Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-45937

Exit crash / SIGSEGV in QAxWidget::clear when using AcroReader DC (32bit)

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P2: Important
    • 5.5.0
    • 5.4.1
    • ActiveX Support
    • None
    • windows, mingw 32bit only (!)
    • 0cef1cc32f372d19458b000ba4e21b90eca588ba (qtactiveqt/5.5, 5.5.2015, 5.5) h

    Description

      I am getting a segmentation fault when calling QAxWidget::clear on AxAcroPDF object. More precisely it happens inside the call of IOleControl::Release
      The segfaults happens with adobe reader DC, but not with adobe reader XI, so I am not sure how to be know for sure this does not come from adobe reader itself.
      The following line produces the bug:

      QAxWidget(QStringLiteral("{ca8a9780-280d-11cf-a24d-444553540000}"));

      the stack trace is the following:

      Thread 6 (Thread 5484.0x2514):
      #0  0x7771ca2c in ntdll!ZwWaitForMultipleObjects () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #1  0x774a112f in KERNELBASE!GetModuleHandleExW () from C:\Windows\SYSTEM32\KernelBase.dll
      No symbol table info available.
      #2  0x767cb792 in combase!CoGetMalloc () from C:\Windows\SYSTEM32\combase.dll
      No symbol table info available.
      #3  0x767cb80c in combase!CoGetMalloc () from C:\Windows\SYSTEM32\combase.dll
      No symbol table info available.
      #4  0x76809ec9 in combase!CoGetProcessIdentifier () from C:\Windows\SYSTEM32\combase.dll
      No symbol table info available.
      #5  0x767fd7f6 in combase!CleanupOleStateInAllTls () from C:\Windows\SYSTEM32\combase.dll
      No symbol table info available.
      #6  0x767fd7e0 in combase!CleanupOleStateInAllTls () from C:\Windows\SYSTEM32\combase.dll
      No symbol table info available.
      #7  0x767fd7e0 in combase!CleanupOleStateInAllTls () from C:\Windows\SYSTEM32\combase.dll
      No symbol table info available.
      #8  0x1445ff94 in ?? ()
      No symbol table info available.
      #9  0x76c77c04 in KERNEL32!BaseThreadInitThunk () from C:\Windows\SYSTEM32\kernel32.dll
      No symbol table info available.
      #10 0x7773ad1f in ntdll!RtlInitializeExceptionChain () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #11 0x7773acea in ntdll!RtlInitializeExceptionChain () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #12 0x00000000 in ?? ()
      No symbol table info available.
      
      Thread 5 (Thread 5484.0xb20):
      #0  0x7771df6c in ntdll!ZwWaitForWorkViaWorkerFactory () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #1  0x77700153 in ntdll!RtlRunOnceBeginInitialize () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #2  0x76c77c04 in KERNEL32!BaseThreadInitThunk () from C:\Windows\SYSTEM32\kernel32.dll
      No symbol table info available.
      #3  0x7773ad1f in ntdll!RtlInitializeExceptionChain () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #4  0x7773acea in ntdll!RtlInitializeExceptionChain () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #5  0x00000000 in ?? ()
      No symbol table info available.
      
      Thread 4 (Thread 5484.0x2118):
      #0  0x7771df6c in ntdll!ZwWaitForWorkViaWorkerFactory () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #1  0x77700153 in ntdll!RtlRunOnceBeginInitialize () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #2  0x76c77c04 in KERNEL32!BaseThreadInitThunk () from C:\Windows\SYSTEM32\kernel32.dll
      No symbol table info available.
      #3  0x7773ad1f in ntdll!RtlInitializeExceptionChain () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #4  0x7773acea in ntdll!RtlInitializeExceptionChain () from C:\Windows\SYSTEM32\ntdll.dll
      No symbol table info available.
      #5  0x00000000 in ?? ()
      No symbol table info available.
      
      Thread 1 (Thread 5484.0x6dc):
      #0  0x51405ce6 in ?? ()
      No symbol table info available.
      #1  0x0028fdb8 in ?? ()
      No symbol table info available.
      #2  0x00402f70 in QAxClientSite::releaseAll (this=0x7e1b00) at qaxwidget.cpp:764
      No locals.
      #3  0x00406652 in QAxWidget::clear (this=0x28fe44) at qaxwidget.cpp:2079
      No locals.
      #4  0x00406318 in QAxWidget::~QAxWidget (this=0x28fe44, __in_chrg=<optimized out>) at qaxwidget.cpp:1960
      No locals.
      #5  0x00401756 in main (argc=1, argv=0x12103680) at ..\qtbug45937\main.cpp:10
              a = {<QGuiApplication> = {<QCoreApplication> = {<QObject> = {_vptr.QObject = 0x9b0ac08 <vtable for QApplication+8>, static staticMetaObject = {d = {superdata = 0x0, stringdata = 0x6bb770c0 <qt_meta_stringdata_QObject>, data = 0x6bb771c0 <qt_meta_data_QObject>, static_metacall = 0x6b95c25c <QObject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}, d_ptr = {d = 0x12103ac8}, static staticQtMetaObject = {d = {superdata = 0x0, stringdata = 0x6bbc6400 <qt_meta_stringdata_Qt>, data = 0x6bbce580 <qt_meta_data_Qt>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}}, static staticMetaObject = {d = {superdata = 0x6bb76c4c <QObject::staticMetaObject>, stringdata = 0x6bbd9fc0 <qt_meta_stringdata_QCoreApplication>, data = 0x6bbda180 <qt_meta_data_QCoreApplication>, static_metacall = 0x6b9b1158 <QCoreApplication::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}, static self = 0x28fe70}, static staticMetaObject = {d = {superdata = 0x6bbd9f1c <QCoreApplication::staticMetaObject>, stringdata = 0x1028380 <qt_meta_stringdata_QGuiApplication>, data = 0x1028780 <qt_meta_data_QGuiApplication>, static_metacall = 0xc1c8a4 <QGuiApplication::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}}, static staticMetaObject = {d = {superdata = 0x101e038 <QGuiApplication::staticMetaObject>, stringdata = 0x9a33480 <qt_meta_stringdata_QApplication>, data = 0x9a33700 <qt_meta_data_QApplication>, static_metacall = 0x95e11c0 <QApplication::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}}
              clsid = {static null = {<No data fields>}, d = 0x7e1e60}
              axw = {<QWidget> = {<QObject> = {_vptr.QObject = 0x435108 <vtable for QAxWidget+8>, static staticMetaObject = {d = {superdata = 0x0, stringdata = 0x6bb770c0 <qt_meta_stringdata_QObject>, data = 0x6bb771c0 <qt_meta_data_QObject>, static_metacall = 0x6b95c25c <QObject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}, d_ptr = {d = 0x7e1ed8}, static staticQtMetaObject = {d = {superdata = 0x0, stringdata = 0x6bbc6400 <qt_meta_stringdata_Qt>, data = 0x6bbce580 <qt_meta_data_Qt>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}}, <QPaintDevice> = {_vptr.QPaintDevice = 0x435204 <vtable for QAxWidget+260>, painters = 0, reserved = 0x0}, static staticMetaObject = {d = {superdata = 0x6bb76c4c <QObject::staticMetaObject>, stringdata = 0x9a39a40 <qt_meta_stringdata_QWidget>, data = 0x9a3a4c0 <qt_meta_data_QWidget>, static_metacall = 0x961c1a4 <QWidget::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}, data = 0x7e1f80}, <QAxBase> = {_vptr.QAxBase = 0x43522c <vtable for QAxWidget+300>, static qt_meta_stringdata_QAxBase = {data = {{ref = {atomic = {_q_value = -1}}, size = 7, alloc = 0, capacityReserved = 0, offset = 208, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 6, alloc = 0, capacityReserved = 0, offset = 200, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 191, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 4, alloc = 0, capacityReserved = 0, offset = 176, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 4, alloc = 0, capacityReserved = 0, offset = 165, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 4, alloc = 0, capacityReserved = 0, offset = 154, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 15, alloc = 0, capacityReserved = 0, offset = 143, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 9, alloc = 0, capacityReserved = 0, offset = 143, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 4, alloc = 0, capacityReserved = 0, offset = 137, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 6, alloc = 0, capacityReserved = 0, offset = 126, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 4, alloc = 0, capacityReserved = 0, offset = 117, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 4, alloc = 0, capacityReserved = 0, offset = 106, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}, {ref = {atomic = {_q_value = -1}}, size = 7, alloc = 0, capacityReserved = 0, offset = 95, static shared_null = {{ref = {atomic = {_q_value = -1}}, size = 0, alloc = 0, capacityReserved = 0, offset = 16, static shared_null = <same as static member of an already seen type>}, {ref = {atomic = {_q_value = 0}}, size = 0, alloc = 0, capacityReserved = 0, offset = 0, static shared_null = <same as static member of an already seen type>}}}}, stringdata = "QAxBase\000signal\000\000name\000argc\000argv\000propertyChanged\000exception\000code\000source\000desc\000help\000control\000"}, static qt_meta_data_QAxBase = {7, 0, 0, 0, 3, 14, 1, 48, 0, 0, 0, 0, 0, 3, 1, 3, 29, 2, 5, 6, 1, 36, 2, 5, 7, 4, 39, 2, 5, 43, 10, 2, 31, 3, 4, 5, 43, 10, 3, 43, 2, 10, 10, 10, 8, 9, 10, 11, 12, 10, 610304, 0}, d = 0x7e1648}, static staticMetaObject = {d = {superdata = 0x9a30068 <QWidget::staticMetaObject>, stringdata = 0x431100 <QAxBase::qt_meta_stringdata_QAxBase>, data = 0x431240 <QAxBase::qt_meta_data_QAxBase>, static_metacall = 0x406716 <QAxWidget::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}, container = 0x7e1b00, d = 0xffffffff}
              __PRETTY_FUNCTION__ = "int main(int, char**)"
      

      Attachments

        For Gerrit Dashboard: QTBUG-45937
        # Subject Branch Project Status CR V

        Activity

          People

            kleint Friedemann Kleint
            ericlemanissier Eric Lemanissier
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes