bzr crashed with SIGSEGV in QGtkStyle::drawComplexControl()

[Logan Rosen]

This crash occurred after running bzr qlog and clicking different entries in the log for the ubuntu:upnp-router-control branch that I had imported into Ubuntu.

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: bzr 2.6.0~beta1-0ubuntu2
ProcVersionSignature: Ubuntu 3.5.0-3.3-generic 3.5.0-rc5
Uname: Linux 3.5.0-3-generic x86_64
ApportVersion: 2.2.5-0ubuntu2
Architecture: amd64
CrashCounter: 1
Date: Mon Jul 9 04:10:36 2012
ExecutablePath: /usr/bin/bzr
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Alpha amd64 (20120627)
InterpreterPath: /usr/bin/python2.7
PackageArchitecture: all
ProcCmdline: /usr/bin/python /usr/bin/bzr qlog
ProcEnviron:
 TERM=xterm
 SHELL=/bin/bash
 PATH=(custom, no user)
 LANG=en_US.UTF-8
SegvAnalysis:
 Segfault happened at: 0x7f8d748bce07 <_ZNK9QGtkStyle18drawComplexControlEN6QStyle14ComplexControlEPK19QStyleOptionComplexP8QPainterPK7QWidget+5175>: mov 0x30(%rsi),%r15
 PC (0x7f8d748bce07) ok
 source "0x30(%rsi)" (0x00000030) not located in a known VMA region (needed readable region)!
 destination "%r15" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: bzr
StacktraceTop:
 QGtkStyle::drawComplexControl(QStyle::ComplexControl, QStyleOptionComplex const*, QPainter*, QWidget const*) const () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QScrollBar::paintEvent(QPaintEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QWidget::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QScrollBar::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
Title: bzr crashed with SIGSEGV in QGtkStyle::drawComplexControl()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 QGtkStyle::drawComplexControl(QStyle::ComplexControl, QStyleOptionComplex const*, QPainter*, QWidget const*) const () from /tmp/tmp6Mv2zp/usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QScrollBar::paintEvent(QPaintEvent*) () from /tmp/tmp6Mv2zp/usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QWidget::event(QEvent*) () from /tmp/tmp6Mv2zp/usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QScrollBar::event(QEvent*) () from /tmp/tmp6Mv2zp/usr/lib/x86_64-linux-gnu/libQtGui.so.4
 QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /tmp/tmp6Mv2zp/usr/lib/x86_64-linux-gnu/libQtGui.so.4

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Ricardo Salveti (rsalveti)]

With the xserver-xorg-video-ati driver, depending on the memory load at the system, it can also crash the Xorg server.

Output from Xorg:

Fatal server error:
[ 438.248] EXA: malloc failed for size 1073610756 bytes
[ 438.248]
[ 438.248] (EE)
Please consult the The X.Org Foundation support
  at http://wiki.x.org
 for help.
[ 438.248] (EE) Please also check the log file at "/var/log/Xorg.0.log" for additional information.
[ 438.248] (EE)

Guess Xorg/Video-ati should also protect the memory allocation to avoid such crash in case the app/toolkit requests a huge EXA buffer.

[Ricardo Salveti (rsalveti)]

Actually this crash happens at the xorg-server package, as it's a fallback to use the system memory when dealing with mixed pixmaps.

I don't yet know if this would be something we could fix at the Xorg side, but the behaviour of a broken app/toolkit crashing the Xorg is something that needs to be avoided.

[Ricardo Salveti (rsalveti)]

I think this bug is the same one as described at bug 1051231, due python-qt4 + qt4 issues.