Bug 494826 - segfault in ktexteditor 6.7.0
Summary: segfault in ktexteditor 6.7.0
Status: RESOLVED FIXED
Alias: None
Product: frameworks-ktexteditor
Classification: Frameworks and Libraries
Component: general (show other bugs)
Version: 6.7.0
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: KWrite Developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-10-15 20:35 UTC by Mark Harmstone
Modified: 2024-11-07 07:04 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Harmstone 2024-10-15 20:35:56 UTC
SUMMARY
ktexteditor 6.7.0 can cause a segfault in kwrite due to an invalid this pointer.

STEPS TO REPRODUCE
1. Open file with many lines in kwrite
2. Do find and replace of "\n" to " ", to put everything on one line
3. Select all
4. Segfault

SOFTWARE/OS VERSIONS
Operating System: Gentoo Linux 2.15
KDE Plasma Version: 5.27.11
KDE Frameworks Version: 5.116.0
Qt Version: 5.15.14
Kernel Version: 6.11.0-gentoo (64-bit)
Graphics Platform: offscreen
Processors: 32 × AMD Ryzen 9 9950X 16-Core Processor
Memory: 60.5 GiB of RAM
Graphics Processor: NVIDIA GeForce RTX 4070/PCIe/SSE2
Comment 1 Mark Harmstone 2024-10-15 20:36:11 UTC
Thread 1 "kwrite" received signal SIGSEGV, Segmentation fault.
0x00007ffff776469a in Kate::TextBlock::startLine (this=0x22500000000) at /tmp/ktexteditor/src/buffer/katetextblock.cpp:34
34          return m_buffer->m_startLines[m_blockIndex];
(gdb) bt
#0  0x00007ffff776469a in Kate::TextBlock::startLine (this=0x22500000000) at /tmp/ktexteditor/src/buffer/katetextblock.cpp:34
#1  0x00007ffff775520f in Kate::TextCursor::lineInternal (this=0x555555c2ccc0) at /tmp/ktexteditor/src/buffer/katetextcursor.h:127
#2  0x00007ffff77516d7 in Kate::TextBuffer::rangesForLine (this=0x555555f60360, line=0, view=0x555555b51cf0, rangesWithAttributeOnly=false, outRanges=Python Exception <class 'gdb.error'>: cannot resolve overloaded method `end': no arguments supplied
)
    at /tmp/ktexteditor/src/buffer/katetextbuffer.cpp:1007
#3  0x00007ffff790a23f in Kate::TextBuffer::rangesForLine (this=0x555555f60360, line=0, view=0x555555b51cf0, rangesWithAttributeOnly=false)
    at /tmp/ktexteditor/src/buffer/katetextbuffer.h:495
#4  0x00007ffff79b0496 in KTextEditor::ViewPrivate::updateRangesIn (this=0x555555b51cf0, activationType=KTextEditor::Attribute::ActivateMouseIn)
    at /tmp/ktexteditor/src/view/kateview.cpp:4797
#5  0x00007ffff79b0214 in KTextEditor::ViewPrivate::slotDelayedUpdateOfView (this=0x555555b51cf0) at /tmp/ktexteditor/src/view/kateview.cpp:4761
#6  0x00007ffff79ccb88 in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (KTextEditor::ViewPrivate::*)()>::call(void (KTextEditor::ViewPrivate::*)(), KTextEditor::ViewPrivate*, void**)
    (f=(void (KTextEditor::ViewPrivate::*)(KTextEditor::ViewPrivate * const)) 0x7ffff79b01f2 <KTextEditor::ViewPrivate::slotDelayedUpdateOfView()>, o=0x555555b51cf0, arg=0x555556009348) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:145
#7  0x00007ffff79ca062 in QtPrivate::FunctionPointer<void (KTextEditor::ViewPrivate::*)()>::call<QtPrivate::List<>, void>(void (KTextEditor::ViewPrivate::*)(), KTextEditor::ViewPrivate*, void**)
    (f=(void (KTextEditor::ViewPrivate::*)(KTextEditor::ViewPrivate * const)) 0x7ffff79b01f2 <KTextEditor::ViewPrivate::slotDelayedUpdateOfView()>, o=0x555555b51cf0, arg=0x555556009348) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:182
#8  0x00007ffff79c6fe5 in QtPrivate::QCallableObject<void (KTextEditor::ViewPrivate::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (which=1, this_=0x555555b102d0, r=0x555555b51cf0, a=0x555556009348, ret=0x0) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:553
#9  0x00007ffff500a21b in QObject::event(QEvent*) () at /usr/lib64/libQt6Core.so.6
#10 0x00007ffff79b00a3 in KTextEditor::ViewPrivate::event (this=0x555555b51cf0, e=0x555556009300) at /tmp/ktexteditor/src/view/kateview.cpp:4712
#11 0x00007ffff6221439 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib64/libQt6Widgets.so.6
#12 0x00007ffff5083bd8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib64/libQt6Core.so.6
#13 0x00007ffff50a970e in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () at /usr/lib64/libQt6Core.so.6
#14 0x00007ffff4e47a37 in postEventSourceDispatch(_GSource*, int (*)(void*), void*) () at /usr/lib64/libQt6Core.so.6
#15 0x00007ffff1dfab1b in g_main_dispatch () at /usr/lib64/libglib-2.0.so.0
#16 0x00007ffff1dfdea7 in g_main_context_iterate_unlocked.isra () at /usr/lib64/libglib-2.0.so.0
#17 0x00007ffff1dfe500 in g_main_context_iteration () at /usr/lib64/libglib-2.0.so.0
#18 0x00007ffff4e45be3 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQt6Core.so.6
#19 0x00007ffff50ae3fa in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQt6Core.so.6
#20 0x00007ffff50ae595 in QCoreApplication::exec() () at /usr/lib64/libQt6Core.so.6
#21 0x000055555555796d in main (argc=2, argv=0x7fffffffd1d8) at /var/tmp/portage/kde-apps/kwrite-24.08.2/work/kate-24.08.2/apps/kwrite/main.cpp:162
Comment 2 Mark Harmstone 2024-10-15 20:36:43 UTC
Bisected to a65e18369bc6043577131dd43d4b3092400d5d5e:

commit a65e18369bc6043577131dd43d4b3092400d5d5e (HEAD)
Author: Waqar Ahmed <waqar.17a@gmail.com>
Date:   Mon Sep 16 18:11:58 2024 +0500

    Store multiline ranges spanning multiple blocks in TextBuffer

 autotests/src/movingrange_test.cpp | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 autotests/src/movingrange_test.h   |  1 +
 src/buffer/katetextblock.cpp       | 20 ++++++++++++++++++++
 src/buffer/katetextbuffer.cpp      | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 src/buffer/katetextbuffer.h        | 24 ++++++++++++++++--------
 src/buffer/katetextrange.cpp       | 26 +++++++++++++++++++++++++-
 src/buffer/katetextrange.h         |  5 +++++
 7 files changed, 177 insertions(+), 9 deletions(-)
Comment 3 Waqar Ahmed 2024-10-16 05:33:04 UTC
Git commit 2c7e0711efd65e68687d530240bb46a1cf8de122 by Waqar Ahmed.
Committed on 16/10/2024 at 05:32.
Pushed by waqar into branch 'master'.

Fix multiblock range handling when unwrapping line

M  +23   -0    autotests/src/movingrange_test.cpp
M  +1    -0    autotests/src/movingrange_test.h
M  +12   -5    src/buffer/katetextblock.cpp

https://invent.kde.org/frameworks/ktexteditor/-/commit/2c7e0711efd65e68687d530240bb46a1cf8de122