Details
Description
Start VLC from within the KDE desktop. Get to the open file dialog (KDE will override Qt's default). Finally exit VLC. A crash occurs in a cleanup handler involving QtDBus and KIO, after VLC is already finished:
With the GNU debugger:
Program received signal SIGSEGV, Segmentation fault.
0xaeb956a5 in ?? () from /usr/lib/i386-linux-gnu/libQtDBus.so.4
(gdb) bt
#0 0xaeb956a5 in ?? () from /usr/lib/i386-linux-gnu/libQtDBus.so.4
#1 0xaeb95d3b in ?? () from /usr/lib/i386-linux-gnu/libQtDBus.so.4
#2 0xb12eb385 in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) () from /usr/lib/i386-linux-gnu/libQtCore.so.4
#3 0xb12fa81f in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib/i386-linux-gnu/libQtCore.so.4
#4 0xb12faf65 in QObject::destroyed(QObject*) ()
from /usr/lib/i386-linux-gnu/libQtCore.so.4
#5 0xb12ff237 in QObject::~QObject() ()
from /usr/lib/i386-linux-gnu/libQtCore.so.4
#6 0xaf80b8f6 in KIO::Scheduler::~Scheduler() () from /usr/lib/libkio.so.5
#7 0xaf80b91c in KIO::Scheduler::~Scheduler() () from /usr/lib/libkio.so.5
#8 0xaf818e65 in ?? () from /usr/lib/libkio.so.5
#9 0xaf80e643 in ?? () from /usr/lib/libkio.so.5
#10 0xaf7696f9 in ?? () from /usr/lib/libkio.so.5
#11 0xb7e093f1 in __run_exit_handlers (status=status@entry=0,
listp=0xb7f813e4 <__exit_funcs>,
run_list_atexit=run_list_atexit@entry=true) at exit.c:77
#12 0xb7e0947d in __GI_exit (status=0) at exit.c:99
#13 0xb7def8cd in __libc_start_main (main=0x8048db0 <main>, argc=1,
ubp_av=0xbffff3b4, init=0x8049950 <__libc_csu_init>,
fini=0x80499c0 <__libc_csu_fini>, rtld_fini=0xb7fee0c0 <_dl_fini>,
stack_end=0xbffff3ac) at libc-start.c:294
#14 0x080492a3 in _start ()
Or with valgrind:
==3751== Thread 1:
==3751== Invalid read of size 4
==3751== at 0xEA646A5: ??? (in /usr/lib/i386-linux-gnu/libQtDBus.so.4.8.4)
==3751== by 0xEA64D3A: ??? (in /usr/lib/i386-linux-gnu/libQtDBus.so.4.8.4)
==3751== by 0x6257384: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/i386-linux-gnu/libQtCore.so.4.8.4)
==3751== by 0x6266F64: QObject::destroyed(QObject*) (in /usr/lib/i386-linux-gnu/libQtCore.so.4.8.4)
==3751== by 0xDE65642: ??? (in /usr/lib/libkio.so.5.8.0)
==3751== by 0xDDC06F8: ??? (in /usr/lib/libkio.so.5.8.0)
==3751== by 0x40BE3F0: __run_exit_handlers (exit.c:77)
==3751== by 0x40BE47C: exit (exit.c:99)
==3751== by 0x40A48CC: (below main) (libc-start.c:294)
==3751== Address 0x4 is not stack'd, malloc'd or (recently) free'd
==3751==
==3751==
==3751== Process terminating with default action of signal 11 (SIGSEGV)
==3751== Access not within mapped region at address 0x4
==3751== at 0xEA646A5: ??? (in /usr/lib/i386-linux-gnu/libQtDBus.so.4.8.4)
==3751== by 0xEA64D3A: ??? (in /usr/lib/i386-linux-gnu/libQtDBus.so.4.8.4)
==3751== by 0x6257384: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/i386-linux-gnu/libQtCore.so.4.8.4)
==3751== by 0x6266F64: QObject::destroyed(QObject*) (in /usr/lib/i386-linux-gnu/libQtCore.so.4.8.4)
==3751== by 0xDE65642: ??? (in /usr/lib/libkio.so.5.8.0)
==3751== by 0xDDC06F8: ??? (in /usr/lib/libkio.so.5.8.0)
==3751== by 0x40BE3F0: __run_exit_handlers (exit.c:77)
==3751== by 0x40BE47C: exit (exit.c:99)
==3751== by 0x40A48CC: (below main) (libc-start.c:294)
==3751== If you believe this happened as a result of a stack
==3751== overflow in your program's main thread (unlikely but
==3751== possible), you can try to increase the size of the
==3751== main thread stack using the --main-stacksize= flag.
==3751== The main thread stack size used in this run was 8388608.
==3751==
This bug was filed against KDE and dismissed as a QtDBus bug:
https://bugs.kde.org/show_bug.cgi?id=234484
KDE-side work-around was rejected by QtDBus developer here:
http://lists.kde.org/?l=kde-core-devel&m=129692764012282&w=2
The oldest report that I know is in Ubuntu Launchpad:
https://bugs.launchpad.net/kdelibs/+bug/408719
Attachments
Issue Links
- relates to
-
QTBUG-27809 Calling QDBusPendingReply::waitForFinished() on seperate objects from multiple threads causes crash.
-
- Closed
-
For Gerrit Dashboard: QTBUG-31932 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
59633,1 | Don't crash if the relayed signal was emitted from the wrong thread | stable | qt/qtbase | Status: MERGED | +2 | 0 |
61932,1 | Don't crash if the relayed signal was emitted from the wrong thread | 4.8 | qt/qt | Status: MERGED | +2 | 0 |