Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-87320

Segfault in qimage_conversions.cpp

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P1: Critical
    • Resolution: Done
    • Affects Version/s: 5.15.1
    • Fix Version/s: 5.15.2, 6.0
    • Component/s: Image formats
    • Labels:
      None
    • Environment:
      Linux/X11 Arch
    • Platform/s:
      Linux/X11
    • Commits:
      0aa8925f1acd47cadc71483cac97d202444d15db (qt/qtbase/dev) b89d68f8610fa74c90905ffde4e1479ac78ddf45 (qt/qtbase/5.15)

      Description

      I am experiencing a segfault in qimage_conversions.cpp. The full backtrace is below. The cause is that when doing parallel image format conversions, the code does not check is QThreadPool::gloablInstance() is NULL. For reasons not clear to me, it is NULL when running inside a docker container. For full context, see https://github.com/kovidgoyal/calibre/commit/28ef780d9911d598314d98bdfc3b1c88a94681df

       

      The fix is simply to check if threadPoll == NULL at lines 296 and 241 in qimage_conversions.cpp

       

      #0  QThreadPool::contains(QThread const*) const (this=this@entry=0x0, thread=0x555555d5c6e0) at thread/qthreadpool.cpp:787
              d = <optimized out>
              poolThread = <optimized out>
      #1  0x00007ffff1487500 in convert_generic(QImageData*, QImageData const*, QFlags<Qt::ImageConversionFlag>) (dest=<optimized out>, src=0x5555571779c0, flags=..., 
          flags@entry=...) at image/qimage_conversions.cpp:240
              destLayout = 0x7ffff19aa580 <qPixelLayouts+384>
              fetch = <optimized out>
              store = <optimized out>
              convertSegment = 
          {__src = 0x5555571779c0, __dest = 0x555556cfbbc0, __flags = {i = 0}, __destLayout = 0x7ffff19aa580 <qPixelLayouts+384>, __fetch = 0x7ffff13deb40 <fetchARGB32ToARGB32PM_sse4(unsigned int*, unsigned char const*, int, int, QVector<unsigned int> const*, QDitherInfo*)>, __store = 0x7ffff1673440 <storePassThrough(uchar*, uint const*, int, int, QVector<unsigned int> const*, QDitherInfo*)>}
              segments = 4
              threadPool = 0x0
              semaphore = 
                      {{d = 0x7fff00000020, u = {_q_value = {<std::__atomic_base<unsigned long long>> = {static _S_alignment = 8, _M_i = 140733193388064}, static is_always_lock_free = true}}}}
              y = <optimized out>
      #2  0x00007ffff14758dc in QImage::convertToFormat_helper(QImage::Format, QFlags<Qt::ImageConversionFlag>) const
          (this=this@entry=0x7fffffffa690, format=format@entry=QImage::Format_ARGB32_Premultiplied, flags=flags@entry=...) at image/qimage.cpp:2103
              image = 
                {<QPaintDevice> = {_vptr.QPaintDevice = 0x7ffff199d588 <vtable for QImage+16>, painters = 0, reserved = 0x0}, static staticMetaObject = {d = {superdata = {direct = 0x0}, stringdata = 0x7ffff18eabc0 <qt_meta_stringdata_QImage>, data = 0x7ffff18eaa60 <qt_meta_data_QImage>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}, d = 0x555556cfbbc0}
              converter = 0x7ffff1487420 <convert_generic(QImageData*, QImageData const*, QFlags<Qt::ImageConversionFlag>)>
      #3  0x00007ffff27d6848 in QImage::convertToFormat(QImage::Format, QFlags<Qt::ImageConversionFlag>) const &
          (flags=..., f=QImage::Format_ARGB32_Premultiplied, this=0x7fffffffa690) at /usr/include/qt/QtGui/qimage.h:184
              PyGILRelease = {thread_state = 0x55555557e820}
              img = 
                {<QPaintDevice> = {_vptr.QPaintDevice = 0x7ffff199d588 <vtable for QImage+16>, painters = 0, reserved = 0x0}, static staticMetaObject = {d = {superdata = {direct = 0x0}, stringdata = 0x7ffff18eabc0 <qt_meta_stringdata_QImage>, data = 0x7ffff18eaa60 <qt_meta_data_QImage>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}, d = 0x5555571779c0}
              cw = <optimized out>
              ch = <optimized out>
              iw = <optimized out>
              ih = <optimized out>
              r = <optimized out>
              c = <optimized out>
              right = 256
              bottom = <optimized out>
              height = 256
              width = 256
              s = <optimized out>
              src = <optimized out>
              dest = <optimized out>
      #4  overlay(QImage const&, QImage&, unsigned int, unsigned int) (image=..., canvas=..., left=0, top=0) at ../../../../../src/calibre/utils/imageops/imageops.cpp:610
              PyGILRelease = {thread_state = 0x55555557e820}
              img = 
                {<QPaintDevice> = {_vptr.QPaintDevice = 0x7ffff199d588 <vtable for QImage+16>, painters = 0, reserved = 0x0}, static staticMetaObject = {d = {superdata = {direct = 0x0}, stringdata = 0x7ffff18eabc0 <qt_meta_stringdata_QImage>, data = 0x7ffff18eaa60 <qt_meta_data_QImage>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}, d = 0x5555571779c0}
              cw = <optimized out>
              ch = <optimized out>
              iw = <optimized out>
              ih = <optimized out>
              r = <optimized out>
              c = <optimized out>
              right = 256
              bottom = <optimized out>
              height = 256
              width = 256
              s = <optimized out>
              src = <optimized out>
              dest = <optimized out>
      #5  0x00007ffff27d4dd5 in func_overlay(PyObject*, PyObject*) (sipArgs=<optimized out>) at /usr/src/debug/calibre/build/pyqt/imageops/imageops.sip:59
              a0 = 0x555556cfb8c0
              a1 = 0x5555570a1e10
              a2 = 0
              a3 = 0
              sipParseErr = 0x0
      #6  0x00007ffff7d5e1ea in PyCFunction_Call () at /usr/lib/libpython3.8.so.1.0
      #7  0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
      #8  0x00007ffff7d4c458 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #9  0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #10 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #11 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #12 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #13 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #14 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #15 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #16 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #17 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #18 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #19 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #20 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #21 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #22 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
      #23 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
      #24 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #25 0x00007ffff7d46762 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #26 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #27 0x00007ffff7d4c025 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #28 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #29 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #30 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #31 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #32 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #33 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #34 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #35 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #36 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
      #37 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
      #38 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #39 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #40 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
      #41 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
      #42 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
      #43 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
      #44 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #45 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #46 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #47 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
      #48 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
      #49 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #50 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #51 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
      #52 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
      #53 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
      #54 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
      #55 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #56 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #57 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #58 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
      #59 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
      #60 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #61 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #62 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
      #63 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
      #64 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
      #65 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
      #66 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #67 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #68 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #69 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
      #70 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
      #71 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #72 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #73 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
      #74 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
      #75 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
      #76 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
      #77 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #78 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #79 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #80 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
      #81 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
      #82 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #83 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #84 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
      #85 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
      #86 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
      #87 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
      #88 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #89 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #90 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #91 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #92 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #93 0x00007ffff7d484d9 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #94 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #95 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #96 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #97 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #98 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
      #99 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #100 0x00007ffff7df81cd in  () at /usr/lib/libpython3.8.so.1.0
      #101 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
      #102 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
      #103 0x00007ffff7df73a3 in PyEval_EvalCode () at /usr/lib/libpython3.8.so.1.0
      #104 0x00007ffff7e02c18 in  () at /usr/lib/libpython3.8.so.1.0
      #105 0x00007ffff7dfce33 in  () at /usr/lib/libpython3.8.so.1.0
      #106 0x00007ffff7cbb9a9 in PyRun_FileExFlags () at /usr/lib/libpython3.8.so.1.0
      #107 0x00007ffff7cbb420 in PyRun_SimpleFileExFlags () at /usr/lib/libpython3.8.so.1.0
      #108 0x00007ffff7e0faea in Py_RunMain () at /usr/lib/libpython3.8.so.1.0
      #109 0x00007ffff7debc59 in Py_BytesMain () at /usr/lib/libpython3.8.so.1.0
      #110 0x00007ffff7a88152 in __libc_start_main () at /usr/lib/libc.so.6
      #111 0x000055555555504e in _start ()
      

        Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

            Assignee:
            allan.jensen Allan Sandfeld Jensen
            Reporter:
            kovidgoyal Kovid Goyal
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Gerrit Reviews

                There are no open Gerrit changes