View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0003961ScribusGeneralpublic2006-07-01 22:482006-07-24 21:14
Reporterjo-hannes Assigned Toavox  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Product Version1.3.4cvs 
Fixed in Version1.3.4cvs 
Summary0003961: crash when opening preferences
Descriptionafter doing as described in 3924

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1224177984 (LWP 5048)]
0x08475359 in QMapPrivate<unsigned int, double>::end (this=0x0) at qmap.h:380
380 ConstIterator end() const { return ConstIterator( header ); }
(gdb) bt
#0 0x08475359 in QMapPrivate<unsigned int, double>::end (this=0x0)
    at qmap.h:380
0000001 0x0847538f in QMap<unsigned int, double>::end (this=0x8923864)
    at qmap.h:663
0000002 0x084753b4 in QMap<unsigned int, double>::contains (this=0x8923864,
    k=@0xbfcb1434) at qmap.h:703
0000003 0x084700f3 in Foi::canRender (this=0x8923838, ch=@0xbfcb1792)
    at scfonts.cpp:166
0000004 0x08239099 in DocumentChecker::checkDocument (currDoc=0x8cc0cf8)
    at documentchecker.cpp:284
0000005 0x0861350d in ScribusMainWindow::scanDocument (this=0x877c230)
    at scribus.cpp:8450
0000006 0x086511cf in ScribusMainWindow::newActWin (this=0x877c230, w=0x8d21728)
    at scribus.cpp:2106
0000007 0x08655697 in ScribusMainWindow::closeEvent (this=0x877c230, ce=0xbfcb1bf8)
    at scribus.cpp:1695
0000008 0xb7867b0c in QWidget::event () from /usr/lib/libqt-mt.so.3
0000009 0xb7939762 in QMainWindow::event () from /usr/lib/libqt-mt.so.3
0000010 0xb77c2e56 in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
0000011 0xb77c3bd6 in QApplication::notify () from /usr/lib/libqt-mt.so.3
0000012 0x0833dcb5 in QApplication::sendEvent (receiver=0x877c230,
    event=0xbfcb1bf8) at qapplication.h:520
0000013 0xb7866aa1 in QWidget::close () from /usr/lib/libqt-mt.so.3
---Type <return> to continue, or q <return> to quit---
0000014 0x081edec6 in QWidget::close (this=0x877c230) at qwidget.h:848
0000015 0x08611be0 in ScribusMainWindow::slotFileQuit (this=0x877c230)
    at scribus.cpp:4479
0000016 0x08658406 in ScribusMainWindow::qt_invoke (this=0x877c230, _id=121,
    _o=0xbfcb1d9c) at scribus.moc:973
0000017 0xb782ceb9 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000018 0xb782d954 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000019 0xb7be7886 in QAction::activated () from /usr/lib/libqt-mt.so.3
0000020 0xb7998307 in QAction::internalActivation () from /usr/lib/libqt-mt.so.3
0000021 0xb7be7a22 in QAction::qt_invoke () from /usr/lib/libqt-mt.so.3
0000022 0x084a9c53 in ScrAction::qt_invoke (this=0x8ad35c8, _id=8, _o=0xbfcb1eb8)
    at scraction.moc:229
0000023 0xb782ceb9 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000024 0xb7bc029a in QSignal::signal () from /usr/lib/libqt-mt.so.3
0000025 0xb784a630 in QSignal::activate () from /usr/lib/libqt-mt.so.3
0000026 0xb7951fb1 in QPopupMenu::mouseReleaseEvent () from /usr/lib/libqt-mt.so.3
0000027 0xb786768d in QWidget::event () from /usr/lib/libqt-mt.so.3
0000028 0xb77c2e56 in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
0000029 0xb77c33e0 in QApplication::notify () from /usr/lib/libqt-mt.so.3
0000030 0xb77541c5 in QApplication::sendSpontaneousEvent ()
   from /usr/lib/libqt-mt.so.3
0000031 0xb774f5c0 in QETWidget::translateMouseEvent () from /usr/lib/libqt-mt.so.3
0000032 0xb774dd59 in QApplication::x11ProcessEvent () from /usr/lib/libqt-mt.so.3
---Type <return> to continue, or q <return> to quit---
0000033 0xb77674db in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
0000034 0xb77db947 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
0000035 0xb77db86a in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
0000036 0xb77c1965 in QApplication::exec () from /usr/lib/libqt-mt.so.3
0000037 0x08660e7e in mainApp (argc=1, argv=0xbfcb2a34) at main_nix.cpp:76
0000038 0x08660ec8 in main (argc=1, argv=0xbfcb2a34) at main_nix.cpp:52
TagsNo tags attached.
Patch

Relationships

child of 0003964 closedplinnell 1.3.4 Release Metabug 

Activities

jo-hannes

2006-07-01 22:49

developer   ~0011741

and a second backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1224407360 (LWP 4940)]
0x08475359 in QMapPrivate<unsigned int, double>::end (this=0x0) at qmap.h:380
380 ConstIterator end() const { return ConstIterator( header ); }
(gdb) bt
#0 0x08475359 in QMapPrivate<unsigned int, double>::end (this=0x0)
    at qmap.h:380
0000001 0x0847538f in QMap<unsigned int, double>::end (this=0x8938e0c)
    at qmap.h:663
0000002 0x084753b4 in QMap<unsigned int, double>::contains (this=0x8938e0c,
    k=@0xbfb77ac4) at qmap.h:703
0000003 0x084700f3 in Foi::canRender (this=0x8938de0, ch=@0xbfb77b3e)
    at scfonts.cpp:166
0000004 0x0847a72a in Cwidth (scFace=0x8938de0, ch=@0xbfb78160, Size=120,
    ch2=@0xbfb7815c) at scfontmetrics.cpp:502
0000005 0x0838c97f in PageItem_TextFrame::DrawObj_Item (this=0x8e319b8,
    p=0x8d161f0, e={x1 = 0, y1 = 10, x2 = 328, y2 = 386}, sc=1)
    at pageitem_textframe.cpp:1896
0000006 0x083618fa in PageItem::DrawObj (this=0x8e319b8, p=0x8d161f0, e=
      {x1 = 0, y1 = 10, x2 = 328, y2 = 386}) at pageitem.cpp:748
0000007 0x084ec31f in ScribusView::DrawPageItems (this=0x8d22478,
    painter=0x8d161f0, clip={x1 = 0, y1 = 10, x2 = 328, y2 = 386})
    at scribusview.cpp:831
0000008 0x084f728e in ScribusView::drawContents (this=0x8d22478, psx=0xbfb78c8c,
    clipx=0, clipy=10, clipw=329, cliph=377) at scribusview.cpp:400
0000009 0xb792a7c2 in QScrollView::drawContentsOffset ()
   from /usr/lib/libqt-mt.so.3
0000010 0xb79291ce in QScrollView::viewportPaintEvent ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib/libqt-mt.so.3
0000011 0x084e178f in ScribusView::viewportPaintEvent (this=0x8d22478,
    p=0xbfb79230) at scribusview.cpp:280
0000012 0xb792bfce in QScrollView::eventFilter () from /usr/lib/libqt-mt.so.3
0000013 0xb77f2002 in QObject::activate_filters () from /usr/lib/libqt-mt.so.3
0000014 0xb77f2080 in QObject::event () from /usr/lib/libqt-mt.so.3
0000015 0xb782f5aa in QWidget::event () from /usr/lib/libqt-mt.so.3
0000016 0xb778ae56 in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
0000017 0xb778bbd6 in QApplication::notify () from /usr/lib/libqt-mt.so.3
0000018 0xb771c1c5 in QApplication::sendSpontaneousEvent ()
   from /usr/lib/libqt-mt.so.3
0000019 0xb7710757 in QETWidget::translatePaintEvent () from /usr/lib/libqt-mt.so.3
0000020 0xb7715de3 in QApplication::x11ProcessEvent () from /usr/lib/libqt-mt.so.3
0000021 0xb772f4db in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
0000022 0xb77a3947 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
0000023 0xb7789991 in QApplication::enter_loop () from /usr/lib/libqt-mt.so.3
0000024 0xb79a842c in QDialog::exec () from /usr/lib/libqt-mt.so.3
0000025 0x086578ed in ScribusMainWindow::slotPrefsOrg (this=0x877c230)
    at scribus.cpp:7236
0000026 0x08658dc0 in ScribusMainWindow::qt_invoke (this=0x877c230, _id=198,
    _o=0xbfb7986c) at scribus.moc:1050
0000027 0xb77f4eb9 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000028 0xb77f5954 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
---Type <return> to continue, or q <return> to quit---
0000029 0xb7baf886 in QAction::activated () from /usr/lib/libqt-mt.so.3
0000030 0xb7960307 in QAction::internalActivation () from /usr/lib/libqt-mt.so.3
0000031 0xb7bafa22 in QAction::qt_invoke () from /usr/lib/libqt-mt.so.3
0000032 0x084a9c53 in ScrAction::qt_invoke (this=0x8943600, _id=8, _o=0xbfb79988)
    at scraction.moc:229
0000033 0xb77f4eb9 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
0000034 0xb7b8829a in QSignal::signal () from /usr/lib/libqt-mt.so.3
0000035 0xb7812630 in QSignal::activate () from /usr/lib/libqt-mt.so.3
0000036 0xb7919fb1 in QPopupMenu::mouseReleaseEvent () from /usr/lib/libqt-mt.so.3
0000037 0xb782f68d in QWidget::event () from /usr/lib/libqt-mt.so.3
0000038 0xb778ae56 in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
0000039 0xb778b3e0 in QApplication::notify () from /usr/lib/libqt-mt.so.3
0000040 0xb771c1c5 in QApplication::sendSpontaneousEvent ()
   from /usr/lib/libqt-mt.so.3
0000041 0xb77175c0 in QETWidget::translateMouseEvent () from /usr/lib/libqt-mt.so.3
0000042 0xb7715d59 in QApplication::x11ProcessEvent () from /usr/lib/libqt-mt.so.3
0000043 0xb772f4db in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
0000044 0xb77a3947 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
0000045 0xb77a386a in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
0000046 0xb7789965 in QApplication::exec () from /usr/lib/libqt-mt.so.3
0000047 0x08660e7e in mainApp (argc=1, argv=0xbfb7a504) at main_nix.cpp:76
0000048 0x08660ec8 in main (argc=1, argv=0xbfb7a504) at main_nix.cpp:52

ringerc

2006-07-02 20:23

reporter   ~0011763

This is confusing. How does an access to a non-null QMap end up calling QMapPrivate::end on (*0) ?

line 663 is:
    const_iterator end() const { return ((const Priv*)sh)->end(); }^M


ie "call end() on the private implementation class pointed to by `sh'". The private pointer is _only_ ever assigned a new QMapPrivate, or copied and incref'd in the copy ctor. Given that, the only ways I can see for this crash to happen are:

    - Accessing pointer to a delete'd or never initialized QMap
    - Heap corruption
    - Qt compiled with -fno-exceptions and an out-of-memory causing `new' to return 0 when allocating the QMapPrivate (somewhat unlikely given how small QMapPrivate is).

ringerc

2006-07-02 20:29

reporter   ~0011764

Reminder sent to: subik

Probably related to the prefs cleanup.

mhanski

2006-07-03 18:58

developer   ~0011778

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1224337728 (LWP 29924)]
0x084742c1 in QMapPrivate<unsigned int, double>::end (this=0x0) at qmap.h:380
380 ConstIterator end() const { return ConstIterator( header ); }
(gdb) bt
#0 0x084742c1 in QMapPrivate<unsigned int, double>::end (this=Cannot access memory at address 0xbf8737e4
) at qmap.h:380
Cannot access memory at address 0xbf8737dc
(gdb)

subik

2006-07-12 13:34

manager   ~0011857

cannot replicate after July-10 commits...

subik

2006-07-13 08:24

manager   ~0011867

please, test it...

Issue History

Date Modified Username Field Change
2006-07-01 22:48 jo-hannes New Issue
2006-07-01 22:49 jo-hannes Note Added: 0011741
2006-07-02 20:23 ringerc Note Added: 0011763
2006-07-02 20:29 ringerc Note Added: 0011764
2006-07-02 21:31 avox Status new => assigned
2006-07-02 21:31 avox Assigned To => avox
2006-07-02 21:35 avox Relationship added child of 0003964
2006-07-03 18:58 mhanski Note Added: 0011778
2006-07-12 13:34 subik Note Added: 0011857
2006-07-13 08:24 subik Note Added: 0011867
2006-07-13 08:24 subik Status assigned => feedback
2006-07-23 12:25 avox Status feedback => resolved
2006-07-23 12:25 avox Fixed in Version => 1.3.4cvs
2006-07-23 12:25 avox Resolution open => fixed
2006-07-24 21:14 cbradney Status resolved => closed