View Issue Details

IDProjectCategoryView StatusLast Update
0006990ScribusStory Editor / Text Framespublic2008-05-19 19:11
Reporterflorian Assigned Tojghali  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionno change required 
PlatformIntel 32-bitOSLinuxOS VersionopenSuSE 10.3
Product Version1.3.5svn 
Summary0006990: crash when editing text frame
DescriptionScribus crashes after pressing the return key
Steps To Reproduce1) Launch Scribus, create a new document or open an existing one
2) Create a text frame
3) Edit contents of frame (key "E")
4) Type "foo" and press return
Additional InformationCommand line output:

scribus-1.3.5svn: /usr/src/scribus_cvs/Scribus/scribus/text/storytext.cpp:476: c
onst ParagraphStyle& StoryText::paragraphStyle(int) const: Zusicherung »pos <= l
ength()« nicht erfüllt.
Scribus Crash
-------------
Scribus crashes due to Signal 0000006
QPaintEngine::setSystemClip: Should not be changed while engine is active
QPaintEngine::setSystemClip: Should not be changed while engine is active
QWidgetPrivate::beginSharedPainter: Painter is already active
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPaintEngine::setSystemClip: Should not be changed while engine is active
QPaintEngine::setSystemClip: Should not be changed while engine is active
Calling Emergency Save
TagsNo tags attached.
Patch

Activities

jghali

2008-05-01 16:10

administrator   ~0019587

Cannot reproduce on Windows with current build.

cbradney

2008-05-03 21:44

administrator   ~0019604

Unable to reproduce on Linux

florian

2008-05-05 08:52

reporter   ~0019613

gdb backtrace output is:

$ gdb /usr/local/scribus_svn/bin/scribus-1.3.5svn
GNU gdb 6.6.50.20070726-cvs
Copyright (C) 2007 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-suse-linux"...
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) run
Starting program: /usr/local/scribus_svn/bin/scribus-1.3.5svn
[Thread debugging using libthread_db enabled]
[New Thread 0xb6a6c6d0 (LWP 11316)]
[New Thread 0xb562fb90 (LWP 11319)]
[New Thread 0xb4db3b90 (LWP 11325)]
[New Thread 0xb45b2b90 (LWP 11326)]
[Thread 0xb4db3b90 (LWP 11325) exited]
[Thread 0xb45b2b90 (LWP 11326) exited]
scribus-1.3.5svn: /usr/src/scribus_cvs/Scribus/scribus/text/storytext.cpp:476: const ParagraphStyle& StoryText::paragraphStyle(int) const: Zusicherung »pos <= length()« nicht erfüllt.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb6a6c6d0 (LWP 11316)]
0xffffe410 in __kernel_vsyscall ()
(gdb) bt
#0 0xffffe410 in __kernel_vsyscall ()
0000001 0xb6c878f5 in raise () from /lib/libc.so.6
0000002 0xb6c891e1 in abort () from /lib/libc.so.6
0000003 0xb6c80c1e in __assert_fail () from /lib/libc.so.6
0000004 0x08abc230 in StoryText::paragraphStyle ()
0000005 0x08abdb9a in StoryText::boundingBox ()
0000006 0x08296127 in LegacyMode::drawTextCursor ()
0000007 0x08296d97 in LegacyMode::drawControls ()
0000008 0x08286cb7 in Canvas::paintEvent ()
0000009 0xb791bfe9 in QWidget::event () from /usr/lib/libQtGui.so.4
0000010 0xb78d001c in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
0000011 0xb78d70f8 in QApplication::notify () from /usr/lib/libQtGui.so.4
0000012 0xb7309e49 in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
0000013 0xb79257be in qt_sendSpontaneousEvent () from /usr/lib/libQtGui.so.4
0000014 0xb791a936 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000015 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000016 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000017 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000018 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000019 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000020 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000021 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000022 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000023 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000024 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000025 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000026 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000027 0xb7a64163 in QWidgetBackingStore::cleanRegion () from /usr/lib/libQtGui.so.4
0000028 0xb7a644d7 in qt_syncBackingStore () from /usr/lib/libQtGui.so.4
0000029 0xb791ba5f in QWidget::event () from /usr/lib/libQtGui.so.4
0000030 0xb7c24cb5 in QMainWindow::event () from /usr/lib/libQtGui.so.4
0000031 0xb78d001c in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
0000032 0xb78d70f8 in QApplication::notify () from /usr/lib/libQtGui.so.4
0000033 0xb7309e49 in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
0000034 0xb730b14d in QCoreApplicationPrivate::sendPostedEvents () from /usr/lib/libQtCore.so.4
0000035 0xb733295a in QEventDispatcherUNIX::processEvents () from /usr/lib/libQtCore.so.4
0000036 0xb7955e31 in QEventDispatcherX11::processEvents () from /usr/lib/libQtGui.so.4
---Type <return> to continue, or q <return> to quit---
0000037 0xb73090dd in QEventLoop::processEvents () from /usr/lib/libQtCore.so.4
0000038 0xb7309271 in QEventLoop::exec () from /usr/lib/libQtCore.so.4
0000039 0xb730b3ba in QCoreApplication::exec () from /usr/lib/libQtCore.so.4
0000040 0xb78cf717 in QApplication::exec () from /usr/lib/libQtGui.so.4
0000041 0x08aabac2 in mainApp ()
0000042 0x08aabb12 in main ()
(gdb) continue
Continuing.
Scribus ist abgest?rzt
-------------
Absturz durch Signal 0000006
QPaintEngine::setSystemClip: Should not be changed while engine is active
QPaintEngine::setSystemClip: Should not be changed while engine is active
QWidgetPrivate::beginSharedPainter: Painter is already active
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPainter::begin: A paint device can only be painted by one painter at a time.
QPaintEngine::setSystemClip: Should not be changed while engine is active
QPaintEngine::setSystemClip: Should not be changed while engine is active
Calling Emergency Save

Program received signal SIGSEGV, Segmentation fault.
0x087b85a1 in ScribusMainWindow::emergencySave ()
(gdb) bt
#0 0x087b85a1 in ScribusMainWindow::emergencySave ()
0000001 0x08aabe5b in defaultCrashHandler ()
0000002 <signal handler called>
0000003 0xffffe410 in __kernel_vsyscall ()
0000004 0xb6c878f5 in raise () from /lib/libc.so.6
0000005 0xb6c891e1 in abort () from /lib/libc.so.6
0000006 0xb6c80c1e in __assert_fail () from /lib/libc.so.6
0000007 0x08abc230 in StoryText::paragraphStyle ()
0000008 0x08abdb9a in StoryText::boundingBox ()
0000009 0x08296127 in LegacyMode::drawTextCursor ()
0000010 0x08296d97 in LegacyMode::drawControls ()
0000011 0x08286cb7 in Canvas::paintEvent ()
0000012 0xb791bfe9 in QWidget::event () from /usr/lib/libQtGui.so.4
0000013 0xb78d001c in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
0000014 0xb78d70f8 in QApplication::notify () from /usr/lib/libQtGui.so.4
0000015 0xb7309e49 in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
0000016 0xb79257be in qt_sendSpontaneousEvent () from /usr/lib/libQtGui.so.4
0000017 0xb791a936 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000018 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000019 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000020 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000021 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000022 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000023 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000024 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000025 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000026 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000027 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000028 0xb791b0ce in QWidgetPrivate::paintSiblingsRecursive () from /usr/lib/libQtGui.so.4
0000029 0xb791a5f7 in QWidgetPrivate::drawWidget () from /usr/lib/libQtGui.so.4
0000030 0xb7a64163 in QWidgetBackingStore::cleanRegion () from /usr/lib/libQtGui.so.4
0000031 0xb7a644d7 in qt_syncBackingStore () from /usr/lib/libQtGui.so.4
0000032 0xb791ba5f in QWidget::event () from /usr/lib/libQtGui.so.4
0000033 0xb7c24cb5 in QMainWindow::event () from /usr/lib/libQtGui.so.4
0000034 0xb78d001c in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
0000035 0xb78d70f8 in QApplication::notify () from /usr/lib/libQtGui.so.4
0000036 0xb7309e49 in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
---Type <return> to continue, or q <return> to quit---
0000037 0xb730b14d in QCoreApplicationPrivate::sendPostedEvents () from /usr/lib/libQtCore.so.4
0000038 0xb733295a in QEventDispatcherUNIX::processEvents () from /usr/lib/libQtCore.so.4
0000039 0xb7955e31 in QEventDispatcherX11::processEvents () from /usr/lib/libQtGui.so.4
0000040 0xb73090dd in QEventLoop::processEvents () from /usr/lib/libQtCore.so.4
0000041 0xb7309271 in QEventLoop::exec () from /usr/lib/libQtCore.so.4
0000042 0xb730b3ba in QCoreApplication::exec () from /usr/lib/libQtCore.so.4
0000043 0xb78cf717 in QApplication::exec () from /usr/lib/libQtGui.so.4
0000044 0x08aabac2 in mainApp ()
0000045 0x08aabb12 in main ()
(gdb) continue
Continuing.
[Thread 0xb562fb90 (LWP 11319) exited]

Program exited with code 0377.
(gdb) quit


How comes that I don't see any output from qDebug calls?

florian

2008-05-05 18:25

reporter   ~0019616

I managed to track down the error to an out-of-range parameter in StoryText::paragraphStyle. But then I recompiled Scribus to enable debugging symbols in the executable (_now_ I know that they were enabled before!) and the error went away. Unable to reproduce it now. (Same source files... sometimes computers are just weird.)

Same with error 0006998.

May be closed as not reproducible. Sorry.

cbradney

2008-05-05 19:10

administrator   ~0019618

can you please try it again without debugging? it might be an uninitialised pointer being hidden by the debugger setting all variables to 0, or you might have to rerun and rerun to get it to happen.

2008-05-07 08:38

 

kdbg.png (178,543 bytes)   
kdbg.png (178,543 bytes)   

florian

2008-05-07 08:42

reporter   ~0019620

Compiled again with compiler settings "-O2 -g3". Bug reproduced, cf. attached screenshot (kdbg.png). The screenshot was taken when the conditional breakpoint ("pos > this->length()") was hit the first (and only) time.

jghali

2008-05-07 09:28

administrator   ~0019621

Cannot reproduce on Windows either in debug mode or in release mode. I know by experience that compiler options such as -O2 and -O3 trigger sometime compiler bugs. Could you try replacing -O2 by -O1 or -Os and see if the bug is still reproductible?

florian

2008-05-08 07:37

reporter   ~0019627

Sometimes the compiler produces buggy executables, sometimes executables without bug... seems randomly to me.

"c++ --version" says:
c++ (GCC) 4.2.1 (SUSE Linux)


I continued debugging with kdbg/gdb (compilation parameters now: "-O1 -g3"). Bug is near "canvasmode_legacy.cpp" line 157. There is a call to StoryText::boundingBox with the parameter "pos". When I type "foo<return>", a breakpoint at canvasmode_legacy.cpp:157 is hit.
At this position, values are:
  textframe->CPos = 4
  textframe->itemText.length() = 4
I would expect that
  qMax(0,qMin(textframe->CPos, textframe->itemText.length())) is 4
but inside textframe->itemText.boundingBox, the parameter "pos" is something strangely out of range (it might make sense if casted to a pointer).

When disassembling canvasmode_legacy.cpp, void LegacyMode::drawTextCursor(QPainter *p, PageItem_TextFrame* textframe), there is something in the code which I consider a bug in the C compiler. The comparison "textframe->itemText.text(textframe->itemText.length()-1) != SpecialChars::PARSEP)" is translated to assembler code
  ...
  <_ZN10LegacyMode14drawTextCursorEP8QPainterP18PageItem_TextFrame+241>: cmp 0x8d25ca0,%ax
  <_ZN10LegacyMode14drawTextCursorEP8QPainterP18PageItem_TextFrame+248>: je 0x829808e <_ZN10LegacyMode14drawTextCursorEP8QPainterP18PageItem_TextFrame+1470>
while the cmp line should read "cmp 0x000d,%ax" correctly. (How can you compare a 32-bit value and a 16-bit register??) 0x8d25ca0 is a _pointer_ to <_ZN12SpecialChars6PARSEPE>.

The C compiler might have a problem with the inline function declarations in QtCore/qchar.h (RPM version: libqt4-devel-4.3.95+20080424-2.1).

What do you think about modifying the source a little so that the compiler won't run into this bug?

florian

2008-05-08 08:50

reporter   ~0019628

Please try

  gcc -o canvasmode_legacy.o -O1 -g3 -c --save-temps canvasmode_legacy.ii && mv canvasmode_legacy.s canvasmode_legacy.ii.O1.s
  gcc -o canvasmode_legacy.o -O0 -g3 -c --save-temps canvasmode_legacy.ii && mv canvasmode_legacy.s canvasmode_legacy.ii.O0.s

and compare canvasmode_legacy.ii.O0.s to canvasmode_legacy.ii.O1.s. You will find the pointer "_ZN12SpecialChars6PARSEPE" in both files.

In the O1 file it reads

        ...
        movzwl -130(%ebp), %eax
        cmpw _ZN12SpecialChars6PARSEPE, %ax
        je .L416
        ...

which CASTS a pointer <SpecialChars::PARSEP> to a ushort (WRONG!) and compares it to textframe->itemText.text(textframe->itemText.length()-1).ucs.
In the O0 file it reads

        ...
        movzwl _ZN12SpecialChars6PARSEPE, %eax
        movw %ax, 4(%esp)
        movzwl -78(%ebp), %eax
        movw %ax, (%esp)
        call _Zne5QCharS_
        testb %al, %al
        je .L3068
        ...

which DEREFERENCES a pointer <SpecialChars::PARSEP> as a ushort* (correct!) and compares it to textframe->itemText.text(textframe->itemText.length()-1).ucs.

2008-05-08 08:52

 

canvasmode_legacy.ii.zip (413,569 bytes)

jghali

2008-05-08 10:07

administrator   ~0019632

That's weird stuff as :
1) textframe->itemText.text(textframe->itemText.length()-1) returns a QChar
2) SpecialChars::PARSEP is a QChar
3) Qt defines bool operator!= ( QChar c1, QChar c2 )

jghali

2008-05-08 10:18

administrator   ~0019633

As you can easily reproduce that issue and seem to have some knowledge about coding, i think you are in the best place to produce a patch to work around that issue and test it yourself.

florian

2008-05-08 11:36

reporter   ~0019635

Just a dirty workaround ... well, it does work for me and it should not break the source for anybody else. But I fear that similar problems occur somewhere else in the code. Dou you have any idea whether we should search further in the Qt code, in the Scribus code or for a bug in the compiler?

$ svn diff
Index: scribus/canvasmode_legacy.cpp
===================================================================
--- scribus/canvasmode_legacy.cpp (Revision 12045)
+++ scribus/canvasmode_legacy.cpp (Arbeitskopie)
@@ -142,7 +142,7 @@
                y1 = static_cast<int>(textframe->itemText.defaultStyle().charStyle().fontSize() / 10);
        }
        else if ( textframe->CPos > textframe->itemText.endOfItem(textframe->lastInFrame())
- || (textframe->CPos >= textframe->itemText.length() && textframe->itemText.text(textframe->itemText.length()-1) != SpecialChars::PARSEP) )
+ || (textframe->CPos >= textframe->itemText.length() && (QChar) textframe->itemText.text(textframe->itemText.length()-1) != (QChar) SpecialChars::PARSEP) )
        {
                FRect bbox = textframe->itemText.boundingBox(qMax(0,qMin(textframe->lastInFrame(), textframe->itemText.length()-1)));
                x = static_cast<int>(bbox.x() + textframe->itemText.item(qMax(0,qMin(textframe->lastInFrame(), textframe->itemText.length()-1)))->glyph.wide());
@@ -154,7 +154,7 @@
        }
        else
        {
- FRect bbox = textframe->itemText.boundingBox(qMax(0,qMin(textframe->CPos, textframe->itemText.length())));
+ FRect bbox = textframe->itemText.boundingBox((int) qMax((int) 0,(int) qMin((int) textframe->CPos, (int) textframe->itemText.length())));
                x = static_cast<int>(bbox.x());
                y = static_cast<int>(bbox.y());
                if (bbox.height() <= 2)

jghali

2008-05-08 12:11

administrator   ~0019638

In this case it seems that this issue is really a compiler issue and not a Scribus bug as other compilers such as msvc compiler and other gcc versions (for eg. 4.0.1) produce correct code. And in this case, there's no reason the compiler would do something wrong as the necessary operators are well defined. I gonna see with other team members if later gcc versions are ok.

jghali

2008-05-08 12:24

administrator   ~0019639

gcc 4.1.2 seems to work ok too

florian

2008-05-08 16:51

reporter   ~0019641

g++ (GCC) 4.2.3 20071030 (prerelease) (SUSE Linux) is broken here

florian

2008-05-09 15:58

reporter   ~0019650

works ok with g++ (SUSE Linux) 4.3.1 20080425 (prerelease) [gcc-4_3-branch revision 134659]

jghali

2008-05-11 10:17

administrator   ~0019655

Closing as no change required as this is obviously a compiler issue, with a prerelease gcc version moreover

plinnell

2008-05-19 19:11

viewer   ~0019691

Submitted: https://bugzilla.novell.com/show_bug.cgi?id=392251

Issue History

Date Modified Username Field Change
2008-05-01 16:06 florian New Issue
2008-05-01 16:10 jghali Note Added: 0019587
2008-05-03 21:44 cbradney Note Added: 0019604
2008-05-05 08:52 florian Note Added: 0019613
2008-05-05 18:25 florian Note Added: 0019616
2008-05-05 19:10 cbradney Note Added: 0019618
2008-05-07 08:38 florian File Added: kdbg.png
2008-05-07 08:42 florian Note Added: 0019620
2008-05-07 09:28 jghali Note Added: 0019621
2008-05-08 07:37 florian Note Added: 0019627
2008-05-08 08:50 florian Note Added: 0019628
2008-05-08 08:52 florian File Added: canvasmode_legacy.ii.zip
2008-05-08 10:07 jghali Note Added: 0019632
2008-05-08 10:18 jghali Note Added: 0019633
2008-05-08 11:36 florian Note Added: 0019635
2008-05-08 12:11 jghali Note Added: 0019638
2008-05-08 12:24 jghali Note Added: 0019639
2008-05-08 16:51 florian Note Added: 0019641
2008-05-09 15:58 florian Note Added: 0019650
2008-05-11 10:17 jghali Status new => resolved
2008-05-11 10:17 jghali Resolution open => no change required
2008-05-11 10:17 jghali Assigned To => jghali
2008-05-11 10:17 jghali Note Added: 0019655
2008-05-11 10:17 jghali Status resolved => closed
2008-05-19 19:11 plinnell Note Added: 0019691
2015-09-17 20:08 Kunda Category Story Editor / Text Frames => Story Ed/Txt Frames
2015-09-17 20:12 Kunda Category Story Ed/Txt Frames => Story Editor / Text Frames