Details
-
Bug
-
Resolution: Fixed
-
P1: Critical
-
6.8
-
None
-
-
de609d84b (dev), 3b208bcfa (6.8), 6f3026b91 (6.7), 92884a1ce (tqtc/lts-6.5)
Description
On a very recent nightly HealthCheck build we got the following ASAN error (link to full log):
PASS : tst_QGuiApplication::font() ================================================================= ==7208==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000142018 at pc 0x7f65b20a96ea bp 0x7ffe362ebcd0 sp 0x7ffe362ebcc8 WRITE of size 1 at 0x606000142018 thread T0 #0 0x7f65b20a96e9 in operator() /home/qt/work/qt/qtbase/src/gui/platform/unix/qgenericunixservices.cpp:393 #1 0x7f65b20af901 in operator() /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:142 #2 0x7f65b20afb32 in call_internal<void, QtPrivate::FunctorCall<QtPrivate::IndexesList<II ...>, QtPrivate::List<Tail ...>, R, Function>::call(Function&, void**) [with int ...II = {0}; SignalArgs = {QDBusPendingCallWatcher*}; R = void; Function = QGenericUnixServices::QGenericUnixServices()::<lambda(QDBusPendingCallWatcher*)>]::<lambda()> > /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:72 #3 0x7f65b20afa1f in call /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:141 #4 0x7f65b20af45c in call<QtPrivate::List<QDBusPendingCallWatcher*>, void> /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:363 #5 0x7f65b20af239 in impl /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:573 #6 0x7f65af730f7d in QtPrivate::QSlotObjectBase::call(QObject*, void**) /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:487 #7 0x7f65af88df2f in void doActivate<false>(QObject*, int, void**) /home/qt/work/qt/qtbase/src/corelib/kernel/qobject.cpp:4111 #8 0x7f65af876898 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) /home/qt/work/qt/qtbase/src/corelib/kernel/qobject.cpp:4171 #9 0x7f65ae576ebe in QDBusPendingCallWatcher::finished(QDBusPendingCallWatcher*) /home/qt/work/qt/qtbase_build/src/dbus/DBus_autogen/include/moc_qdbuspendingcall.cpp:161 #10 0x7f65ae571c67 in operator() /home/qt/work/qt/qtbase/src/dbus/qdbuspendingcall.cpp:98 #11 0x7f65ae57736d in operator() /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:142 #12 0x7f65ae57750e in call_internal<void, QtPrivate::FunctorCall<QtPrivate::IndexesList<II ...>, QtPrivate::List<Tail ...>, R, Function>::call(Function&, void**) [with int ...II = {}; SignalArgs = {}; R = void; Function = QDBusPendingCallWatcherHelper::add(QDBusPendingCallWatcher*)::<lambda()>]::<lambda()> > /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:72 #13 0x7f65ae57748b in call /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:141 #14 0x7f65ae57732e in call<QtPrivate::List<>, void> /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:363 #15 0x7f65ae5772f3 in impl /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:573 #16 0x7f65af730f7d in QtPrivate::QSlotObjectBase::call(QObject*, void**) /home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:487 #17 0x7f65af85fcbf in QMetaCallEvent::placeMetaCall(QObject*) /home/qt/work/qt/qtbase/src/corelib/kernel/qobject.cpp:620 #18 0x7f65af86297d in QObject::event(QEvent*) /home/qt/work/qt/qtbase/src/corelib/kernel/qobject.cpp:1419 #19 0x7f65af71f7af in QCoreApplicationPrivate::notify_helper(QObject*, QEvent*) /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1319 #20 0x7f65af71eef2 in doNotify /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1246 #21 0x7f65af71ed9d in QCoreApplication::notify(QObject*, QEvent*) /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1229 #22 0x7f65b1070588 in QGuiApplication::notify(QObject*, QEvent*) /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:1994 #23 0x7f65af71eb8f in QCoreApplication::notifyInternal2(QObject*, QEvent*) /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1145 #24 0x7f65af720786 in QCoreApplication::sendEvent(QObject*, QEvent*) /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1589 #25 0x7f65af7240a1 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1944 #26 0x7f65af721af9 in QCoreApplication::sendPostedEvents(QObject*, int) /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1778 #27 0x7f65b01b26ac in postEventSourceDispatch /home/qt/work/qt/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:245 #28 0x7f65ae72082a in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x5582a) #29 0x7f65ae720bcf (/usr/lib64/libglib-2.0.so.0+0x55bcf) #30 0x7f65ae720c5b in g_main_context_iteration (/usr/lib64/libglib-2.0.so.0+0x55c5b) #31 0x7f65b01b3c94 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) /home/qt/work/qt/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:395 #32 0x7f65a6e38a2e in QXcbGlibEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) /home/qt/work/qt/qtbase/src/plugins/platforms/xcb/qxcbeventdispatcher.cpp:96 #33 0x7f65af71f913 in QCoreApplication::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1382 #34 0x7f65b120f1b6 in qWaitFor<QTest::qWaitForWindowExposed(QWindow*, int)::<lambda()> > /home/qt/work/qt/qtbase/src/corelib/kernel/qtestsupport_core.h:38 #35 0x7f65b120eb52 in qWaitFor<QTest::qWaitForWindowExposed(QWindow*, int)::<lambda()> > /home/qt/work/qt/qtbase/src/corelib/kernel/qtestsupport_core.h:57 #36 0x7f65b120d0de in QTest::qWaitForWindowExposed(QWindow*, int) /home/qt/work/qt/qtbase/src/gui/kernel/qtestsupport_gui.cpp:84 #37 0x55b0be3b31f2 in tst_QGuiApplication::modalWindow() /home/qt/work/qt/qtbase/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication.cpp:689 #38 0x55b0be3bb8b7 in tst_QGuiApplication::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/qt/work/qt/qtbase_standalone_tests/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication_autogen/include/tst_qguiapplication.moc:241 #39 0x7f65af7740f1 in QMetaMethodInvoker::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.cpp:2754 #40 0x7f65af771ea3 in QMetaMethod::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.cpp:2593 #41 0x7f65b32c3792 in std::enable_if<!std::disjunction<>::value, bool>::type QMetaMethod::invoke<void>(QObject*, Qt::ConnectionType, QTemplatedMetaMethodReturnArgument<void>) const /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.h:148 #42 0x7f65b32be001 in std::enable_if<!std::disjunction<>::value, bool>::type QMetaMethod::invoke<>(QObject*, Qt::ConnectionType) const /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.h:160 #43 0x7f65b329755e in invokeTestMethodIfValid /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:448 #44 0x7f65b329cd62 in QTest::TestMethods::invokeTestOnData(int) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1086 #45 0x7f65b329eca3 in QTest::TestMethods::invokeTest(int, QLatin1String, std::optional<QTest::WatchDog>&) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1388 #46 0x7f65b32a1f17 in QTest::TestMethods::invokeTests(QObject*) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1725 #47 0x7f65b32a36ff in QTest::qRun() /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1930 #48 0x7f65b32a246a in QTest::qExec(QObject*, int, char**) /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1808 #49 0x55b0be3c2ff3 in main /home/qt/work/qt/qtbase/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication.cpp:1380 #50 0x7f65aec5c24c in __libc_start_main (/lib64/libc.so.6+0x3524c) #51 0x55b0be36c469 in _start ../sysdeps/x86_64/start.S:120 0x606000142018 is located 56 bytes inside of 64-byte region [0x606000141fe0,0x606000142020) freed by thread T0 here: #0 0x7f65b350ce45 in operator delete(void*, unsigned long) (/usr/lib64/libasan.so.5+0x10ce45) #1 0x7f65a6e58aec in QXcbUnixServices::~QXcbUnixServices() (/home/qt/work/install/plugins/platforms/../../lib/libQt6XcbQpa.so.6+0x19aaec) #2 0x7f65a6e57512 in QScopedPointerDeleter<QPlatformServices>::cleanup(QPlatformServices*) (/home/qt/work/install/plugins/platforms/../../lib/libQt6XcbQpa.so.6+0x199512) #3 0x7f65a6e55c43 in QScopedPointer<QPlatformServices, QScopedPointerDeleter<QPlatformServices> >::~QScopedPointer() (/home/qt/work/install/plugins/platforms/../../lib/libQt6XcbQpa.so.6+0x197c43) #4 0x7f65a6e4df2f in QXcbIntegration::~QXcbIntegration() /home/qt/work/qt/qtbase/src/plugins/platforms/xcb/qxcbintegration.cpp:187 #5 0x7f65a6e4dfd5 in QXcbIntegration::~QXcbIntegration() /home/qt/work/qt/qtbase/src/plugins/platforms/xcb/qxcbintegration.cpp:192 #6 0x7f65b106fcc4 in QGuiApplicationPrivate::~QGuiApplicationPrivate() /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:1784 #7 0x7f65b106fdad in QGuiApplicationPrivate::~QGuiApplicationPrivate() /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:1791 #8 0x7f65af88f6ec in QScopedPointerDeleter<QObjectData>::cleanup(QObjectData*) /home/qt/work/qt/qtbase/src/corelib/tools/qscopedpointer.h:24 #9 0x7f65af8887d3 in QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::~QScopedPointer() /home/qt/work/qt/qtbase/src/corelib/tools/qscopedpointer.h:81 #10 0x7f65af8616c8 in QObject::~QObject() /home/qt/work/qt/qtbase/src/corelib/kernel/qobject.cpp:1006 #11 0x7f65af71e55e in QCoreApplication::~QCoreApplication() /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:943 #12 0x7f65b105f51e in QGuiApplication::~QGuiApplication() /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:657 #13 0x55b0be3b1fcc in tst_QGuiApplication::font() /home/qt/work/qt/qtbase/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication.cpp:592 #14 0x55b0be3bb8a6 in tst_QGuiApplication::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/qt/work/qt/qtbase_standalone_tests/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication_autogen/include/tst_qguiapplication.moc:240 #15 0x7f65af7740f1 in QMetaMethodInvoker::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.cpp:2754 #16 0x7f65af771ea3 in QMetaMethod::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.cpp:2593 #17 0x7f65b32c3792 in std::enable_if<!std::disjunction<>::value, bool>::type QMetaMethod::invoke<void>(QObject*, Qt::ConnectionType, QTemplatedMetaMethodReturnArgument<void>) const /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.h:148 #18 0x7f65b32be001 in std::enable_if<!std::disjunction<>::value, bool>::type QMetaMethod::invoke<>(QObject*, Qt::ConnectionType) const /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.h:160 #19 0x7f65b329755e in invokeTestMethodIfValid /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:448 #20 0x7f65b329cd62 in QTest::TestMethods::invokeTestOnData(int) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1086 #21 0x7f65b329eca3 in QTest::TestMethods::invokeTest(int, QLatin1String, std::optional<QTest::WatchDog>&) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1388 #22 0x7f65b32a1f17 in QTest::TestMethods::invokeTests(QObject*) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1725 #23 0x7f65b32a36ff in QTest::qRun() /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1930 #24 0x7f65b32a246a in QTest::qExec(QObject*, int, char**) /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1808 #25 0x55b0be3c2ff3 in main /home/qt/work/qt/qtbase/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication.cpp:1380 #26 0x7f65aec5c24c in __libc_start_main (/lib64/libc.so.6+0x3524c) previously allocated by thread T0 here: #0 0x7f65b350b9bf in operator new(unsigned long) (/usr/lib64/libasan.so.5+0x10b9bf) #1 0x7f65a6e4ccdd in QXcbIntegration::QXcbIntegration(QList<QString> const&, int&, char**) /home/qt/work/qt/qtbase/src/plugins/platforms/xcb/qxcbintegration.cpp:106 #2 0x7f65acdaabc6 in QXcbIntegrationPlugin::create(QString const&, QList<QString> const&, int&, char**) /home/qt/work/qt/qtbase/src/plugins/platforms/xcb/qxcbmain.cpp:22 #3 0x7f65b1169c35 in QPlatformIntegration* qLoadPlugin<QPlatformIntegration, QPlatformIntegrationPlugin, QList<QString> const&, int&, char**&>(QFactoryLoader const*, QString const&, QList<QString> const&, int&, char**&) /home/qt/work/qt/qtbase/src/corelib/plugin/qfactoryloader_p.h:100 #4 0x7f65b11696ce in QPlatformIntegrationFactory::create(QString const&, QList<QString> const&, int&, char**, QString const&) /home/qt/work/qt/qtbase/src/gui/kernel/qplatformintegrationfactory.cpp:23 #5 0x7f65b106382b in init_platform /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:1248 #6 0x7f65b106d265 in QGuiApplicationPrivate::createPlatformIntegration() /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:1532 #7 0x7f65b106d5a4 in QGuiApplicationPrivate::createEventDispatcher() /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:1551 #8 0x7f65af71df9b in QCoreApplicationPrivate::init() /home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:913 #9 0x7f65b106da07 in QGuiApplicationPrivate::init() /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:1579 #10 0x7f65b105ee9c in QGuiApplication::QGuiApplication(int&, char**, int) /home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:641 #11 0x55b0be3b16b4 in tst_QGuiApplication::font() /home/qt/work/qt/qtbase/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication.cpp:567 #12 0x55b0be3bb8a6 in tst_QGuiApplication::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/qt/work/qt/qtbase_standalone_tests/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication_autogen/include/tst_qguiapplication.moc:240 #13 0x7f65af7740f1 in QMetaMethodInvoker::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.cpp:2754 #14 0x7f65af771ea3 in QMetaMethod::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.cpp:2593 #15 0x7f65b32c3792 in std::enable_if<!std::disjunction<>::value, bool>::type QMetaMethod::invoke<void>(QObject*, Qt::ConnectionType, QTemplatedMetaMethodReturnArgument<void>) const /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.h:148 #16 0x7f65b32be001 in std::enable_if<!std::disjunction<>::value, bool>::type QMetaMethod::invoke<>(QObject*, Qt::ConnectionType) const /home/qt/work/qt/qtbase/src/corelib/kernel/qmetaobject.h:160 #17 0x7f65b329755e in invokeTestMethodIfValid /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:448 #18 0x7f65b329cd62 in QTest::TestMethods::invokeTestOnData(int) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1086 #19 0x7f65b329eca3 in QTest::TestMethods::invokeTest(int, QLatin1String, std::optional<QTest::WatchDog>&) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1388 #20 0x7f65b32a1f17 in QTest::TestMethods::invokeTests(QObject*) const /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1725 #21 0x7f65b32a36ff in QTest::qRun() /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1930 #22 0x7f65b32a246a in QTest::qExec(QObject*, int, char**) /home/qt/work/qt/qtbase/src/testlib/qtestcase.cpp:1808 #23 0x55b0be3c2ff3 in main /home/qt/work/qt/qtbase/tests/auto/gui/kernel/qguiapplication/tst_qguiapplication.cpp:1380 #24 0x7f65aec5c24c in __libc_start_main (/lib64/libc.so.6+0x3524c) SUMMARY: AddressSanitizer: heap-use-after-free /home/qt/work/qt/qtbase/src/gui/platform/unix/qgenericunixservices.cpp:393 in operator() Shadow bytes around the buggy address: 0x0c0c800203b0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x0c0c800203c0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd 0x0c0c800203d0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd 0x0c0c800203e0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x0c0c800203f0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd =>0x0c0c80020400: fd fd fd[fd]fa fa fa fa fd fd fd fd fd fd fd fd 0x0c0c80020410: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x0c0c80020420: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd 0x0c0c80020430: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd 0x0c0c80020440: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x0c0c80020450: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==7208==ABORTING
It seems like some heap memory allocated and freed in the previous test tst_QGuiApplication::font() is being accessed again during the next test, tst_QGuiApplication::modalWindow().
Attachments
For Gerrit Dashboard: QTBUG-125239 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
582304,8 | QGenericUnixServices: properly disconnect signals in dtor | dev | qt/qtbase | Status: MERGED | +2 | 0 |
587457,2 | QGenericUnixServices: properly disconnect signals in dtor | 6.8 | qt/qtbase | Status: MERGED | +2 | 0 |
587537,2 | QGenericUnixServices: properly disconnect signals in dtor | 6.7 | qt/qtbase | Status: MERGED | +2 | 0 |
587544,2 | QGenericUnixServices: properly disconnect signals in dtor | tqtc/lts-6.5 | qt/tqtc-qtbase | Status: MERGED | +2 | 0 |