I have a number of torrents which did not have their diskspace pre allocated, i svn up, restart KTorrent, started all torrents manually, and then this crashlog comes out.

Code: Select all

Application: KTorrent (ktorrent), signal SIGSEGV
[Thread debugging using libthread_db enabled]
[New Thread 0x7f696217e780 (LWP 15195)]
[New Thread 0x460cc950 (LWP 15220)]
[New Thread 0x458cb950 (LWP 15219)]
[KCrash handler]
#5  0x00007f695f7939ab in ?? () from /usr/lib/libQtGui.so.4
#6  0x00007f695f793a6d in QSortFilterProxyModel::mapFromSource ()
   from /usr/lib/libQtGui.so.4
#7  0x00007f695f78d9b9 in QSortFilterProxyModel::parent ()
   from /usr/lib/libQtGui.so.4
#8  0x00007f695f747045 in QTreeView::indexRowSizeHint ()
   from /usr/lib/libQtGui.so.4
#9  0x00007f695f747775 in ?? () from /usr/lib/libQtGui.so.4
#10 0x00007f695f74cd72 in QTreeView::scrollContentsBy ()
   from /usr/lib/libQtGui.so.4
#11 0x00007f695f67a5f0 in QAbstractScrollArea::qt_metacall ()
   from /usr/lib/libQtGui.so.4
#12 0x00007f695f7126e5 in QAbstractItemView::qt_metacall ()
   from /usr/lib/libQtGui.so.4
#13 0x00007f695f752b45 in QTreeView::qt_metacall ()
   from /usr/lib/libQtGui.so.4
#14 0x00000000004406f5 in kt::View::qt_metacall (this=0x7fff6a2b5ab0,
    _c=4293322212, _id=1781226192, _a=0x2bdf8e0)
    at /home/martijn/svn/ktorrent/build/ktorrent/view.moc:113
#15 0x00007f695e019474 in QMetaObject::activate ()
   from /usr/lib/libQtCore.so.4
#16 0x00007f695f826b4e in QAbstractSlider::valueChanged ()
   from /usr/lib/libQtGui.so.4
#17 0x00007f695f5ae45f in QAbstractSlider::wheelEvent ()
   from /usr/lib/libQtGui.so.4
#18 0x00007f695f2f30f2 in QWidget::event () from /usr/lib/libQtGui.so.4
#19 0x00007f695f2a141d in QApplicationPrivate::notify_helper ()
   from /usr/lib/libQtGui.so.4
#20 0x00007f695f2a9ef2 in QApplication::notify () from /usr/lib/libQtGui.so.4
#21 0x00007f6960a36fab in KApplication::notify () from /usr/lib/libkdeui.so.5
#22 0x00007f695e00511f in QCoreApplication::notifyInternal ()
   from /usr/lib/libQtCore.so.4
#23 0x00007f695f2f30f2 in QWidget::event () from /usr/lib/libQtGui.so.4
#24 0x00007f695f7179cd in QAbstractItemView::viewportEvent ()
   from /usr/lib/libQtGui.so.4
#25 0x00007f695f74c450 in QTreeView::viewportEvent ()
   from /usr/lib/libQtGui.so.4
#26 0x00007f695e0043f8 in QCoreApplicationPrivate::sendThroughObjectEventFilters () from /usr/lib/libQtCore.so.4
#27 0x00007f695f2a13ec in QApplicationPrivate::notify_helper ()
   from /usr/lib/libQtGui.so.4
#28 0x00007f695f2a9ef2 in QApplication::notify () from /usr/lib/libQtGui.so.4
#29 0x00007f6960a36fab in KApplication::notify () from /usr/lib/libkdeui.so.5
#30 0x00007f695e00511f in QCoreApplication::notifyInternal ()
   from /usr/lib/libQtCore.so.4
#31 0x00007f695f2fb602 in ?? () from /usr/lib/libQtGui.so.4
#32 0x00007f695f30d21d in ?? () from /usr/lib/libQtGui.so.4
#33 0x00007f695f30bcbf in QApplication::x11ProcessEvent ()
   from /usr/lib/libQtGui.so.4
#34 0x00007f695f3330a4 in ?? () from /usr/lib/libQtGui.so.4
#35 0x00007f695a987892 in g_main_context_dispatch ()
   from /usr/lib/libglib-2.0.so.0
#36 0x00007f695a98b01d in ?? () from /usr/lib/libglib-2.0.so.0
#37 0x00007f695a98b1db in g_main_context_iteration ()
   from /usr/lib/libglib-2.0.so.0
#38 0x00007f695e02d45f in QEventDispatcherGlib::processEvents ()
   from /usr/lib/libQtCore.so.4
#39 0x00007f695f33286f in ?? () from /usr/lib/libQtGui.so.4
#40 0x00007f695e003a42 in QEventLoop::processEvents ()
   from /usr/lib/libQtCore.so.4
#41 0x00007f695e003bcd in QEventLoop::exec () from /usr/lib/libQtCore.so.4
#42 0x00007f695e00607d in QCoreApplication::exec ()
   from /usr/lib/libQtCore.so.4
#43 0x0000000000425563 in main (argc=5, argv=0x7fff6a2b8c58)
    at /home/martijn/svn/ktorrent/ktorrent/main.cpp:167
#0  0x00007f695d1430e1 in nanosleep () from /lib/libc.so.6



I have also seen this crash a few times. It is pretty random (KTorrent crashes being left unattended) and I have no clue what triggers it.

From the look of it, it is most likely a Qt crash. The crash happens when Qt responds to a mouse wheel event, not much KT code involved.

I think this crash is gone as of Qt 4.4.2/4.4.3

No, apparently it is not.

So example backtrace:

Code: Select all

Application: KTorrent (ktorrent), signal SIGSEGV
[Thread debugging using libthread_db enabled]
[New Thread 0x7f20412a96f0 (LWP 3715)]
[New Thread 0x427e5950 (LWP 3749)]
[New Thread 0x41859950 (LWP 3748)]
[KCrash handler]
#5  QSortFilterProxyModelPrivate::source_to_proxy (this=0x497e760,
    source_index=@0x7fff493e8f80)
    at ../../include/QtCore/../../src/corelib/kernel/qabstractitemmodel.h:358
#6  0x00007f204043b35d in QSortFilterProxyModel::mapFromSource (
    this=<value optimized out>, sourceIndex=@0x7fff493e8f80)
    at itemviews/qsortfilterproxymodel.cpp:2262
#7  0x00007f20404352a9 in QSortFilterProxyModel::parent (this=0x3,
    child=<value optimized out>) at itemviews/qsortfilterproxymodel.cpp:1451
#8  0x00007f20403ee6e5 in QTreeView::indexRowSizeHint (this=0x4972f70,
    index=@0x50c55d0)
    at ../../include/QtCore/../../src/corelib/kernel/qabstractitemmodel.h:358
#9  0x00007f20403eee15 in QTreeViewPrivate::itemHeight (this=0x4973340,
    item=0) at itemviews/qtreeview.cpp:3112
#10 0x00007f20403f301e in QTreeViewPrivate::itemAtCoordinate (this=0x4973340,
    coordinate=298) at itemviews/qtreeview.cpp:3210
#11 0x00007f20403f3525 in QTreeViewPrivate::itemDecorationAt (this=0x4973340,
    pos=@0x7fff493e96f4) at itemviews/qtreeview.cpp:3479
#12 0x00007f20403f394a in QTreeView::viewportEvent (this=0x4972f70,
    event=0x7fff493e96e0) at itemviews/qtreeview.cpp:1248
#13 0x00007f203db43658 in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=<value optimized out>, receiver=0x4973950, event=0x7fff493e96e0)
    at kernel/qcoreapplication.cpp:694
#14 0x00007f203ff48a2c in QApplicationPrivate::notify_helper (this=0x20a4a80,
    receiver=0x4973950, e=0x7fff493e96e0) at kernel/qapplication.cpp:3799
#15 0x00007f203ff513ee in QApplication::notify (this=<value optimized out>,
    receiver=<value optimized out>, e=0x7fff493e9b90)
    at kernel/qapplication.cpp:3553
#16 0x00007f203f9a741b in KApplication::notify (this=0x7fff493ea820,
    receiver=0x4973950, event=0x7fff493e9b90)
    at /build/buildd/kde4libs-4.1.2/kdeui/kernel/kapplication.cpp:311
#17 0x00007f203db44381 in QCoreApplication::notifyInternal (
    this=0x7fff493ea820, receiver=0x4973950, event=0x7fff493e9b90)
    at kernel/qcoreapplication.cpp:587
#18 0x00007f203ff503e8 in QApplicationPrivate::sendMouseEvent (
    receiver=0x4973950, event=0x7fff493e9b90, alienWidget=0x4973950,
    nativeWidget=0x2190f30, buttonDown=<value optimized out>,
    lastMouseReceiver=@0x7f20408ce000)
    at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:212
#19 0x00007f203ffb4909 in QETWidget::translateMouseEvent (this=0x2190f30,
    event=<value optimized out>) at kernel/qapplication_x11.cpp:4042
#20 0x00007f203ffb37ff in QApplication::x11ProcessEvent (this=0x7fff493ea820,
    event=0x7fff493ea450) at kernel/qapplication_x11.cpp:3160
#21 0x00007f203ffdac84 in x11EventSourceDispatch (s=0x20a81f0, callback=0,
    user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:142
#22 0x00007f203b2bc78b in g_main_context_dispatch ()
   from /usr/lib/libglib-2.0.so.0
#23 0x00007f203b2bff5d in ?? () from /usr/lib/libglib-2.0.so.0
#24 0x00007f203b2c011b in g_main_context_iteration ()
   from /usr/lib/libglib-2.0.so.0
#25 0x00007f203db6c70f in QEventDispatcherGlib::processEvents (
    this=0x209bad0, flags=<value optimized out>)
    at kernel/qeventdispatcher_glib.cpp:319
#26 0x00007f203ffda44f in QGuiEventDispatcherGlib::processEvents (
    this=0x7fff493e8f60, flags=<value optimized out>)
    at kernel/qguieventdispatcher_glib.cpp:198
#27 0x00007f203db42ca2 in QEventLoop::processEvents (
    this=<value optimized out>, flags={i = 1228842816})
    at kernel/qeventloop.cpp:143
#28 0x00007f203db42e2d in QEventLoop::exec (this=0x7fff493ea780, flags=
      {i = 1228842896}) at kernel/qeventloop.cpp:194
#29 0x00007f203db452dd in QCoreApplication::exec ()
    at kernel/qcoreapplication.cpp:845
#30 0x0000000000425563 in main (argc=5, argv=0x7fff493eb478)
    at /home/modax/src/ktorrent/ktorrent-trunk/ktorrent/main.cpp:167
#0  0x00007f203c26aff1 in nanosleep () from /lib/libc.so.6


Relevant valgrind memcheck output:

Code: Select all

==22913== Invalid read of size 8
==22913==    at 0x5DDB277: QSortFilterProxyModel::parent(QModelIndex const&) const (qmap.h:140)
==22913==    by 0x5D946E4: QTreeView::indexRowSizeHint(QModelIndex const&) const (qabstractitemmodel.h:358)
==22913==    by 0x5D94E14: QTreeViewPrivate::itemHeight(int) const (qtreeview.cpp:3112)
==22913==    by 0x5D9901D: QTreeViewPrivate::itemAtCoordinate(int) const (qtreeview.cpp:3210)
==22913==    by 0x5D99524: QTreeViewPrivate::itemDecorationAt(QPoint const&) const (qtreeview.cpp:3479)
==22913==    by 0x5D99949: QTreeView::viewportEvent(QEvent*) (qtreeview.cpp:1248)
==22913==    by 0x831B657: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:694)
==22913==    by 0x58EEA2B: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3799)
==22913==    by 0x58F5F0C: QApplicationPrivate::dispatchEnterLeave(QWidget*, QWidget*) (qapplication.cpp:2469)
==22913==    by 0x59597BD: QApplication::x11ProcessEvent(_XEvent*) (qapplication_x11.cpp:3156)
==22913==    by 0x5980C83: _ZL22x11EventSourceDispatchP8_GSourcePFiPvES1_ (qguieventdispatcher_glib.cpp:142)
==22913==    by 0xAAE878A: g_main_context_dispatch (in /mnt/sda2/usr/lib/libglib-2.0.so.0.1600.6)
==22913==    by 0xAAEBF5C: (within /mnt/sda2/usr/lib/libglib-2.0.so.0.1600.6)
==22913==    by 0xAAEC11A: g_main_context_iteration (in /mnt/sda2/usr/lib/libglib-2.0.so.0.1600.6)
==22913==    by 0x834470E: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:319)
==22913==    by 0x598044E: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:198)
==22913==    by 0x831ACA1: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:143)
==22913==    by 0x831AE2C: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:194)
==22913==    by 0x831D2DC: QCoreApplication::exec() (qcoreapplication.cpp:845)
==22913==    by 0x425562: main (main.cpp:167)
==22913==  Address 0x14e6a328 is 40 bytes inside a block of size 48 free'd
==22913==    at 0x4C207FC: operator delete(void*) (vg_replace_malloc.c:342)
==22913==    by 0x5DE08E8: QSortFilterProxyModelPrivate::clear_mapping() (qalgorithms.h:346)
==22913==    by 0x5DE0AF1: QSortFilterProxyModel::invalidate() (qsortfilterproxymodel.cpp:2083)
==22913==    by 0x43CC48: kt::View::update() (view.cpp:160)
==22913==    by 0x444FAF: kt::ViewManager::update() (viewmanager.cpp:247)
==22913==    by 0x4353B6: kt::GUI::update() (gui.cpp:548)
==22913==    by 0x438764: kt::GUI::qt_metacall(QMetaObject::Call, int, void**) (gui.moc:143)
==22913==    by 0x83306D3: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3031)
==22913==    by 0x832AFE2: QObject::event(QEvent*) (qobject.cpp:1120)
==22913==    by 0x58EEA5C: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3803)
==22913==    by 0x58F67D9: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3768)
==22913==    by 0x649241A: KApplication::notify(QObject*, QEvent*) (kapplication.cpp:311)
==22913==    by 0x831C380: QCoreApplication::notifyInternal(QObject*, QEvent*) (qcoreapplication.cpp:587)
==22913==    by 0x8348255: QTimerInfoList::activateTimers() (qcoreapplication.h:209)
==22913==    by 0x83447AC: _ZL19timerSourceDispatchP8_GSourcePFiPvES1_ (qeventdispatcher_glib.cpp:160)
==22913==    by 0xAAE878A: g_main_context_dispatch (in /mnt/sda2/usr/lib/libglib-2.0.so.0.1600.6)
==22913==    by 0xAAEBF5C: (within /mnt/sda2/usr/lib/libglib-2.0.so.0.1600.6)
==22913==    by 0xAAEC11A: g_main_context_iteration (in /mnt/sda2/usr/lib/libglib-2.0.so.0.1600.6)
==22913==    by 0x834470E: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:319)
==22913==    by 0x598044E: QGuiEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qguieventdispatcher_glib.cpp:198)
==22913==    by 0x831ACA1: QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:143)
==22913==    by 0x831AE2C: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:194)
==22913==    by 0x831D2DC: QCoreApplication::exec() (qcoreapplication.cpp:845)
==22913==    by 0x425562: main (main.cpp:167)


So basically either ktorrent is calling proxy_model->invalidate*() at inappropriate time or Qt is buggy (I think the latter). QAbstractItemView only schedules layout changes when proxy_model->invalidate*() is called (i.e. QAbstractItemView recieves layoutChanged signal from the model). QAbstractItemView seems to be enforcing execution of the delayed layout update on the start of many methods but neither QAbstractItemView nor QTreeView do this in viewportEvent() (which leads to this bug). Therefore kt::View ends up in situation where invalid indices are used. Maybe KTorrent could enforce layout update with QAbstractItemView::executeDelayedItemsLayout by reimplementing viewportEvent()?

So this patch should then fix it :

http://ktorrent.org/misc/qt_scroll_crash_fix.patch

Try it out (note patch doesn't contain fix for all QTreeView's just the torrent views, the peer view and the file view)

OK, I have now committed the patch so this should be fixed. I have also reported this to trolltech.

I have not had a crash since applying the patch. I didn't try too hard though since it is very difficult to reproduce. However, I'm pretty confident that my analysis is correct and it should be fixed.