Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-70309

ASAN heap-use-after-free with Qt Quick application that users shader effects

    XMLWordPrintable

Details

    Description

      Exception Type:        EXC_CRASH (SIGABRT)
      Exception Codes:       0x0000000000000000, 0x0000000000000000
      Exception Note:        EXC_CORPSE_NOTIFY
      
      Application Specific Information:
      =================================================================
      ==73827==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000073e18 at pc 0x00010d6fa02e bp 0x70000b6249b0 sp 0x70000b6249a8
      READ of size 8 at 0x611000073e18 thread T9
          #0 0x10d6fa02d in QSGNode::firstChild() const qsgnode.h:140
          #1 0x10d88b21e in QSGDefaultLayer::grab() qsgdefaultlayer.cpp:304
          #2 0x10d88a999 in QSGDefaultLayer::updateTexture() qsgdefaultlayer.cpp:181
          #3 0x10df5b145 in QQuickOpenGLShaderEffectMaterial::updateTextures() const qquickopenglshadereffectnode.cpp:474
          #4 0x10df5b956 in QQuickOpenGLShaderEffectNode::preprocess() qquickopenglshadereffectnode.cpp:516
          #5 0x10d70bb06 in QSGRenderer::preprocess() qsgrenderer.cpp:312
          #6 0x10d7092e7 in QSGRenderer::renderScene(QSGBindable const&) qsgrenderer.cpp:221
          #7 0x10d708ed9 in QSGRenderer::renderScene(unsigned int) qsgrenderer.cpp:197
          #8 0x10d86b93e in QSGDefaultRenderContext::renderNextFrame(QSGRenderer*, unsigned int) qsgdefaultrendercontext.cpp:182
          #9 0x10da2900e in QQuickWindowPrivate::renderSceneGraph(QSize const&) qquickwindow.cpp:485
          #10 0x10d897a74 in QSGRenderThread::syncAndRender() qsgthreadedrenderloop.cpp:645
          #11 0x10d89970d in QSGRenderThread::run() qsgthreadedrenderloop.cpp:729
          #12 0x10bb5f047 in QThreadPrivate::start(void*) qthread_unix.cpp:367
          #13 0x7fff50c50660 in _pthread_body (libsystem_pthread.dylib:x86_64+0x3660)
          #14 0x7fff50c5050c in _pthread_start (libsystem_pthread.dylib:x86_64+0x350c)
          #15 0x7fff50c4fbf8 in thread_start (libsystem_pthread.dylib:x86_64+0x2bf8)
      
      0x611000073e18 is located 24 bytes inside of 216-byte region [0x611000073e00,0x611000073ed8)
      freed by thread T9 here:
          #0 0x1113d8132 in wrap__ZdlPv (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x63132)
          #1 0x10d6fe2a1 in QSGTransformNode::~QSGTransformNode() qsgnode.cpp:1183
          #2 0x10da59954 in QQuickWindowPrivate::cleanupNodes() qquickwindow.cpp:3103
          #3 0x10da27d21 in QQuickWindowPrivate::updateDirtyNodes() qquickwindow.cpp:3157
          #4 0x10da2727a in QQuickWindowPrivate::syncSceneGraph() qquickwindow.cpp:435
          #5 0x10d89663f in QSGRenderThread::sync(bool) qsgthreadedrenderloop.cpp:562
          #6 0x10d89726d in QSGRenderThread::syncAndRender() qsgthreadedrenderloop.cpp:609
          #7 0x10d89970d in QSGRenderThread::run() qsgthreadedrenderloop.cpp:729
          #8 0x10bb5f047 in QThreadPrivate::start(void*) qthread_unix.cpp:367
          #9 0x7fff50c50660 in _pthread_body (libsystem_pthread.dylib:x86_64+0x3660)
          #10 0x7fff50c5050c in _pthread_start (libsystem_pthread.dylib:x86_64+0x350c)
          #11 0x7fff50c4fbf8 in thread_start (libsystem_pthread.dylib:x86_64+0x2bf8)
      
      previously allocated by thread T9 here:
          #0 0x1113d7b32 in wrap__Znwm (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x62b32)
          #1 0x10d9ab86a in QQuickItemPrivate::createTransformNode() qquickitem.cpp:3888
          #2 0x10d68bef7 in QQuickItemPrivate::itemNode() qquickitem_p.h:932
          #3 0x10defede3 in QQuickShaderEffectSource::updatePaintNode(QSGNode*, QQuickItem::UpdatePaintNodeData*) qquickshadereffectsource.cpp:695
          #4 0x10da5cfd3 in QQuickWindowPrivate::updateDirtyNode(QQuickItem*) qquickwindow.cpp:3424
          #5 0x10da28032 in QQuickWindowPrivate::updateDirtyNodes() qquickwindow.cpp:3169
          #6 0x10da2727a in QQuickWindowPrivate::syncSceneGraph() qquickwindow.cpp:435
          #7 0x10d89663f in QSGRenderThread::sync(bool) qsgthreadedrenderloop.cpp:562
          #8 0x10d89726d in QSGRenderThread::syncAndRender() qsgthreadedrenderloop.cpp:609
          #9 0x10d89970d in QSGRenderThread::run() qsgthreadedrenderloop.cpp:729
          #10 0x10bb5f047 in QThreadPrivate::start(void*) qthread_unix.cpp:367
          #11 0x7fff50c50660 in _pthread_body (libsystem_pthread.dylib:x86_64+0x3660)
          #12 0x7fff50c5050c in _pthread_start (libsystem_pthread.dylib:x86_64+0x350c)
          #13 0x7fff50c4fbf8 in thread_start (libsystem_pthread.dylib:x86_64+0x2bf8)
      
      Thread T9 created by T0 here:
          #0 0x1113c3e1d in wrap_pthread_create (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4ee1d)
          #1 0x10bb620ce in QThread::start(QThread::Priority) qthread_unix.cpp:726
          #2 0x10d89f8d9 in QSGThreadedRenderLoop::handleExposure(QQuickWindow*) qsgthreadedrenderloop.cpp:996
          #3 0x10d89d648 in QSGThreadedRenderLoop::exposureChanged(QQuickWindow*) qsgthreadedrenderloop.cpp:915
          #4 0x10da24bd8 in QQuickWindow::exposeEvent(QExposeEvent*) qquickwindow.cpp:228
          #5 0x109e12fb4 in QWindow::event(QEvent*) qwindow.cpp:2307
          #6 0x10da3d7a9 in QQuickWindow::event(QEvent*) qquickwindow.cpp:1643
          #7 0x107ff2344 in QApplicationPrivate::notify_helper(QObject*, QEvent*) qapplication.cpp:3738
          #8 0x107ff8811 in QApplication::notify(QObject*, QEvent*) qapplication.cpp:3108
          #9 0x10c32d5c5 in QCoreApplication::notifyInternal2(QObject*, QEvent*) qcoreapplication.cpp:1048
          #10 0x10c32fcac in QCoreApplication::sendSpontaneousEvent(QObject*, QEvent*) qcoreapplication.cpp:1431
          #11 0x109dcd5a5 in QGuiApplicationPrivate::processExposeEvent(QWindowSystemInterfacePrivate::ExposeEvent*) qguiapplication.cpp:3040
          #12 0x109dbc685 in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) qguiapplication.cpp:1876
          #13 0x109d2daad in bool QWindowSystemInterfacePrivate::handleWindowSystemEvent<QWindowSystemInterface::SynchronousDelivery>(QWindowSystemInterfacePrivate::WindowSystemEvent*) qwindowsysteminterface.cpp:104
          #14 0x109d4a76c in void QWindowSystemInterface::handleExposeEvent<QWindowSystemInterface::SynchronousDelivery>(QWindow*, QRegion const&) qwindowsysteminterface.cpp:339
          #15 0x117be4b6e in QCocoaWindow::handleExposeEvent(QRegion const&) qcocoawindow.mm:1169
          #16 0x117c10327 in -[QNSView(Drawing) updateRegion:] qnsview_drawing.mm:123
          #17 0x117c1238f in -[QNSView(Drawing) displayLayer:] qnsview_drawing.mm:214
          #18 0x7fff33e7745e in -[CALayer display] (QuartzCore:x86_64+0x2045e)
          #19 0x7fff261dd59d in _NSBackingLayerDisplay (AppKit:x86_64+0x18c59d)
          #20 0x7fff261d2408 in -[_NSViewBackingLayer display] (AppKit:x86_64+0x181408)
          #21 0x7fff33e68e7c in CA::Layer::display_if_needed(CA::Transaction*) (QuartzCore:x86_64+0x11e7c)
          #22 0x7fff33e6893a in CA::Layer::layout_and_display_if_needed(CA::Transaction*) (QuartzCore:x86_64+0x1193a)
          #23 0x7fff33e6792b in CA::Context::commit_transaction(CA::Transaction*) (QuartzCore:x86_64+0x1092b)
          #24 0x7fff33e674c4 in CA::Transaction::commit() (QuartzCore:x86_64+0x104c4)
          #25 0x7fff26989a71 in __65+[CATransaction(NSCATransaction) NS_setFlushesWithDisplayRefresh]_block_invoke (AppKit:x86_64+0x938a71)
          #26 0x7fff28b15416 in __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ (CoreFoundation:x86_64h+0xa3416)
          #27 0x7fff28b1533e in __CFRunLoopDoObservers (CoreFoundation:x86_64h+0xa333e)
          #28 0x7fff28af78b7 in __CFRunLoopRun (CoreFoundation:x86_64h+0x858b7)
          #29 0x7fff28af7152 in CFRunLoopRunSpecific (CoreFoundation:x86_64h+0x85152)
          #30 0x7fff27de1d95 in RunCurrentEventLoopInMode (HIToolbox:x86_64+0x2fd95)
          #31 0x7fff27de1a0e in ReceiveNextEventCommon (HIToolbox:x86_64+0x2fa0e)
          #32 0x7fff27de1883 in _BlockUntilNextEventMatchingListInModeWithFilter (HIToolbox:x86_64+0x2f883)
          #33 0x7fff26092a72 in _DPSNextEvent (AppKit:x86_64+0x41a72)
          #34 0x7fff26828e33 in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (AppKit:x86_64+0x7d7e33)
          #35 0x7fff26087884 in -[NSApplication run] (AppKit:x86_64+0x36884)
          #36 0x117c53a99 in QCocoaEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qcocoaeventdispatcher.mm:430
          #37 0x10c31d198 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qeventloop.cpp:136
          #38 0x10c31d89d in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) qeventloop.cpp:214
          #39 0x10c32f3ae in QCoreApplication::exec() qcoreapplication.cpp:1336
          #40 0x109dbbaf5 in QGuiApplication::exec() qguiapplication.cpp:1753
          #41 0x106f69310 in TshnmApplication::doRun(int&, char**) TshnmApplication.cpp:264
          #42 0x10749ca87 in AbstractApplication::run(int&, char**) AbstractApplication.cpp:43
          #43 0x106f9b1d7 in main main.cpp:17
          #44 0x7fff50938014 in start (libdyld.dylib:x86_64+0x1014)
      

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            qt.team.quick.subscriptions Qt Quick and Widgets Team
            mitch_curtis Mitch Curtis
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes