Crash #3 seems to be caused when deleting the "extension" widget in QMenuBar. This is a Qt-created widget that is used for showing an overflow menu. The widget has a QKeySequence "shortcut" member in its QAbstractButtonPrivate structure.
Stepping through the code one assembly instruction at a time, I can see that QKeySequence is a shared_empty instance and its reference count is reduced to 0, which causes ~QAbstractButtonPrivate to call delete on it. QKeySequencePrivate shared_empty is a static variable, so this results triggers the crash.
Here's the stack frame that produces the crash. I commented all of WMenuBar::initialize except for creating the File menu and adding it. This is enough to trigger the crash (without creating a menu, the problem does not occur).
Attached screenshot shows the shared_empty's reference count dropped to zero right before QAbstractButtonPrivate calls delete. (this is right after the lock xadd instruction that decremented).
mixxx.exe!QAbstractButtonPrivate::~QAbstractButtonPrivate() C++
mixxx.exe!QToolButtonPrivate::~QToolButtonPrivate() C++
mixxx.exe!QToolButtonPrivate::`scalar deleting destructor'(unsigned int) C++
mixxx.exe!QObject::~QObject() Line 967 C++
mixxx.exe!QWidget::~QWidget() Line 1703 C++
mixxx.exe!QAbstractButton::~QAbstractButton() Line 606 C++
mixxx.exe!QToolButton::`scalar deleting destructor'(unsigned int) C++
mixxx.exe!QObjectPrivate::deleteChildren() Line 1932 C++
mixxx.exe!QWidget::~QWidget() Line 1682 C++
mixxx.exe!QMenuBar::~QMenuBar() Line 857 C++
mixxx.exe!WMainMenuBar::`scalar deleting destructor'(unsigned int) C++
mixxx.exe!QObject::event(QEvent * e=0x11061d68) Line 1258 C++
mixxx.exe!QWidget::event(QEvent * event=0x11061d68) Line 8862 C++
mixxx.exe!QMenuBar::event(QEvent * e=0x11061d68) Line 1608 C++
mixxx.exe!QApplicationPrivate::notify_helper(QObject * receiver=0x004a7718, QEvent * e=0x11061d68) Line 4568 C++
mixxx.exe!QApplication::notify(QObject * receiver=0x004a7718, QEvent * e=0x11061d68) Line 4535 C++
mixxx.exe!MixxxApplication::notify(QObject * target=0x004a7718, QEvent * event=0x11061d68) Line 139 C++
mixxx.exe!QCoreApplication::notifyInternal(QObject * receiver=0x004a7718, QEvent * event=0x11061d68) Line 968 C++
mixxx.exe!QCoreApplicationPrivate::sendPostedEvents(QObject * receiver=0x004a7718, int event_type, QThreadData * data=0x004025f0) Line 1579 C++
mixxx.exe!MixxxMainWindow::finalize() Line 496 C++
mixxx.exe!MixxxMainWindow::closeEvent(QCloseEvent * event=0x0025d470) Line 1204 C++
mixxx.exe!QWidget::event(QEvent * event=0x0025d470) Line 8861 C++
mixxx.exe!QApplicationPrivate::notify_helper(QObject * receiver=0x00480ca0, QEvent * e=0x0025d470) Line 4568 C++
mixxx.exe!QApplication::notify(QObject * receiver=0x00480ca0, QEvent * e=0x0025d470) Line 4535 C++
mixxx.exe!MixxxApplication::notify(QObject * target=0x00480ca0, QEvent * event=0x0025d470) Line 139 C++
mixxx.exe!QCoreApplication::notifyInternal(QObject * receiver=0x00480ca0, QEvent * event=0x0025d470) Line 968 C++
mixxx.exe!QWidgetPrivate::close_helper(QWidgetPrivate::CloseMode mode=CloseWithSpontaneousEvent) Line 7956 C++
mixxx.exe!QtWndProc(HWND__ * hwnd=0x0025076e, unsigned int message=16, unsigned int wParam=0, long lParam=0) Line 2208 C++
user32.dll!_InternalCallWinProc@20
() Unknown
user32.dll!_UserCallWinProcCheckWow@32
() Unknown
user32.dll!_DispatchClientMessage@24
() Unknown
user32.dll!___fnDWORD@4
() Unknown
ntdll.dll!_KiUserCallbackDispatcher@12
() Unknown
user32.dll!_RealDefWindowProcW@16
() Unknown
uxtheme.dll!DoMsgDefault(struct _THEME_MSG const *) Unknown
uxtheme.dll!OnDwpSysCommand(class CThemeWnd *,struct _THEME_MSG *) Unknown
uxtheme.dll!_ThemeDefWindowProc(struct HWND__ *,unsigned int,unsigned int,long,int) Unknown
uxtheme.dll!_ThemeDefWindowProcW@16
() Unknown
user32.dll!_DefWindowProcW@16
() Unknown
mixxx.exe!QWinInputContext::DefWindowProcW(HWND__ * hwnd=0x0025076e, unsigned int msg=0, unsigned int wParam=61536, long lParam=1901649) Line 366 C++
mixxx.exe!QtWndProc(HWND__ * hwnd=0x0025076e, unsigned int message=274, unsigned int wParam=61536, long lParam=1901649) Line 2698 C++
user32.dll!_InternalCallWinProc@20
() Unknown
user32.dll!_UserCallWinProcCheckWow@32
() Unknown
user32.dll!_SendMessageWorker@24
() Unknown
user32.dll!_SendMessageW@16
() Unknown
uxtheme.dll!OnDwpNcLButtonDown(class CThemeWnd *,struct _THEME_MSG *) Unknown
uxtheme.dll!_ThemeDefWindowProc(struct HWND__ *,unsigned int,unsigned int,long,int) Unknown
uxtheme.dll!_ThemeDefWindowProcW@16
() Unknown
user32.dll!_DefWindowProcW@16
() Unknown
mixxx.exe!QWinInputContext::DefWindowProcW(HWND__ * hwnd=0x0025076e, unsigned int msg=1, unsigned int wParam=20, long lParam=1901649) Line 366 C++
mixxx.exe!QtWndProc(HWND__ * hwnd=0x0025076e, unsigned int message=161, unsigned int wParam=20, long lParam=1901649) Line 2698 C++
user32.dll!_InternalCallWinProc@20
() Unknown
user32.dll!_UserCallWinProcCheckWow@32
() Unknown
user32.dll!_DispatchMessageWorker@8
() Unknown
user32.dll!_DispatchMessageW@4
() Unknown
mixxx.exe!QEventDispatcherWin32::processEvents(QFlags<enum QEventLoop::ProcessEventsFlag> flags={...}) Line 830 C++
mixxx.exe!QGuiEventDispatcherWin32::processEvents(QFlags<enum QEventLoop::ProcessEventsFlag> flags={...}) Line 1216 C++
mixxx.exe!QEventLoop::exec(QFlags<enum QEventLoop::ProcessEventsFlag> flags={...}) Line 204 C++
mixxx.exe!QCoreApplication::exec() Line 1229 C++
mixxx.exe!main(int argc=1, char * * argv=0x003f30c8) Line 116 C++
mixxx.exe!__scrt_common_main_seh() Line 253 C++
kernel32.dll!@BaseThreadInitThunk@12
() Unknown
ntdll.dll!___RtlUserThreadStart@8
() Unknown
ntdll.dll!__RtlUserThreadStart@8
() Unknown
Crash #3 seems to be caused when deleting the "extension" widget in QMenuBar. This is a Qt-created widget that is used for showing an overflow menu. The widget has a QKeySequence "shortcut" member in its QAbstractButton Private structure.
Stepping through the code one assembly instruction at a time, I can see that QKeySequence is a shared_empty instance and its reference count is reduced to 0, which causes ~QAbstractButto nPrivate to call delete on it. QKeySequencePrivate shared_empty is a static variable, so this results triggers the crash.
Here's the stack frame that produces the crash. I commented all of WMenuBar: :initialize except for creating the File menu and adding it. This is enough to trigger the crash (without creating a menu, the problem does not occur).
Attached screenshot shows the shared_empty's reference count dropped to zero right before QAbstractButton Private calls delete. (this is right after the lock xadd instruction that decremented).
mixxx. exe!QAbstractBu ttonPrivate: :~QAbstractButt onPrivate( ) C++ exe!QToolButton Private: :~QToolButtonPr ivate() C++ exe!QToolButton Private: :`scalar deleting destructor' (unsigned int) C++ exe!QObject: :~QObject( ) Line 967 C++ exe!QWidget: :~QWidget( ) Line 1703 C++ exe!QAbstractBu tton::~ QAbstractButton () Line 606 C++ exe!QToolButton ::`scalar deleting destructor' (unsigned int) C++ exe!QObjectPriv ate::deleteChil dren() Line 1932 C++ exe!QWidget: :~QWidget( ) Line 1682 C++ exe!QMenuBar: :~QMenuBar( ) Line 857 C++ exe!WMainMenuBa r::`scalar deleting destructor' (unsigned int) C++ exe!QObject: :event( QEvent * e=0x11061d68) Line 1258 C++ exe!QWidget: :event( QEvent * event=0x11061d68) Line 8862 C++ exe!QMenuBar: :event( QEvent * e=0x11061d68) Line 1608 C++ exe!QApplicatio nPrivate: :notify_ helper( QObject * receiver= 0x004a7718, QEvent * e=0x11061d68) Line 4568 C++ exe!QApplicatio n::notify( QObject * receiver= 0x004a7718, QEvent * e=0x11061d68) Line 4535 C++ exe!MixxxApplic ation:: notify( QObject * target=0x004a7718, QEvent * event=0x11061d68) Line 139 C++ exe!QCoreApplic ation:: notifyInternal( QObject * receiver= 0x004a7718, QEvent * event=0x11061d68) Line 968 C++ exe!QCoreApplic ationPrivate: :sendPostedEven ts(QObject * receiver= 0x004a7718, int event_type, QThreadData * data=0x004025f0) Line 1579 C++ exe!MixxxMainWi ndow::finalize( ) Line 496 C++ exe!MixxxMainWi ndow::closeEven t(QCloseEvent * event=0x0025d470) Line 1204 C++ exe!QWidget: :event( QEvent * event=0x0025d470) Line 8861 C++ exe!QApplicatio nPrivate: :notify_ helper( QObject * receiver= 0x00480ca0, QEvent * e=0x0025d470) Line 4568 C++ exe!QApplicatio n::notify( QObject * receiver= 0x00480ca0, QEvent * e=0x0025d470) Line 4535 C++ exe!MixxxApplic ation:: notify( QObject * target=0x00480ca0, QEvent * event=0x0025d470) Line 139 C++ exe!QCoreApplic ation:: notifyInternal( QObject * receiver= 0x00480ca0, QEvent * event=0x0025d470) Line 968 C++ exe!QWidgetPriv ate::close_ helper( QWidgetPrivate: :CloseMode mode=CloseWithS pontaneousEvent ) Line 7956 C++ exe!QtWndProc( HWND__ * hwnd=0x0025076e, unsigned int message=16, unsigned int wParam=0, long lParam=0) Line 2208 C++ dll!_InternalCa llWinProc@ 20 dll!_UserCallWi nProcCheckWow@ 32 dll!_DispatchCl ientMessage@ 24 dll!___ fnDWORD@ 4 dll!_KiUserCall backDispatcher@ 12 dll!_RealDefWin dowProcW@ 16 dll!DoMsgDefaul t(struct _THEME_MSG const *) Unknown dll!OnDwpSysCom mand(class CThemeWnd *,struct _THEME_MSG *) Unknown dll!_ThemeDefWi ndowProc( struct HWND__ *,unsigned int,unsigned int,long,int) Unknown dll!_ThemeDefWi ndowProcW@ 16 dll!_DefWindowP rocW@16 exe!QWinInputCo ntext:: DefWindowProcW( HWND__ * hwnd=0x0025076e, unsigned int msg=0, unsigned int wParam=61536, long lParam=1901649) Line 366 C++ exe!QtWndProc( HWND__ * hwnd=0x0025076e, unsigned int message=274, unsigned int wParam=61536, long lParam=1901649) Line 2698 C++ dll!_InternalCa llWinProc@ 20 dll!_UserCallWi nProcCheckWow@ 32 dll!_SendMessag eWorker@ 24 dll!_SendMessag eW@16 dll!OnDwpNcLBut tonDown( class CThemeWnd *,struct _THEME_MSG *) Unknown dll!_ThemeDefWi ndowProc( struct HWND__ *,unsigned int,unsigned int,long,int) Unknown dll!_ThemeDefWi ndowProcW@ 16 dll!_DefWindowP rocW@16 exe!QWinInputCo ntext:: DefWindowProcW( HWND__ * hwnd=0x0025076e, unsigned int msg=1, unsigned int wParam=20, long lParam=1901649) Line 366 C++ exe!QtWndProc( HWND__ * hwnd=0x0025076e, unsigned int message=161, unsigned int wParam=20, long lParam=1901649) Line 2698 C++ dll!_InternalCa llWinProc@ 20 dll!_UserCallWi nProcCheckWow@ 32 dll!_DispatchMe ssageWorker@ 8 dll!_DispatchMe ssageW@ 4 exe!QEventDispa tcherWin32: :processEvents( QFlags< enum QEventLoop: :ProcessEventsF lag> flags={...}) Line 830 C++ exe!QGuiEventDi spatcherWin32: :processEvents( QFlags< enum QEventLoop: :ProcessEventsF lag> flags={...}) Line 1216 C++ exe!QEventLoop: :exec(QFlags< enum QEventLoop: :ProcessEventsF lag> flags={...}) Line 204 C++ exe!QCoreApplic ation:: exec() Line 1229 C++ exe!main( int argc=1, char * * argv=0x003f30c8) Line 116 C++ exe!__scrt_ common_ main_seh( ) Line 253 C++ dll!@BaseThread InitThunk@ 12 dll!___ RtlUserThreadSt art@8 dll!__RtlUserTh readStart@ 8
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
user32.
() Unknown
user32.
() Unknown
user32.
() Unknown
user32.
() Unknown
ntdll.
() Unknown
user32.
() Unknown
uxtheme.
uxtheme.
uxtheme.
uxtheme.
() Unknown
user32.
() Unknown
mixxx.
mixxx.
user32.
() Unknown
user32.
() Unknown
user32.
() Unknown
user32.
() Unknown
uxtheme.
uxtheme.
uxtheme.
() Unknown
user32.
() Unknown
mixxx.
mixxx.
user32.
() Unknown
user32.
() Unknown
user32.
() Unknown
user32.
() Unknown
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
mixxx.
kernel32.
() Unknown
ntdll.
() Unknown
ntdll.
() Unknown