Closed Wuzzy2 closed 8 years ago
Hi Wuzzy, In the case of a pointer crash, it probably makes more sense to have a dump of the logging. But I'm sure I know where the cause is: the destructor of ViewWorld (i.e. the destructor of a QGraphicsScene) deletes all remaining ViewObjects. There shouldn't be any at that time - which is why the administration of the shared pointers goes bonkers... If you run with -verbosity=5 and dump the full log (please as zipped attachment), we can figure out what the original object was, and why it wasn't deleted properly.
By now I realized that several more objects have pointers that need clearing, so expect another patch like the last one for issue #228 .
And again, this is all due to the changes I needed to make for issue #223.
Note: I think I only fixed the QSharedPointer
thingie - not the collision issue. I'm not sure how to fix that, it seems to be a Qt-internal issue :cry:
Anybody a reproducible scenario to show the problem?
Yes, me!
Log: http://lpaste.net/raw/164328 My Qt version: 5.6.0 TBE revision: c3b4c4ce462f1b5c6dfc3eecdc1ff43020ffed00
This reproduces on OS X with the same version, I only needed to click on one of the pie menu items to make it segfault.
Call stack:
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 org.qt-project.QtWidgets 0x0000000101448454 QGraphicsItem::childItems() const + 36
1 org.the-butterfly-effect 0x0000000100ebbcd6 AbstractUndoCommand::isViewObjectColliding() + 422
2 org.the-butterfly-effect 0x0000000100ebb8c9 AbstractUndoCommand::setDecoratorStateUndoRedo() + 25
3 org.the-butterfly-effect 0x0000000100ebb83e AbstractUndoCommand::~AbstractUndoCommand() + 286
4 org.the-butterfly-effect 0x0000000100ec2085 0x100eb8000 + 41093
5 org.the-butterfly-effect 0x0000000100ec2035 0x100eb8000 + 41013
6 org.the-butterfly-effect 0x0000000100ec2059 0x100eb8000 + 41049
7 org.the-butterfly-effect 0x0000000100ec4d8a UndoSingleton::createUndoCommand(QSharedPointer
Hmm, it seems you also have to click on one of the items in the pie menu after you clicked the floor (not sure).
The actual error is “Segmentation fault”.
Stack trace by gdb
:
Thread 1 "tbe" received signal SIGSEGV, Segmentation fault.
0x00007ffff750b29c in QGraphicsItem::collidingItems(Qt::ItemSelectionMode) const () from /usr/lib/libQt5Widgets.so.5
(gdb) bt
#0 0x00007ffff750b29c in QGraphicsItem::collidingItems(Qt::ItemSelectionMode) const () from /usr/lib/libQt5Widgets.so.5
#1 0x00000000004ab850 in AbstractUndoCommand::isViewObjectColliding (this=0x1769530) at /home/wuzzy/src/tbe/tbe/src/control/AbstractUndoCommand.cpp:83
#2 0x00000000004abf40 in AbstractUndoCommand::setDecoratorStateUndoRedo (this=0x1769530) at /home/wuzzy/src/tbe/tbe/src/control/AbstractUndoCommand.cpp:170
#3 0x00000000004ab657 in AbstractUndoCommand::~AbstractUndoCommand (this=0x1769530, __in_chrg=<optimized out>)
at /home/wuzzy/src/tbe/tbe/src/control/AbstractUndoCommand.cpp:49
#4 0x00000000004b0bf4 in MoveUndoCommand::~MoveUndoCommand (this=0x1769530, __in_chrg=<optimized out>) at /home/wuzzy/src/tbe/tbe/src/control/MoveUndoCommand.h:27
#5 0x00000000004b0c10 in MoveUndoCommand::~MoveUndoCommand (this=0x1769530, __in_chrg=<optimized out>) at /home/wuzzy/src/tbe/tbe/src/control/MoveUndoCommand.h:27
#6 0x00000000004b3336 in UndoSingleton::createUndoCommand (anObject=..., anUndoType=ActionIcon::ACTION_MOVE) at /home/wuzzy/src/tbe/tbe/src/control/UndoSingleton.cpp:93
#7 0x000000000052fc26 in PieMenu::iconClicked (this=0x195cdd0, anIconPtr=0x1973010) at /home/wuzzy/src/tbe/tbe/src/view/PieMenu.cpp:170
#8 0x0000000000545f63 in PieMenu::qt_static_metacall (_o=0x195cdd0, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x7fffffffccb0)
at /home/wuzzy/src/tbe/tbe/build/src/moc_PieMenu.cpp:335
#9 0x00007ffff6527679 in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib/libQt5Core.so.5
#10 0x0000000000545ebb in ActionIcon::clicked (this=0x1973010, _t1=0x1973010) at /home/wuzzy/src/tbe/tbe/build/src/moc_PieMenu.cpp:264
#11 0x0000000000548409 in ActionIcon::mousePressEvent (this=0x1973010) at /home/wuzzy/src/tbe/tbe/build/src/../../src/view/PieMenu.h:95
#12 0x00007ffff7515542 in QGraphicsItem::sceneEvent(QEvent*) () from /usr/lib/libQt5Widgets.so.5
#13 0x00007ffff753c641 in ?? () from /usr/lib/libQt5Widgets.so.5
#14 0x00007ffff7545336 in ?? () from /usr/lib/libQt5Widgets.so.5
#15 0x00007ffff75457a9 in QGraphicsScene::mousePressEvent(QGraphicsSceneMouseEvent*) () from /usr/lib/libQt5Widgets.so.5
#16 0x000000000053d8c4 in ViewWorld::mousePressEvent (this=0x129a4c0, mouseEvent=0x7fffffffd230) at /home/wuzzy/src/tbe/tbe/src/view/ViewWorld.cpp:92
#17 0x00007ffff754dc10 in QGraphicsScene::event(QEvent*) () from /usr/lib/libQt5Widgets.so.5
#18 0x00007ffff72227bc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#19 0x00007ffff722795f in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#20 0x00007ffff64fa280 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#21 0x00007ffff75680af in QGraphicsView::mousePressEvent(QMouseEvent*) () from /usr/lib/libQt5Widgets.so.5
#22 0x00007ffff7267aff in QWidget::event(QEvent*) () from /usr/lib/libQt5Widgets.so.5
#23 0x00007ffff736373e in QFrame::event(QEvent*) () from /usr/lib/libQt5Widgets.so.5
#24 0x00007ffff756956b in QGraphicsView::viewportEvent(QEvent*) () from /usr/lib/libQt5Widgets.so.5
#25 0x00007ffff64f9fe1 in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#26 0x00007ffff7222795 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#27 0x00007ffff7228727 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#28 0x00007ffff64fa280 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#29 0x00007ffff7226ee5 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) ()
from /usr/lib/libQt5Widgets.so.5
#30 0x00007ffff72812c3 in ?? () from /usr/lib/libQt5Widgets.so.5
#31 0x00007ffff7283793 in ?? () from /usr/lib/libQt5Widgets.so.5
#32 0x00007ffff72227bc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#33 0x00007ffff722795f in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQt5Widgets.so.5
#34 0x00007ffff64fa280 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/libQt5Core.so.5
#35 0x00007ffff6a46693 in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) () from /usr/lib/libQt5Gui.so.5
#36 0x00007ffff6a47ea5 in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) () from /usr/lib/libQt5Gui.so.5
#37 0x00007ffff6a2518b in QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Gui.so.5
#38 0x00007fffecd8c080 in ?? () from /usr/lib/libQt5XcbQpa.so.5
#39 0x00007ffff4cecdd7 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#40 0x00007ffff4ced040 in ?? () from /usr/lib/libglib-2.0.so.0
#41 0x00007ffff4ced0ec in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#42 0x00007ffff65506cf in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#43 0x00007ffff64f846a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#44 0x00007ffff6500a0c in QCoreApplication::exec() () from /usr/lib/libQt5Core.so.5
#45 0x00000000004caac6 in main (argc=1, argv=0x7fffffffe428) at /home/wuzzy/src/tbe/tbe/src/main.cpp:290
OK, I see it now, did something wrong.
=================================================================
==27993==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030004a05f0 at pc 0x0000005cd04b bp 0x7fff0b946900 sp 0x7fff0b9468f8
READ of size 4 at 0x6030004a05f0 thread T0
#0 0x5cd04a in int QGenericAtomicOps<QBasicAtomicOps<4> >::load<int>(int const&) /usr/include/qt5/QtCore/qgenericatomic.h:90:16
#1 0x5cd04a in QBasicAtomicInteger<int>::load() const /usr/include/qt5/QtCore/qbasicatomic.h:118
#2 0x5cfcb5 in QtPrivate::RefCount::ref() /usr/include/qt5/QtCore/qrefcount.h:49:21
#3 0x5cf0c4 in QList<QGraphicsItem*>::QList(QList<QGraphicsItem*> const&) /usr/include/qt5/QtCore/qlist.h:778:10
#4 0x5c9634 in QForeachContainer<QList<QGraphicsItem*> >::QForeachContainer(QList<QGraphicsItem*> const&) /usr/include/qt5/QtCore/qglobal.h:891:44
#5 0x5c2856 in AbstractUndoCommand::isViewObjectColliding() /home/klaas/Programming/tbe-github/src/control/AbstractUndoCommand.cpp:87:5
#6 0x5c036d in AbstractUndoCommand::setDecoratorStateUndoRedo() /home/klaas/Programming/tbe-github/src/control/AbstractUndoCommand.cpp:170:10
#7 0x5bfdd0 in AbstractUndoCommand::~AbstractUndoCommand() /home/klaas/Programming/tbe-github/src/control/AbstractUndoCommand.cpp:49:9
0x6030004a05f0 is located 0 bytes inside of 32-byte region [0x6030004a05f0,0x6030004a0610)
freed by thread T0 here:
#0 0x593deb in free /home/abuild/rpmbuild/BUILD/llvm-3.7.0.src/stage2/../projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30:3
#1 0x5ccf3e in QTypedArrayData<unsigned short>::deallocate(QArrayData*) /usr/include/qt5/QtCore/qarraydata.h:222:9
#2 0x5c8e37 in QString::~QString() /usr/include/qt5/QtCore/qstring.h:1053:51
#3 0x6a2a62 in QMapNode<QString, QString>::destroySubTree() /usr/include/qt5/QtCore/qmap.h:260:9
#4 0x6a2c0d in QMapNode<QString, QString>::destroySubTree() /usr/include/qt5/QtCore/qmap.h:263:13
#5 0x6a26ba in QMapData<QString, QString>::destroy() /usr/include/qt5/QtCore/qmap.h:222:13
#6 0x6a0b96 in QMap<QString, QString>::~QMap() /usr/include/qt5/QtCore/qmap.h:339:43
#7 0x6e2b7d in PropertyList::~PropertyList() /home/klaas/Programming/tbe-github/src/model/Property.h:42:28
#8 0x6ce015 in AbstractObject::~AbstractObject() /home/klaas/Programming/tbe-github/src/model/AbstractObject.cpp:98:1
#9 0x7c81b8 in RectObject::~RectObject() /home/klaas/Programming/tbe-github/src/model/RectObject.cpp:135:1
#10 0x7c82da in RectObject::~RectObject() /home/klaas/Programming/tbe-github/src/model/RectObject.cpp:134:1
That helps a bit. Let me think...
I found a hard-to-reproduce crash: If you use a lot of undo and reset (reset the parts, not the timer reset!) in one particular level while constantly adding and modifying stuff, eventually TBE will crash. Sometimes TBE crashes by doing two resets in row. This issue is probably about two problems, actually, but I am not sure. It does not always happen and I have not yet figured out the exact cause of the crashes.
Here's what happened after an undo:
Console:
Backtrace:
There's another QPointer-related crash. Here's what happend after a reset:
Backtrace:
ea741b57ee1c01ac3f707f91c0d3d079f2d337b6