Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-87320

Segfault in qimage_conversions.cpp

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P1: Critical
    • 5.15.2, 6.0
    • 5.15.1
    • Image formats
    • None
    • Linux/X11 Arch
    • Linux/X11
    • 0aa8925f1acd47cadc71483cac97d202444d15db (qt/qtbase/dev) b89d68f8610fa74c90905ffde4e1479ac78ddf45 (qt/qtbase/5.15)

    Description

      I am experiencing a segfault in qimage_conversions.cpp. The full backtrace is below. The cause is that when doing parallel image format conversions, the code does not check is QThreadPool::gloablInstance() is NULL. For reasons not clear to me, it is NULL when running inside a docker container. For full context, see https://github.com/kovidgoyal/calibre/commit/28ef780d9911d598314d98bdfc3b1c88a94681df

       

      The fix is simply to check if threadPoll == NULL at lines 296 and 241 in qimage_conversions.cpp

       

      #0  QThreadPool::contains(QThread const*) const (this=this@entry=0x0, thread=0x555555d5c6e0) at thread/qthreadpool.cpp:787
        d = <optimized out>
        poolThread = <optimized out>
#1  0x00007ffff1487500 in convert_generic(QImageData*, QImageData const*, QFlags<Qt::ImageConversionFlag>) (dest=<optimized out>, src=0x5555571779c0, flags=..., 
    flags@entry=...) at image/qimage_conversions.cpp:240
        destLayout = 0x7ffff19aa580 <qPixelLayouts+384>
        fetch = <optimized out>
        store = <optimized out>
        convertSegment = 
    {__src = 0x5555571779c0, __dest = 0x555556cfbbc0, __flags = {i = 0}, __destLayout = 0x7ffff19aa580 <qPixelLayouts+384>, __fetch = 0x7ffff13deb40 <fetchARGB32ToARGB32PM_sse4(unsigned int*, unsigned char const*, int, int, QVector<unsigned int> const*, QDitherInfo*)>, __store = 0x7ffff1673440 <storePassThrough(uchar*, uint const*, int, int, QVector<unsigned int> const*, QDitherInfo*)>}
        segments = 4
        threadPool = 0x0
        semaphore = 
                {{d = 0x7fff00000020, u = {_q_value = {<std::__atomic_base<unsigned long long>> = {static _S_alignment = 8, _M_i = 140733193388064}, static is_always_lock_free = true}}}}
        y = <optimized out>
#2  0x00007ffff14758dc in QImage::convertToFormat_helper(QImage::Format, QFlags<Qt::ImageConversionFlag>) const
    (this=this@entry=0x7fffffffa690, format=format@entry=QImage::Format_ARGB32_Premultiplied, flags=flags@entry=...) at image/qimage.cpp:2103
        image = 
          {<QPaintDevice> = {_vptr.QPaintDevice = 0x7ffff199d588 <vtable for QImage+16>, painters = 0, reserved = 0x0}, static staticMetaObject = {d = {superdata = {direct = 0x0}, stringdata = 0x7ffff18eabc0 <qt_meta_stringdata_QImage>, data = 0x7ffff18eaa60 <qt_meta_data_QImage>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}, d = 0x555556cfbbc0}
        converter = 0x7ffff1487420 <convert_generic(QImageData*, QImageData const*, QFlags<Qt::ImageConversionFlag>)>
#3  0x00007ffff27d6848 in QImage::convertToFormat(QImage::Format, QFlags<Qt::ImageConversionFlag>) const &
    (flags=..., f=QImage::Format_ARGB32_Premultiplied, this=0x7fffffffa690) at /usr/include/qt/QtGui/qimage.h:184
        PyGILRelease = {thread_state = 0x55555557e820}
        img = 
          {<QPaintDevice> = {_vptr.QPaintDevice = 0x7ffff199d588 <vtable for QImage+16>, painters = 0, reserved = 0x0}, static staticMetaObject = {d = {superdata = {direct = 0x0}, stringdata = 0x7ffff18eabc0 <qt_meta_stringdata_QImage>, data = 0x7ffff18eaa60 <qt_meta_data_QImage>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}, d = 0x5555571779c0}
        cw = <optimized out>
        ch = <optimized out>
        iw = <optimized out>
        ih = <optimized out>
        r = <optimized out>
        c = <optimized out>
        right = 256
        bottom = <optimized out>
        height = 256
        width = 256
        s = <optimized out>
        src = <optimized out>
        dest = <optimized out>
#4  overlay(QImage const&, QImage&, unsigned int, unsigned int) (image=..., canvas=..., left=0, top=0) at ../../../../../src/calibre/utils/imageops/imageops.cpp:610
        PyGILRelease = {thread_state = 0x55555557e820}
        img = 
          {<QPaintDevice> = {_vptr.QPaintDevice = 0x7ffff199d588 <vtable for QImage+16>, painters = 0, reserved = 0x0}, static staticMetaObject = {d = {superdata = {direct = 0x0}, stringdata = 0x7ffff18eabc0 <qt_meta_stringdata_QImage>, data = 0x7ffff18eaa60 <qt_meta_data_QImage>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}, d = 0x5555571779c0}
        cw = <optimized out>
        ch = <optimized out>
        iw = <optimized out>
        ih = <optimized out>
        r = <optimized out>
        c = <optimized out>
        right = 256
        bottom = <optimized out>
        height = 256
        width = 256
        s = <optimized out>
        src = <optimized out>
        dest = <optimized out>
#5  0x00007ffff27d4dd5 in func_overlay(PyObject*, PyObject*) (sipArgs=<optimized out>) at /usr/src/debug/calibre/build/pyqt/imageops/imageops.sip:59
        a0 = 0x555556cfb8c0
        a1 = 0x5555570a1e10
        a2 = 0
        a3 = 0
        sipParseErr = 0x0
#6  0x00007ffff7d5e1ea in PyCFunction_Call () at /usr/lib/libpython3.8.so.1.0
#7  0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
#8  0x00007ffff7d4c458 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#9  0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#10 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#11 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#12 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#13 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#14 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#15 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#16 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#17 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#18 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#19 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#20 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#21 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#22 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
#23 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
#24 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#25 0x00007ffff7d46762 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#26 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#27 0x00007ffff7d4c025 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#28 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#29 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#30 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#31 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#32 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#33 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#34 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#35 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#36 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
#37 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
#38 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#39 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#40 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
#41 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
#42 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
#43 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
#44 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#45 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#46 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#47 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
#48 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
#49 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#50 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#51 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
#52 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
#53 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
#54 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
#55 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#56 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#57 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#58 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
#59 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
#60 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#61 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#62 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
#63 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
#64 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
#65 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
#66 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#67 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#68 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#69 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
#70 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
#71 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#72 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#73 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
#74 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
#75 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
#76 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
#77 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#78 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#79 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#80 0x00007ffff7d67b3c in  () at /usr/lib/libpython3.8.so.1.0
#81 0x00007ffff7d6b2c2 in PyObject_Call () at /usr/lib/libpython3.8.so.1.0
#82 0x00007ffff7d49838 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#83 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#84 0x00007ffff7d5021e in _PyObject_FastCallDict () at /usr/lib/libpython3.8.so.1.0
#85 0x00007ffff7d63143 in _PyObject_Call_Prepend () at /usr/lib/libpython3.8.so.1.0
#86 0x00007ffff7e20a39 in  () at /usr/lib/libpython3.8.so.1.0
#87 0x00007ffff7d50b84 in _PyObject_MakeTpCall () at /usr/lib/libpython3.8.so.1.0
#88 0x00007ffff7d4bf54 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#89 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#90 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#91 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#92 0x00007ffff7d581cd in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#93 0x00007ffff7d484d9 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#94 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#95 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#96 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#97 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#98 0x00007ffff7d58138 in _PyFunction_Vectorcall () at /usr/lib/libpython3.8.so.1.0
#99 0x00007ffff7d47ac1 in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#100 0x00007ffff7df81cd in  () at /usr/lib/libpython3.8.so.1.0
#101 0x00007ffff7d476fd in _PyEval_EvalFrameDefault () at /usr/lib/libpython3.8.so.1.0
#102 0x00007ffff7d46044 in _PyEval_EvalCodeWithName () at /usr/lib/libpython3.8.so.1.0
#103 0x00007ffff7df73a3 in PyEval_EvalCode () at /usr/lib/libpython3.8.so.1.0
#104 0x00007ffff7e02c18 in  () at /usr/lib/libpython3.8.so.1.0
#105 0x00007ffff7dfce33 in  () at /usr/lib/libpython3.8.so.1.0
#106 0x00007ffff7cbb9a9 in PyRun_FileExFlags () at /usr/lib/libpython3.8.so.1.0
#107 0x00007ffff7cbb420 in PyRun_SimpleFileExFlags () at /usr/lib/libpython3.8.so.1.0
#108 0x00007ffff7e0faea in Py_RunMain () at /usr/lib/libpython3.8.so.1.0
#109 0x00007ffff7debc59 in Py_BytesMain () at /usr/lib/libpython3.8.so.1.0
#110 0x00007ffff7a88152 in __libc_start_main () at /usr/lib/libc.so.6
#111 0x000055555555504e in _start ()

      Attachments

        For Gerrit Dashboard: QTBUG-87320
        # Subject Branch Project Status CR V
        316993,2 Protect QImage work on shutdown dev qt/qtbase Status: MERGED +2 0
        317074,3 Protect QImage work on shutdown 5.15 qt/qtbase Status: MERGED +2 0

        Activity

          People

            allan.jensen Allan Sandfeld Jensen
            kovidgoyal Kovid Goyal
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes