Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-38800

Segmentation fault in QFontEngineFT::init when filling a model asynchronously

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P1: Critical
    • Resolution: Done
    • Affects Version/s: 5.3.0 Beta1, 5.3.0
    • Fix Version/s: 5.4.0 RC
    • Labels:
      None
    • Environment:
      Kubuntu 13.10
      gcc (Ubuntu/Linaro 4.8.1-10ubuntu9) 4.8.1
      Qt 5.3.0-beta or Qt from git stable on May 5th
    • Commits:
      dd08a22a4e8d7120341a1227e227de3f0628dd2f

      Description

      Attached is a test case that crashes due to what looks like a race condition in QFontEngineFT::init(..).

      There is a number of things that are present in order for this crash to happen:

      • The "label" Text element needs to have an HTML tag at the end (in this case, <tt>)
      • The "codeLine" Text element needs to have the FontLoader included
      • The model is populated asynchronously when we set the "code" property on it (the timer in CodeModel emulates the original application, where we pass the code through a webview)

      The interval on the timer in CodeModel.cpp might need to be modified in order to have it crash. For me, it crashes with an interval between 0 and 45 ms.

      It crashes both with 5.3.0-beta as well as with the stable git branch. The original application also crashes with 5.2.1, although I do not get the test application to do that.

      It does no longer crash if I set the environment variable QSG_RENDER_LOOP to "basic".

      Backtrace (with git stable from May 5th):
      0 main_arena /lib/x86_64-linux-gnu/libc.so.6 0x7ffff59a5d48
      1 FT_Get_PS_Font_Info /usr/lib/x86_64-linux-gnu/libfreetype.so.6 0x7fffefaec83d
      2 QFontEngineFT::init qfontengine_ft.cpp 705 0x7ffff187d715
      3 QFontEngineFT::init qfontengine_ft.cpp 680 0x7ffff187d5b4
      4 QFontconfigDatabase::fontEngine qfontconfigdatabase.cpp 652 0x7ffff1888613
      5 loadSingleEngine qfontdatabase.cpp 825 0x7ffff68c611c
      6 loadEngine qfontdatabase.cpp 847 0x7ffff68c62ae
      7 QFontDatabase::findFont qfontdatabase.cpp 2525 0x7ffff68cb825
      8 QFontDatabase::load qfontdatabase.cpp 2607 0x7ffff68cbdc7
      9 QFontPrivate::engineForScript qfont.cpp 218 0x7ffff689dc43
      10 QTextEngine::fontEngine qtextengine.cpp 1926 0x7ffff68d71f7
      11 QTextEngine::shapeText qtextengine.cpp 924 0x7ffff68d2d63
      12 QTextEngine::shape qtextengine.cpp 1401 0x7ffff68d4c63
      13 QTextLine::layout_helper qtextlayout.cpp 1753 0x7ffff68ece41
      14 QTextLine::setLineWidth qtextlayout.cpp 1537 0x7ffff68ec36d
      15 QTextDocumentLayoutPrivate::layoutBlock qtextdocumentlayout.cpp 2638 0x7ffff6942eea
      16 QTextDocumentLayoutPrivate::layoutFlow qtextdocumentlayout.cpp 2424 0x7ffff69417f2
      17 QTextDocumentLayoutPrivate::layoutFrame qtextdocumentlayout.cpp 2165 0x7ffff693ff74
      18 QTextDocumentLayoutPrivate::layoutFrame qtextdocumentlayout.cpp 2071 0x7ffff693f432
      19 QTextDocumentLayout::doLayout qtextdocumentlayout.cpp 2964 0x7ffff6944f25
      20 QTextDocumentLayoutPrivate::ensureLayoutedByPosition qtextdocumentlayout.cpp 3136 0x7ffff6945c87
      21 QTextDocumentLayoutPrivate::layoutStep qtextdocumentlayout.cpp 3142 0x7ffff6945cde
      22 QTextDocumentLayout::documentChanged qtextdocumentlayout.cpp 2921 0x7ffff6944b65
      23 QTextDocument::setDefaultFont qtextdocument.cpp 1618 0x7ffff690a585
      24 QQuickTextPrivate::updateSize qquicktext.cpp 470 0x7ffff791104e
      25 QQuickText::updatePolish qquicktext.cpp 2263 0x7ffff7917890
      26 QQuickWindowPrivate::polishItems qquickwindow.cpp 271 0x7ffff78bba51
      27 QSGThreadedRenderLoop::polishAndSync qsgthreadedrenderloop.cpp 1150 0x7ffff788eece
      28 QSGThreadedRenderLoop::handleExposure qsgthreadedrenderloop.cpp 986 0x7ffff788e820
      29 QSGThreadedRenderLoop::exposureChanged qsgthreadedrenderloop.cpp 920 0x7ffff788e442
      30 QQuickWindow::exposeEvent qquickwindow.cpp 216 0x7ffff78bb7b0
      31 QWindow::event qwindow.cpp 1956 0x7ffff67e45fc
      32 QQuickWindow::event qquickwindow.cpp 1341 0x7ffff78bf5bd
      33 QCoreApplicationPrivate::notify_helper qcoreapplication.cpp 1052 0x7ffff61e5ebe
      34 QCoreApplication::notify qcoreapplication.cpp 997 0x7ffff61e5b80
      35 QGuiApplication::notify qguiapplication.cpp 1457 0x7ffff67d483c
      36 QCoreApplication::notifyInternal qcoreapplication.cpp 935 0x7ffff61e5a88
      37 QCoreApplication::sendSpontaneousEvent qcoreapplication.h 240 0x7ffff67dbc37
      38 QGuiApplicationPrivate::processExposeEvent qguiapplication.cpp 2528 0x7ffff67d91ab
      39 QGuiApplicationPrivate::processWindowSystemEvent qguiapplication.cpp 1566 0x7ffff67d4af6
      40 QWindowSystemInterface::sendWindowSystemEvents qwindowsysteminterface.cpp 579 0x7ffff67bf1b1
      41 QUnixEventDispatcherQPA::processEvents qunixeventdispatcher.cpp 71 0x7ffff1891cf1
      42 QEventLoop::processEvents qeventloop.cpp 136 0x7ffff61e27b8
      43 QEventLoop::exec qeventloop.cpp 212 0x7ffff61e2a83
      44 QCoreApplication::exec qcoreapplication.cpp 1188 0x7ffff61e616e
      45 QGuiApplication::exec qguiapplication.cpp 1436 0x7ffff67d4764
      46 main main.cpp 24 0x403894

      In the rare case that it actually runs all the way through, at shutdown I get a crash in QFreetypeFace::cleanup instead:
      0 ?? 0x7fff00000003
      1 QFreetypeFace::cleanup qfontengine_ft.cpp 325 0x7ffff187b585
      2 QtFreetypeData::~QtFreetypeData qfontengine_ft.cpp 153 0x7ffff187aa32
      3 qThreadStorage_deleteData<QtFreetypeData> qthreadstorage.h 94 0x7ffff1886b0a
      4 QThreadStorage<QtFreetypeData*>::deleteData qthreadstorage.h 137 0x7ffff18861f6
      5 QThreadStorageData::finish qthreadstorage.cpp 203 0x7ffff5f6f17b
      6 QCoreApplicationPrivate::cleanupThreadData qcoreapplication.cpp 455 0x7ffff61e4a0e
      7 QGuiApplicationPrivate::~QGuiApplicationPrivate qguiapplication.cpp 1303 0x7ffff67d44f7
      8 QGuiApplicationPrivate::~QGuiApplicationPrivate qguiapplication.cpp 1319 0x7ffff67d46bc
      9 QScopedPointerDeleter<QObjectData>::cleanup qscopedpointer.h 62 0x7ffff622dae4
      10 QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::~QScopedPointer qscopedpointer.h 109 0x7ffff622c015
      11 QObject::~QObject qobject.cpp 880 0x7ffff6221606
      12 QCoreApplication::~QCoreApplication qcoreapplication.cpp 777 0x7ffff61e58d4
      13 QGuiApplication::~QGuiApplication qguiapplication.cpp 550 0x7ffff67d18d8
      14 main main.cpp 24 0x4038ae

        Attachments

        1. FreetypeCrash.tar.gz
          69 kB
          Tobias Nätterlund
        2. SlideViewer.tar.gz
          135 kB
          Tobias Nätterlund
        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

            Assignee:
            esabraha Eskil Abrahamsen Blomfeldt
            Reporter:
            tnatterlund Tobias Nätterlund
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Gerrit Reviews

                There are no open Gerrit changes