-
Bug
-
Resolution: Fixed
-
P2: Important
-
6.11
-
None
-
-
31c38d5f7 (dev), 63345a96f (6.10)
-
Multimedia Current w28 ...
running tests\manual\minimal-player\minimal-player.exe and closing by via the window "close" window i got this heap-use-after-free crash:
==17068==ERROR: AddressSanitizer: heap-use-after-free on address 0x11988bfd05e0 at pc 0x7fffb0dcaf42 bp 0x0062d3b292d0 sp 0x0062d3b292d8 WRITE of size 4 at 0x11988bfd05e0 thread T0 #0 0x7fffb0dcaf41 in std::_Atomic_storage<int, 4>::store(int, enum std::memory_order) C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\include\atomic:919 #1 0x7fffb0e49130 in QAtomicOps<int>::storeRelease<int>(struct std::atomic<int> &, int) D:\qt6\qtbase\src\corelib\thread\qatomic_cxx11.h:239 #2 0x7fffb0e5bc0d in QBasicAtomicInteger<int>::storeRelease(int) D:\qt6\qtbase\src\corelib\thread\qbasicatomic.h:41 #3 0x7fffb100262a in ``QWindowsWindow::requestUpdate'::`8'::<lambda_1>::operator()'::`8'::<lambda_1>::operator() D:\qt6\qtbase\src\plugins\platforms\windows\qwindowswindow.cpp:4012 #4 0x7fffb1002e8c in `QtPrivate::FunctorCall<std::integer_sequence<unsigned __int64>,QtPrivate::List<>,void,``QWindowsWindow::requestUpdate'::`8'::<lambda_1>::operator()'::`8'::<lambda_1> >::call'::`2'::<lambda_1>::operator() D:\qt6\qtbase\src\corelib\kernel\qobjectdefs_impl.h:116 #5 0x7fffb1003887 in QtPrivate::FunctorCallBase::call_internal<void,`QtPrivate::FunctorCall<std::integer_sequence<unsigned __int64>,QtPrivate::List<>,void,``QWindowsWindow::requestUpdate'::`8'::<lambda_1>::operator()'::`8'::<lambda_1> >::call'::`2'::<lambda_1> > D:\qt6\qtbase\src\corelib\kernel\qobjectdefs_impl.h:65 #6 0x7fffb1002dc8 in QtPrivate::FunctorCall<std::integer_sequence<unsigned __int64>,QtPrivate::List<>,void,``QWindowsWindow::requestUpdate'::`8'::<lambda_1>::operator()'::`8'::<lambda_1> >::call D:\qt6\qtbase\src\corelib\kernel\qobjectdefs_impl.h:115 #7 0x7fffb1003861 in QtPrivate::FunctorCallable<``QWindowsWindow::requestUpdate'::`8'::<lambda_1>::operator()'::`8'::<lambda_1> >::call<QtPrivate::List<>,void> D:\qt6\qtbase\src\corelib\kernel\qobjectdefs_impl.h:337 #8 0x7fffb1002b8e in QtPrivate::QCallableObject<``QWindowsWindow::requestUpdate'::`8'::<lambda_1>::operator()'::`8'::<lambda_1>,QtPrivate::List<>,void>::impl D:\qt6\qtbase\src\corelib\kernel\qobjectdefs_impl.h:547 #9 0x7fffb55c9eae in QtPrivate::QSlotObjectBase::call(class QObject *, void **) D:\qt6\qtbase\src\corelib\kernel\qobjectdefs_impl.h:461 #10 0x7fffb5ac5923 in QMetaCallEvent::placeMetaCall(class QObject *) D:\qt6\qtbase\src\corelib\kernel\qobject.cpp:546 #11 0x7fffb5aada2b in QObject::event(class QEvent *) D:\qt6\qtbase\src\corelib\kernel\qobject.cpp:1479 #12 0x7fffb251035f in QWindow::event(class QEvent *) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:2782 #13 0x7ff8541e41c8 in QVideoWindow::event(class QEvent *) D:\qt6\qtmultimedia\src\multimedia\video\qvideowindow.cpp:506 #14 0x7fffb74b5c77 in QApplicationPrivate::notify_helper(class QObject *, class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:3273 #15 0x7fffb74b053e in QApplication::notify(class QObject *, class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:3223 #16 0x7fffb58faf6e in QCoreApplication::notifyInternal2(class QObject *, class QEvent *) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1109 #17 0x7fffb58f55d3 in QCoreApplication::sendEvent(class QObject *, class QEvent *) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1549 #18 0x7fffb5900b91 in QCoreApplicationPrivate::sendPostedEvents(class QObject *, int, class QThreadData *) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1904 #19 0x7fffb6205e48 in QEventDispatcherWin32::sendPostedEvents(void) D:\qt6\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp:925 #20 0x7fffb33f6c83 in QWindowsGuiEventDispatcher::sendPostedEvents(void) D:\qt6\qtbase\src\gui\platform\windows\qwindowsguieventdispatcher.cpp:43 #21 0x7fffb6200a75 in QEventDispatcherWin32::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp:483 #22 0x7fffb33f6c3d in QWindowsGuiEventDispatcher::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\gui\platform\windows\qwindowsguieventdispatcher.cpp:36 #23 0x7fffb593bcde in QEventLoop::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\corelib\kernel\qeventloop.cpp:104 #24 0x7fffb593c50e in QEventLoop::exec(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\corelib\kernel\qeventloop.cpp:186 #25 0x7fffb58f4ea0 in QCoreApplication::exec(void) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1452 #26 0x7fffb22a14b7 in QGuiApplication::exec(void) D:\qt6\qtbase\src\gui\kernel\qguiapplication.cpp:1967 #27 0x7fffb74aa4f9 in QApplication::exec(void) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:2540 #28 0x7ff6e6293419 in run(struct CLIArgs const &) D:\qt6\qtmultimedia\tests\manual\minimal-player\minimal-player.cpp:127 #29 0x7ff6e6293d9a in main D:\qt6\qtmultimedia\tests\manual\minimal-player\minimal-player.cpp:138 #30 0x7ff6e62a43fb in qtEntryPoint D:\qt6\qtbase\src\entrypoint\qtentrypoint_win.cpp:45 #31 0x7ff6e62a40bc in WinMain D:\qt6\qtbase\src\entrypoint\qtentrypoint_win.cpp:63 #32 0x7ff6e629f281 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:102 #33 0x7ff6e629f1d1 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #34 0x7ff6e629f08d in __scrt_common_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330 #35 0x7ff6e629f2fd in WinMainCRTStartup D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_winmain.cpp:16 #36 0x7ff8b3dfe8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6) #37 0x7ff8b54a8d9b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180008d9b) 0x11988bfd05e0 is located 288 bytes inside of 296-byte region [0x11988bfd04c0,0x11988bfd05e8) freed by thread T0 here: #0 0x7fffb1157fd3 in operator delete(void *, unsigned __int64) D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win_delete_scalar_size_thunk.cpp:41 #1 0x7fffb1008640 in QWindowsWindow::`scalar deleting dtor'(unsigned int) (D:\qt6\build\Desktop-Debug\qtbase\plugins\platforms\qwindowsd.dll+0x1802a8640) #2 0x7fffb25165eb in QWindowPrivate::destroy(void) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:2177 #3 0x7fffb25162bf in QWindowPrivate::destroy(void) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:2153 #4 0x7fffb2507740 in QWindow::destroy(void) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:2139 #5 0x7fffb250ffe0 in QWindow::event(class QEvent *) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:2734 #6 0x7fffb778bbbd in QWidgetWindow::event(class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qwidgetwindow.cpp:399 #7 0x7fffb74b5c77 in QApplicationPrivate::notify_helper(class QObject *, class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:3273 #8 0x7fffb74b053e in QApplication::notify(class QObject *, class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:3223 #9 0x7fffb58faf6e in QCoreApplication::notifyInternal2(class QObject *, class QEvent *) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1109 #10 0x7fffb58fa973 in QCoreApplication::sendSpontaneousEvent(class QObject *, class QEvent *) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1563 #11 0x7fffb22b4789 in QGuiApplicationPrivate::processCloseEvent(class QWindowSystemInterfacePrivate::CloseEvent *) D:\qt6\qtbase\src\gui\kernel\qguiapplication.cpp:2880 #12 0x7fffb22b7340 in QGuiApplicationPrivate::processWindowSystemEvent(class QWindowSystemInterfacePrivate::WindowSystemEvent *) D:\qt6\qtbase\src\gui\kernel\qguiapplication.cpp:2231 #13 0x7fffb2531156 in QWindowSystemInterface::sendWindowSystemEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\gui\kernel\qwindowsysteminterface.cpp:1117 #14 0x7fffb33f6c90 in QWindowsGuiEventDispatcher::sendPostedEvents(void) D:\qt6\qtbase\src\gui\platform\windows\qwindowsguieventdispatcher.cpp:44 #15 0x7fffb6200a75 in QEventDispatcherWin32::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp:483 #16 0x7fffb33f6c3d in QWindowsGuiEventDispatcher::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\gui\platform\windows\qwindowsguieventdispatcher.cpp:36 #17 0x7fffb593bcde in QEventLoop::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\corelib\kernel\qeventloop.cpp:104 #18 0x7fffb593c50e in QEventLoop::exec(class QFlags<enum QEventLoop::ProcessEventsFlag>) D:\qt6\qtbase\src\corelib\kernel\qeventloop.cpp:186 #19 0x7fffb58f4ea0 in QCoreApplication::exec(void) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1452 #20 0x7fffb22a14b7 in QGuiApplication::exec(void) D:\qt6\qtbase\src\gui\kernel\qguiapplication.cpp:1967 #21 0x7fffb74aa4f9 in QApplication::exec(void) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:2540 #22 0x7ff6e6293419 in run(struct CLIArgs const &) D:\qt6\qtmultimedia\tests\manual\minimal-player\minimal-player.cpp:127 #23 0x7ff6e6293d9a in main D:\qt6\qtmultimedia\tests\manual\minimal-player\minimal-player.cpp:138 #24 0x7ff6e62a43fb in qtEntryPoint D:\qt6\qtbase\src\entrypoint\qtentrypoint_win.cpp:45 #25 0x7ff6e62a40bc in WinMain D:\qt6\qtbase\src\entrypoint\qtentrypoint_win.cpp:63 #26 0x7ff6e629f281 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:102 #27 0x7ff6e629f1d1 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #28 0x7ff6e629f08d in __scrt_common_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330 previously allocated by thread T0 here: [swscaler @ 000011D28CBB6410] deprecated pixel format used, make sure you did set range correctly #0 0x7fffb11580a5 in operator new(unsigned __int64) D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win_new_scalar_thunk.cpp:40 #1 0x7fffb0e3732c in QWindowsIntegration::createPlatformWindowHelper(class QWindow *, struct QWindowsWindowData const &) const D:\qt6\qtbase\src\plugins\platforms\windows\qwindowsintegration.cpp:356 #2 0x7fffb0e32623 in QWindowsIntegration::createPlatformWindow(class QWindow *) const D:\qt6\qtbase\src\plugins\platforms\windows\qwindowsintegration.cpp:322 #3 0x7fffb25158a5 in QWindowPrivate::create(bool) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:574 #4 0x7fffb24fef63 in QWindow::create(void) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:743 #5 0x7fffb2513dbb in QWindowPrivate::setVisible(bool) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:379 #6 0x7fffb250b6df in QWindow::setVisible(bool) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:716 #7 0x7fffb250bcbc in QWindow::showNormal(void) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:2424 #8 0x7fffb250b725 in QWindow::show(void) D:\qt6\qtbase\src\gui\kernel\qwindow.cpp:2339 #9 0x7fffb779ed51 in QWindowContainer::event(class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qwindowcontainer.cpp:317 #10 0x7fffb74b5c77 in QApplicationPrivate::notify_helper(class QObject *, class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:3273 #11 0x7fffb74b0518 in QApplication::notify(class QObject *, class QEvent *) D:\qt6\qtbase\src\widgets\kernel\qapplication.cpp:3219 #12 0x7fffb58faf6e in QCoreApplication::notifyInternal2(class QObject *, class QEvent *) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1109 #13 0x7fffb58f55d3 in QCoreApplication::sendEvent(class QObject *, class QEvent *) D:\qt6\qtbase\src\corelib\kernel\qcoreapplication.cpp:1549 #14 0x7fffb76f970e in QWidgetPrivate::show_helper(void) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:8120 #15 0x7fffb76fc175 in QWidgetPrivate::setVisible(bool) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:8430 #16 0x7fffb76bfd20 in QWidget::setVisible(bool) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:8358 #17 0x7fffb76f40fb in QWidgetPrivate::showChildren(bool) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:8518 #18 0x7fffb76f952a in QWidgetPrivate::show_helper(void) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:8075 #19 0x7fffb76fc175 in QWidgetPrivate::setVisible(bool) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:8430 #20 0x7fffb76bfd20 in QWidget::setVisible(bool) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:8358 #21 0x7fffb76c01b5 in QWidget::show(void) D:\qt6\qtbase\src\widgets\kernel\qwidget.cpp:7975 #22 0x7ff6e62930a5 in run(struct CLIArgs const &) D:\qt6\qtmultimedia\tests\manual\minimal-player\minimal-player.cpp:101 #23 0x7ff6e6293d9a in main D:\qt6\qtmultimedia\tests\manual\minimal-player\minimal-player.cpp:138 #24 0x7ff6e62a43fb in qtEntryPoint D:\qt6\qtbase\src\entrypoint\qtentrypoint_win.cpp:45 #25 0x7ff6e62a40bc in WinMain D:\qt6\qtbase\src\entrypoint\qtentrypoint_win.cpp:63 #26 0x7ff6e629f281 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:102 #27 0x7ff6e629f1d1 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #28 0x7ff6e629f08d in __scrt_common_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330
it seems to be a rare case, i've only seen it by chance in one out of many runs (following my practice of always debugging with asan)
For Gerrit Dashboard: QTBUG-140869 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
682515,6 | QWindowsWindow: requestUpdate - fix use-after-free | dev | qt/qtbase | Status: MERGED | +2 | 0 |
683388,2 | QWindowsWindow: requestUpdate - fix use-after-free | 6.10 | qt/qtbase | Status: MERGED | +2 | 0 |