Shell crashes when closing apps with Qt 5.1.1

Bug #1222988 reported by Ricardo Salveti
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
qtbase-opensource-src (Ubuntu)
Fix Released
Critical
Unassigned
unity8 (Ubuntu)
Invalid
Critical
Unassigned

Bug Description

Using unity8 from https://launchpad.net/~canonical-qt5-edgers/+archive/qt5-beta-proper together with Qt 5.1.1, which following packages:

unity8 1:7.81.3+13.10.20130905.2 -0+201309091433~302~ubuntu13.10.1
libqt5core5:armhf 5.1.1+dfsg-2ubuntu1~saucy1~test5
libqt5opengl5:armhf 5.1.1+dfsg-2ubuntu1~saucy1~test5

Qt5.1.1 based build:
http://s-jenkins:8080/job/ubuntu-touch-image-saucy-qt51/5/artifact/saucy-preinstalled-phablet-armhf.zip

Steps to reproduce:
1 - Boot the phone
2 - Open an app (e.g. browser)
3 - Get back to the shell
4 - Close the app

Stacktrace:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x4c44d460 (LWP 1575)]
0x00000000 in ?? ()
(gdb) bt full
#0 0x00000000 in ?? ()
No symbol table info available.
#1 0x40ba007c in QMetaObject::cast (this=0x40664c24 <QSGDynamicTexture::staticMetaObject>, obj=0x4f65ab60) at kernel/qmetaobject.cpp:338
        m = <optimized out>
#2 0x40544460 in qobject_cast<QSGDynamicTexture*> (object=<optimized out>) at /usr/include/qt5/QtCore/qobject.h:483
No locals.
#3 QSGDefaultImageNode::preprocess (this=0x4f6696f8) at scenegraph/qsgdefaultimagenode.cpp:353
        doDirty = false
        alpha = <optimized out>
#4 0x405348ce in QSGRenderer::preprocess (this=0x476c2b58) at scenegraph/coreapi/qsgrenderer.cpp:391
        n = 0x4f6696f8
        it = {i = {i = 0x4ed81830}}
        items = {q_hash = {{d = 0x47641f70, e = 0x47641f70}}}
        profileFrames = <optimized out>
#5 0x405341ca in QSGRenderer::renderScene (this=this@entry=0x476c2b58, bindable=...) at scenegraph/coreapi/qsgrenderer.cpp:251
        profileFrames = false
        bindTime = 0
        renderTime = 0
#6 0x405342e8 in QSGRenderer::renderScene (this=this@entry=0x476c2b58) at scenegraph/coreapi/qsgrenderer.cpp:231
        b = warning: RTTI symbol not found for class 'QSGRenderer::renderScene()::B'
{<QSGBindable> = {_vptr.QSGBindable = 0x4065dad8 <vtable for QSGRenderer::renderScene()::B+8>}, <No data fields>}
#7 0x4053ae56 in QSGContext::renderNextFrame (this=<optimized out>, renderer=0x476c2b58, fboId=<optimized out>) at scenegraph/qsgcontext.cpp:313
No locals.
#8 0x4055e52e in QQuickWindowPrivate::renderSceneGraph (this=this@entry=0x228000, size=...) at items/qquickwindow.cpp:336
        _qml_memory_scope = {pushed = false}
        fboId = <optimized out>
        devicePixelRatio = <optimized out>
#9 0x4054bace in QSGRenderThread::syncAndRender (this=this@entry=0x228738) at scenegraph/qsgthreadedrenderloop.cpp:595
        i = 0
        profileFrames = <optimized out>
        syncRequested = <optimized out>
        __PRETTY_FUNCTION__ = "void QSGRenderThread::syncAndRender()"
        waitTimer = {t1 = 333, t2 = 574734734}
        repaintRequested = <optimized out>
#10 0x4054c996 in QSGRenderThread::run (this=0x228738) at scenegraph/qsgthreadedrenderloop.cpp:666
No locals.
#11 0x40a8c86c in QThreadPrivate::start (arg=0x228738) at thread/qthread_unix.cpp:345
        __clframe = {__cancel_routine = 0x40a8bff1 <QThreadPrivate::finish(void*)>, __cancel_arg = 0x228738, __do_it = 1, __cancel_type = <optimized out>}
        thr = 0x228738
        data = <optimized out>
        objectName = {static null = {<No data fields>}, d = 0x40bfee94 <QArrayData::shared_null>}
#12 0x41a30e64 in start_thread (arg=0x4c44d460) at pthread_create.c:313
        pd = 0x4c44d460
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {1279579768, 1279579232, 0, 1279577576, -1095887600, 1084803025, -1095887600, 2263032, 1279577576, 1101205059, 0 <repeats 16 times>, 536870931,
                0 <repeats 37 times>}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#13 0x4115e758 in ?? () at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:96 from /lib/arm-linux-gnueabihf/libc.so.6
No locals.
#14 0x4115e758 in ?? () at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:96 from /lib/arm-linux-gnueabihf/libc.so.6

Tags: qt5.1

CVE References

tags: added: qt5.1
Changed in unity8:
importance: Undecided → Critical
Changed in qtbase-opensource-src (Ubuntu):
importance: Undecided → Critical
Changed in unity8 (Ubuntu):
importance: Undecided → Critical
Revision history for this message
Ricardo Salveti (rsalveti) wrote :

/*!
    \fn QMetaObject *QMetaObject::superClass() const

    Returns the meta-object of the superclass, or 0 if there is no
    such object.

    \sa className()
*/

/*!
    \internal

    Returns \a obj if object \a obj inherits from this
    meta-object; otherwise returns 0.
*/
QObject *QMetaObject::cast(QObject *obj) const
{
    if (obj) {
        const QMetaObject *m = obj->metaObject(); // <<<<<<<<<<<<--------------- crash (line 338)
        do {
            if (m == this)
                return obj;
        } while ((m = m->d.superdata));
    }
    return 0;
}

Revision history for this message
Ricardo Salveti (rsalveti) wrote :

Not sure if a regression on qtbase or qtdeclarative, would be nice to know if this ever worked with a more recent revision besides 5.0.2.

Revision history for this message
Timo Jyrinki (timo-jyrinki) wrote :

As tested with 5.1.0 from https://launchpad.net/~ubuntu-sdk-team/+archive/testing/+packages , it crashes there as well so it's not something introduced between 5.1.0 -> 5.1.1 but instead during Qt 5.1.0 development.

I wonder if some similar workaround for the Unity8 crashes could be done as Günter found for camera-app at bug #1223042?

Revision history for this message
Timo Jyrinki (timo-jyrinki) wrote :

This QTBUG may be related, not exactly same but quite close and a 5.0.2 -> 5.1.0 regression: https://bugreports.qt-project.org/browse/QTBUG-32513

Revision history for this message
Michał Sawicz (saviq) wrote :

The above bug has been fixed, we should try and backport the fix.

Michał Sawicz (saviq)
Changed in unity8:
importance: Critical → Undecided
status: New → Incomplete
Revision history for this message
Michał Sawicz (saviq) wrote :

OK, 5.2 beta is out and we should switch to it ASAP, so let's reevaluate this when we have 5.2 packages.

Changed in unity8 (Ubuntu):
status: New → Incomplete
Revision history for this message
Timo Jyrinki (timo-jyrinki) wrote :

Does not crash with Qt 5.2 anymore.

Changed in qtbase-opensource-src (Ubuntu):
status: New → Fix Committed
Changed in unity8 (Ubuntu):
status: Incomplete → Invalid
Changed in unity8:
status: Incomplete → Invalid
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (13.3 KiB)

This bug was fixed in the package qtbase-opensource-src - 5.2.1+dfsg-1ubuntu7

---------------
qtbase-opensource-src (5.2.1+dfsg-1ubuntu7) trusty; urgency=medium

  [ Colin Watson ]
  * Add arm64 to archs that don't use -m64

qtbase-opensource-src (5.2.1+dfsg-1ubuntu6) trusty; urgency=medium

  * Add Use-None-instead-of-GLX_NONE.patch:
    - Cherry-pick upstream patch (LP: #1288278)

qtbase-opensource-src (5.2.1+dfsg-1ubuntu5) trusty; urgency=medium

  * Only run tests on armhf, amd64 and i386.

qtbase-opensource-src (5.2.1+dfsg-1ubuntu4) trusty; urgency=medium

  [ Chris Gagnon ]
  * Enable unit tests

qtbase-opensource-src (5.2.1+dfsg-1ubuntu3) trusty; urgency=medium

  * Revert the transitional package change final landing.

qtbase-opensource-src (5.2.1+dfsg-1ubuntu2) trusty; urgency=medium

  * libqt5core5 transitional package to be able to run ABI related tests

qtbase-opensource-src (5.2.1+dfsg-1ubuntu1) trusty; urgency=low

  [ Dmitry Shachnev ]
  * Update watch file (taken from Debian).
  * Fix generating documentation by building qdoc before using it.
  * Remove qtcreator.qdoc from qtbase5-doc.install, as it is already in
    qtbase5-dev.install.
  * Merge with Debian up to 5.2.0~beta1+dfsg-3.
    - Fixes build failures on powerpc and armel.
  * Add debian/patches/fix_cppcodemarker_crash.patch to fix qdoc
    crash that caused ubuntu-ui-toolkit to FTBFS (LP: #1217331).

  [ Łukasz 'sil2100' Zemczak ]
  * Cherry-pick two submitted patches to support appmenu-qt: (LP: #1157213)
    - make_qkdetheme_constructor_public.diff
    - platformtheme_env.diff

  [ Timo Jyrinki ]
  * New upstream release 5.2.1 (LP: #1256341) (LP: #1223032) (LP: #1222988)
    (LP: #1223042) (LP: #1253120) (LP: #1251262)
  * Sync with Debian 5.2.0+dfsg-7, remaining changes:
    - Remove firebird and ibase dependencies
    - Maintainer fields and Vcs-Bzr
    - No gdb required on ppc64el
    - Provides: qt-default to qt5-default
    - Define explicit list on which archs openvg required
    - Additional patches:
      + disable_overlay_scrollbars.diff
      + load_testability_from_env_var.patch
      + make_qkdetheme_constructor_public.diff
      + platformtheme_env.diff
      + qdoc-Fix-crash-in-Generator-generateInnerNode.patch
      + 0001-Do-not-overwrite-basePixmap-of-QIconLoader-PixmapEnt.patch
    - Use our symbols files
    - Additional multi-arch packages (not correct policy-wise)
  * Drop upstream patches:
    - add_since_52_to_new_QColor_features.patch
    - fix_cppcodemarker_crash.patch
    - fix_usr-move_workaround_in_the_presence_of_multi-arch.patch
    - make_QColor_understand_AARRGGBB.patch
    - Add-workaround-for-GL-on-Android-emulator.patch
    - 0001-Do-not-overwrite-basePixmap-of-QIconLoader-PixmapEnt.patch
    - fix_destroy_qapp_segfault.diff
  * Remove Ubuntu patches:
    - enable_appmenu_support.diff (obsolete)
    - 0001-Implement-XEmbed-protocol.patch (submitted and merged upstream)
    - fix_maliit_activation.patch (not used anymore)
    - inputmethod_fix_focusout.patch (not used anymore)
    - fix_number_precision_qjsondocument.patch_8e8becdc.patch (upstream)
    - bug1227629.patch (merged upstream)
    - fix_rowinserted.patch (LP: #1242630...

Changed in qtbase-opensource-src (Ubuntu):
status: Fix Committed → Fix Released
Michał Sawicz (saviq)
no longer affects: unity8
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.