Open nvrWhere opened 2 months ago
KitsuneRal
commented
2 months ago Interesting. _redactedBecause is a unique pointer, and nobody else does anything lifecycle-related to it. Basically, it is never deleted apart from the event that contains it. Are you sure that m_event is valid?
TobiasFella
commented
2 months ago I have a suspicion that we indeed have invalid events on the neochat side, see e.g. https://bugs.kde.org/show_bug.cgi?id=488066
KitsuneRal
commented
2 months ago If that's any help, I remember fighting a very nasty race between updating a room pointer in the event model and accessing the model items, in Quaternion. The problem was that the moment you change the room pointer, all those bindings in QML get triggered and some of them may very well concern events from the old room because endModelReset() hasn't been called yet, so the view assumes the old items are still valid (beginModelReset() doesn't invalidate anything, as one would expect). I ended up having not one but two model resets for that reason - first to neutral (nullptr) state, and then to the new room - to make sure QML doesn't have any leftovers from the old room.
nvrWhere
commented
2 months ago I created https://invent.kde.org/network/neochat/-/merge_requests/1790 copying Quaternion, lets see if it helps
TobiasFella
commented
2 months ago I think what's happening here is not a bug in libQuotient but rather:
Describe the bug
We have the following code in neochat for visualising a redacted event in the timeline.
I've noticed a crash when entering a room and loading the timeline which is related to this code, suggesting that a pointer is being returned to an event that has already been deleted.
To Reproduce Steps to reproduce the behaviour, and the description of the actual result:
Expected behavior No Crash
Is it environment-specific? I assume not
Additional context Backtrace:
0 std::lower_bound<QJsonPrivate::ObjectIterator<const QtCbor::Element, QList::const_iterator>, QLatin1String, gnu_cxx::__ops::_Iter_comp_val<indexOf(const QExplicitlySharedDataPointer&, QLatin1String, bool*)::<lambda(const QJsonPrivate::ObjectIterator<const QtCbor::Element, QList::const_iterator>::value_type&, const QLatin1String&)> > >
1 std::lower_bound<QJsonPrivate::ObjectIterator<const QtCbor::Element, QList::const_iterator>, QLatin1String, indexOf(const QExplicitlySharedDataPointer&, QLatin1String, bool*)::<lambda(const QJsonPrivate::ObjectIterator<const QtCbor::Element, QList::const_iterator>::value_type&, const QLatin1String&)> > (first=..., last=..., val=..., comp=...)
2 indexOf (o=..., key=..., keyExists=keyExists@entry=0x7fffffffae5f)
3 0x00007ffff3e425fb in QJsonObject::valueImpl (this=0x1c7e8cf8, key=...)
4 QJsonObject::value (this=0x1c7e8cf8, key=...)
5 0x00007ffff67980c9 in QJsonObject::operator[] (this=, key=...)
6 Quotient::Event::contentJson (this=)
7 0x00000000005c309e in Quotient::Event::contentPart<QString, QString const&> (this=, key=...)
8 Quotient::RedactionEvent::reason (this=)
9 0x00000000005bedf3 in MessageContentModel::data (this=0x1df8e0d0, index=..., role=)
10 0x00007ffff71156a8 in QModelIndex::data (this=0x7fffffffb080, arole=0)
11 QQmlDMAbstractItemModelData::value (this=this@entry=0x1e28a560, role=0)
12 0x00007ffff7115cfe in QQmlDMAbstractItemModelData::metaCall
13 0x00007ffff3da7b11 in QMetaProperty::read (this=this@entry=0x7fffffffb320, object=0x1e28a560)
14 0x00007ffff6de79ee in QQmlPropertyToPropertyBinding::update (this=0x1edae540, flags=...)
15 0x00007ffff7105ca6 in QQDMIncubationTask::initializeRequiredProperties
16 0x00007ffff7105e07 in QQmlDelegateModelPrivate::setInitialState
17 0x00007ffff6d63a63 in QQmlIncubatorPrivate::incubate (this=this@entry=0x1c7d1470, i=...)
18 0x00007ffff6d63daf in QQmlEnginePrivate::incubate (this=0x11448c0, i=, forContext=)
19 0x00007ffff71026c9 in QQmlDelegateModelPrivate::object
--Type for more, q to quit, c to continue without paging--
20 0x00007ffff7767240 in QQuickRepeaterPrivate::requestItems (this=0x1ed5cad0)
21 0x00007ffff776a02c in QQuickRepeater::modelUpdated (this=0x1e8edf70, changeSet=..., reset=)
22 0x00007ffff776a704 in QQuickRepeater::qt_metacall
23 0x00007ffff3dfaa3a in doActivate (sender=0x1c285bc0, signal_index=4, argv=0x7fffffffba90)
24 0x00007ffff3df0b47 in QMetaObject::activate
25 0x00007ffff70b9bd7 in QQmlInstanceModel::modelUpdated
26 0x00007ffff70f6c6d in non-virtual thunk to QQmlDelegateModelPrivate::emitModelUpdated(QQmlChangeSet const&, bool)
27 0x00007ffff70fbb9b in QQmlDelegateModelGroupPrivate::emitModelUpdated (this=0x1c702830, reset=reset@entry=true)
28 0x00007ffff70fe078 in QQmlDelegateModelPrivate::emitChanges (this=this@entry=0x1eb19a90)
29 0x00007ffff710b667 in QQmlDelegateModel::handleModelReset (this=)
30 0x00007ffff3dfa752 in QtPrivate::QSlotObjectBase::call (this=0x1fad6820, r=, a=0x7fffffffcd30)
31 doActivate (sender=0x1df8e0d0, signal_index=21, argv=0x7fffffffcd30)
32 0x00007ffff3df0b47 in QMetaObject::activate
33 0x00007ffff4000ba0 in QAbstractItemModel::modelReset (this=, _t1=...)
34 0x00000000005bd7fc in operator() (__closure=0x1edd24f0)
35 QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, MessageContentModel::linkPreviewComponent(const QUrl&)::<lambda()> >::call (f=..., arg=) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:137
36 QtPrivate::FunctorCallable<MessageContentModel::linkPreviewComponent(const QUrl&)::<lambda()> >::call<QtPrivate::List<>, void> (f=..., arg=) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:345
37 QtPrivate::QCallableObject<MessageContentModel::linkPreviewComponent(const QUrl&)::<lambda()>, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase , QObject , void *, bool )
38 0x00007ffff3dfa752 in QtPrivate::QSlotObjectBase::call (this=0x1edd24e0, r=, a=0x7fffffffce78)
39 doActivate (sender=0x1f9ac7e0, signal_index=3, argv=0x7fffffffce78)
--Type for more, q to quit, c to continue without paging--
40 0x00007ffff3df0b47 in QMetaObject::activate
41 0x00000000006eb62f in LinkPreviewer::loadedChanged (this=)
42 operator() (__closure=0x1c82a090) at /home/jgraham/kde/src/neochat/src/linkpreviewer.cpp:82
43 0x00007ffff3dfa752 in QtPrivate::QSlotObjectBase::call (this=0x1c82a080, r=, a=0x7fffffffd080)
44 doActivate (sender=0x1eb85070, signal_index=10, argv=0x7fffffffd080)
45 0x00007ffff3df0b47 in QMetaObject::activate
46 0x00007ffff66e9752 in Quotient::BaseJob::success (this=, _t1=)
47 0x00007ffff67aff95 in Quotient::BaseJob::finishJob (this=0x1eb85070)
48 0x00007ffff3dfa752 in QtPrivate::QSlotObjectBase::call (this=0x1e85ec10, r=, a=0x7fffffffd1d8)
49 doActivate (sender=0x7fff64d9f8d0, signal_index=12, argv=0x7fffffffd1d8)
50 0x00007ffff3df0b47 in QMetaObject::activate
51 0x00007ffff4492c77 in QNetworkReply::finished (this=this@entry=0x7fff64d9f8d0)
52 0x00007ffff453af09 in QNetworkReplyHttpImplPrivate::finished (this=0x1df901c0)
53 0x00007ffff3debdeb in QObject::event (this=0x7fff64d9f8d0, e=0x7fff2408fef0)
54 0x00007ffff538b168 in QApplicationPrivate::notify_helper
55 0x00007ffff3d95b18 in QCoreApplication::notifyInternal2 (receiver=0x7fff64d9f8d0, event=0x7fff2408fef0)
56 0x00007ffff3d95d7d in QCoreApplication::sendEvent (receiver=, event=)
57 0x00007ffff3d998c1 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0xa910a0)
58 0x00007ffff3d99b6d in QCoreApplication::sendPostedEvents (receiver=, event_type=)
59 0x00007ffff407d39f in postEventSourceDispatch (s=0xb0afa0)
60 0x00007ffff130ee8c in g_main_dispatch (context=0x7fffd8000f00) at ../glib/gmain.c:3344
61 g_main_context_dispatch_unlocked (context=0x7fffd8000f00) at ../glib/gmain.c:4152
62 0x00007ffff1370c98 in g_main_context_iterate_unlocked.isra.0
63 0x00007ffff1310383 in g_main_context_iteration (context=0x7fffd8000f00, may_block=1) at ../glib/gmain.c:4282
--Type for more, q to quit, c to continue without paging--
64 0x00007ffff407cb53 in QEventDispatcherGlib::processEvents (this=0xa7ae40, flags=...)
65 0x00007ffff3da2713 in QEventLoop::exec (this=this@entry=0x7fffffffd750, flags=..., flags@entry=...)
66 0x00007ffff3d9e69c in QCoreApplication::exec ()
67 0x00007ffff47d53dd in QGuiApplication::exec ()
68 0x00007ffff538b0d9 in QApplication::exec ()
69 0x000000000043a4d4 in main (argc=, argv=)