab6e14 in QCoreApplication::exec() () from /tmp/.mount_krita-4KlmX8/usr/bin/../lib/libQt5Core.so.5
#9  0x000055555555e0bf in main ()
```
And the "thread apply all bt" output is in the attachment.
Comment 3 Dmitry Kazakov 2023-09-25 11:45:16 UTC
Hi, Protoniv!

Does your image has any selections, fill layers, vector layers or transform masks? These three types of layers could theoretically cause the issue...

If possible, could you please share the image you use to trigger this bug (you can send it privately to my email)?

And is it possible to make a video capture of the session that causes the crash?
Comment 4 Dmitry Kazakov 2023-09-25 12:04:04 UTC
Btw, I have built a special version of Krita, could you also try this bug using this build? It has the following changes:

1) It is huge! (1.1GiB)
2) Has debugging symbols
3) Has ASAN instrumentation (will crash on the first error and will dump the error to the terminal)
4) Will crash automatically on any of these warnings, so we will be able to catch the exact place where the issue happens:

* QObject::killTimer: Timers cannot be stopped from another thread
* QObject::~QObject: Timers cannot be stopped from another thread

5) Is slower than normal Krita due to ASAN. If it is too slow for you to test, please tell me and I will try to think something up.

How to start this version:

export ASAN_OPTIONS=alloc_dealloc_mismatch=0,new_delete_type_mismatch=0,detect_leaks=0
gdb --eval-command=run ./krita-5.3.0-prealpha-4e429b5509-x86_64.appimage


If this version is too slow for real testing, I can build another one without ASAN, but it would take quite a bit of time...
Comment 5 Dmitry Kazakov 2023-09-25 12:05:46 UTC
Oh, and here is the link to the package:

https://disk.yandex.ru/d/gvgwIMVSjDZHqQ
Comment 6 Protoniv 2023-09-25 12:21:48 UTC
(In reply to Dmitry Kazakov from comment #3)
> Hi, Protoniv!
> 
> Does your image has any selections, fill layers, vector layers or transform
> masks? These three types of layers could theoretically cause the issue...

Hi, Dmitry!
I use only paint layer in those sessions, and 3~4 files I run in recent sessions all encontered the same crash. Using selections did not enconter any crash.
It happened mostly when finishing some Ctrl+Z, use stylus to draw on canvas but nothing happened, sometimes krita just crash in a few seconds. sometimes switching krita focus (minimize then maximize again) make brush draw again.

I'm suspecting it might be related to the OS, since my working laptop had encontered the crash 5 or 6 times, but after some packages update (after this bug report), krita does not crash again.
The gdb crash report is generate from my home desktop, which had not recieve any update since Sep 6th.

(In reply to Dmitry Kazakov from comment #4)
> Btw, I have built a special version of Krita, could you also try this bug using this build?

Thank you!
I will report back once meet the crash again with this build.
Comment 7 Bug Janitor Service 2023-09-26 03:46:14 UTC
Thanks for your comment!

Automatically switching the status of this bug to REPORTED so that the KDE team
knows that the bug is ready to get confirmed.

In the future you may also do this yourself when providing needed information.
Comment 8 Dmitry Kazakov 2023-09-26 08:31:24 UTC
I will mark the bug as NEEDSINFO again until a detailed report is ready :)
Comment 9 Protoniv 2023-09-27 00:10:14 UTC
Hi, Dmitry!
The test package is fast enough after loading screen, I don't see any slow down while testing.
Here is the crash output, hope it helps:

```
QObject::killTimer: Timers cannot be stopped from another thread
fatal catch

Thread 192 "Thread (pooled)" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fff8b3da700 (LWP 5342)]
__GI_raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51      }
```

And the gdb bt command:

```
#0  __GI_raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007fffec6123e5 in __GI_abort () at abort.c:79
#2  0x00007fffecfe0c0f in QMessageLogger::fatal(char const*, ...) const ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#3  0x00007fffecff73b0 in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#4  0x00007fffed254fb9 in QTimer::stop() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#5  0x00007fffed254ff1 in QTimer::~QTimer() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#6  0x00007fffed25500d in QTimer::~QTimer() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#7  0x00007fffed243c9e in QObjectPrivate::deleteChildren() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#8  0x00007fffed24ed46 in QObject::~QObject() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#9  0x00007fffee9c82b5 in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaglobal.so.20
#10 0x00007fffed243c9e in QObjectPrivate::deleteChildren() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#11 0x00007fffed24ed46 in QObject::~QObject() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#12 0x00007ffff16126b7 in KoSelection::~KoSelection() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaflake.so.20
#13 0x00007ffff1612796 in KoSelection::~KoSelection() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaflake.so.20
#14 0x00007ffff1658883 in KoShapeManager::~KoShapeManager() ()
   from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaflake.so.20
#15 0x00007ffff1658c86 in KoShapeManager::~KoShapeManager() () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaflake.so.20
#16 0x00007ffff57a9382 in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaui.so.20
#17 0x00007ffff57a9aa6 in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaui.so.20
#18 0x00007ffff576ba4a in KisShapeLayer::~KisShapeLayer() () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaui.so.20
#19 0x00007ffff576c0c6 in KisShapeLayer::~KisShapeLayer() () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaui.so.20
#20 0x00007ffff364aeee in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#21 0x00007ffff363b4ef in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#22 0x00007ffff35ff46b in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#23 0x00007ffff3675d71 in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#24 0x00007ffff3b749ff in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#25 0x00007ffff2e9be69 in KisSavedMacroCommand::~KisSavedMacroCommand() () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#26 0x00007ffff2e9c136 in KisSavedMacroCommand::~KisSavedMacroCommand() () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#27 0x00007fffefee1ce1 in KUndo2QStack::checkUndoLimit() () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritacommand.so.20
#28 0x00007fffefee4265 in KUndo2QStack::push(KUndo2Command*) () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritacommand.so.20
#29 0x00007ffff66fe7be in KisDocumentUndoStore::addCommand(KUndo2Command*) () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaui.so.20
#30 0x00007ffff3b785ea in KisPostExecutionUndoAdapter::addCommand(QSharedPointer<KUndo2Command>) () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#31 0x00007ffff5f59c9c in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaui.so.20
#32 0x00007ffff3418f59 in non-virtual thunk to KisRunnableStrokeJobData::run() () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#33 0x00007ffff3415ea9 in KisRunnableBasedStrokeStrategy::doStrokeCallback(KisStrokeJobData*) () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#34 0x00007ffff5f51c2b in FreehandStrokeStrategy::doStrokeCallback(KisStrokeJobData*) () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaui.so.20
#35 0x00007ffff341372f in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#36 0x00007ffff2bcfb6c in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libkritaimage.so.20
#37 0x00007fffed0205b2 in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#38 0x00007fffed01d303 in ?? () from /tmp/.mount_krita-8rrnDl/usr/bin/../lib/libQt5Core.so.5
#39 0x00007fffee4836ea in start_thread (arg=0x7fff8b3da700) at pthread_create.c:477
#40 0x00007fffec6de49f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```
Comment 10 Protoniv 2023-09-27 00:17:26 UTC
Created attachment 161895 [details]
thread apply all bt from test package
Comment 11 Dmitry Kazakov 2023-09-27 06:29:56 UTC
Hi, Protoniv!

Thanks a lot for testing and providing the log! It looks really helpful! :)
Comment 12 Bug Janitor Service 2023-09-27 10:40:26 UTC
A possibly relevant merge request was started @ https://invent.kde.org/graphics/krita/-/merge_requests/1950
Comment 13 Dmitry Kazakov 2023-09-29 07:32:34 UTC
Git commit 8ad47b97f2ae9fd1ba7c0b8946409adfdd9ddf57 by Dmitry Kazakov.
Committed on 29/09/2023 at 09:31.
Pushed by dkazakov into branch 'master'.

Fix a crash after removing a vector layer with active selection of shapes

Steps to reproduce:

0) set undo limit to 10 steps;
1) add a vector layer;
2) add a lot of shapes/text to that;
3) select some of these shapes
4) remove the vector layer;
5) do 10 brush strokes to make sure the vector layer
   is pushed out of the history;

The problem happened in the following way:

1) On destruction of the layer, KoSelection::deselect() was called
2) This deselect() call triggered a start of the QTimer
3) The timer itself was destroyed in the non-gui thread (in an
   active state), as was warned by Qt
4) The timer event was delivered to the destroyed timer, which
   caused a crash.

M  +4    -4    libs/flake/KoSelection.cpp
M  +8    -3    libs/flake/KoSelection_p.h
M  +3    -3    libs/flake/KoShapeManager.cpp
M  +3    -2    libs/flake/KoShapeManager_p.h

https://invent.kde.org/graphics/krita/-/commit/8ad47b97f2ae9fd1ba7c0b8946409adfdd9ddf57
Comment 14 Dmitry Kazakov 2023-09-29 07:34:18 UTC
Git commit d8e8822bac32005536a934c0cdb2917cc2aca8f2 by Dmitry Kazakov.
Committed on 29/09/2023 at 09:34.
Pushed by dkazakov into branch 'krita/5.2'.

Fix a crash after removing a vector layer with active selection of shapes

Steps to reproduce:

0) set undo limit to 10 steps;
1) add a vector layer;
2) add a lot of shapes/text to that;
3) select some of these shapes
4) remove the vector layer;
5) do 10 brush strokes to make sure the vector layer
   is pushed out of the history;

The problem happened in the following way:

1) On destruction of the layer, KoSelection::deselect() was called
2) This deselect() call triggered a start of the QTimer
3) The timer itself was destroyed in the non-gui thread (in an
   active state), as was warned by Qt
4) The timer event was delivered to the destroyed timer, which
   caused a crash.


(cherry picked from commit 8ad47b97f2ae9fd1ba7c0b8946409adfdd9ddf57)

M  +4    -4    libs/flake/KoSelection.cpp
M  +8    -3    libs/flake/KoSelection_p.h
M  +3    -3    libs/flake/KoShapeManager.cpp
M  +3    -2    libs/flake/KoShapeManager_p.h

https://invent.kde.org/graphics/krita/-/commit/d8e8822bac32005536a934c0cdb2917cc2aca8f2
Comment 15 Dmitry Kazakov 2023-09-29 07:37:37 UTC
Hi, Protoniv!

I think I have fixed the bug (thank you very much for testing the custom build, it helped a lot)! Please check the resulting build (whatever will be build the first):

https://invent.kde.org/graphics/krita/-/jobs/1221241

or 

https://binary-factory.kde.org/job/Krita_Stable_Appimage_Build/2002/
Comment 16 Protoniv 2023-09-30 21:45:57 UTC
(In reply to Dmitry Kazakov from comment #15)
> Hi, Protoniv!
> 
> I think I have fixed the bug (thank you very much for testing the custom
> build, it helped a lot)! Please check the resulting build (whatever will be
> build the first):
> 
> https://invent.kde.org/graphics/krita/-/jobs/1221241
> 
> or 
> 
> https://binary-factory.kde.org/job/Krita_Stable_Appimage_Build/2002/

Hi, Dmitry!

After following your reproduce step with RC1 and #2002 build, the crash seems no longer appears in newer builds.
Thank you very much!
Comment 17 Dmitry Kazakov 2023-10-02 07:43:46 UTC
You are welcome! :)