Segfault with Qt-5.11.0

[Gaetan Bisson]

Dear all,

I'm getting a segfault when running Subsurface with Qt-5.11. It occurs
with both an old binary compiled against Qt-5.10 and a freshly rebuilt
binary. Note that building against Qt-5.11 requires fixing a couple of
headers, but that's unrelated:

https://github.com/Subsurface-divelog/subsurface/pull/1317

The segfault occurs whenever the dive list is nonempty. With a new
profile, just click on "Log" then "Add Dive" and then "Apply Changes" to
trigger it. Here's a backtrace:


Thread 1 "subsurface" received signal SIGSEGV, Segmentation fault.
0x00007ffff05aa4d2 in QSortFilterProxyModel::parent(QModelIndex const&) const () from /usr/lib/libQt5Core.so.5
(gdb) bt
#0 0x00007ffff05aa4d2 in QSortFilterProxyModel::parent(QModelIndex const&) const () at /usr/lib/libQt5Core.so.5
#1 0x00007ffff291f60a in QTreeView::drawRow(QPainter*, QStyleOptionViewItem const&, QModelIndex const&) const () at /usr/lib/libQt5Widgets.so.5
#2 0x00007ffff2924e7f in QTreeView::drawTree(QPainter*, QRegion const&) const () at /usr/lib/libQt5Widgets.so.5
#3 0x00007ffff29299f8 in QTreeView::paintEvent(QPaintEvent*) () at /usr/lib/libQt5Widgets.so.5
#4 0x00007ffff26a0058 in QWidget::event(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#5 0x00007ffff27467df in QFrame::event(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#6 0x00007ffff28c0b84 in QAbstractItemView::viewportEvent(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#7 0x00007ffff292aa3c in QTreeView::viewportEvent(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#8 0x00007ffff05cf8db in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) () at /usr/lib/libQt5Core.so.5
#9 0x00007ffff2660974 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#10 0x00007ffff266825b in QApplication::notify(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#11 0x00007ffff05cfbc9 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/libQt5Core.so.5
#12 0x00007ffff26989bc in QWidgetPrivate::sendPaintEvent(QRegion const&) () at /usr/lib/libQt5Widgets.so.5
#13 0x00007ffff2699141 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) ()
at /usr/lib/libQt5Widgets.so.5
#14 0x00007ffff2699e2e in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#15 0x00007ffff2699d14 in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#16 0x00007ffff2699d14 in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#17 0x00007ffff2699d14 in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#18 0x00007ffff2698f0d in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) ()
at /usr/lib/libQt5Widgets.so.5
#19 0x00007ffff2699e2e in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#20 0x00007ffff2698f0d in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) ()
at /usr/lib/libQt5Widgets.so.5
#21 0x00007ffff2699e2e in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#22 0x00007ffff2698f0d in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) ()
at /usr/lib/libQt5Widgets.so.5
#23 0x00007ffff2699e2e in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#24 0x00007ffff2699d14 in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#25 0x00007ffff2699d14 in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#26 0x00007ffff2698f0d in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) ()
at /usr/lib/libQt5Widgets.so.5
#27 0x00007ffff2699e2e in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#28 0x00007ffff2698f0d in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) ()
at /usr/lib/libQt5Widgets.so.5
#29 0x00007ffff2699e2e in QWidgetPrivate::paintSiblingsRecursive(QPaintDevice*, QList<QObject*> const&, int, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () at /usr/lib/libQt5Widgets.so.5
#30 0x00007ffff2698f0d in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) ()
at /usr/lib/libQt5Widgets.so.5
#31 0x00007ffff2670151 in () at /usr/lib/libQt5Widgets.so.5
#32 0x00007ffff2670309 in () at /usr/lib/libQt5Widgets.so.5
#33 0x00007ffff2687a57 in QWidgetPrivate::syncBackingStore() () at /usr/lib/libQt5Widgets.so.5
#34 0x00007ffff26a0199 in QWidget::event(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#35 0x00007ffff27b88b5 in QMainWindow::event(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#36 0x00007ffff2660984 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#37 0x00007ffff266825b in QApplication::notify(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#38 0x00007ffff05cfbc9 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/libQt5Core.so.5
#39 0x00007ffff05d2c5c in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () at /usr/lib/libQt5Core.so.5
#40 0x00007ffff29700b6 in () at /usr/lib/libQt5Widgets.so.5
#41 0x00007ffff2975679 in () at /usr/lib/libQt5Widgets.so.5
#42 0x00007ffff05fa2e2 in QObject::event(QEvent*) () at /usr/lib/libQt5Core.so.5
#43 0x00007ffff298181c in QGraphicsScene::event(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#44 0x00007ffff2660984 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#45 0x00007ffff266825b in QApplication::notify(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#46 0x00007ffff05cfbc9 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/libQt5Core.so.5
#47 0x00007ffff05d2c5c in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () at /usr/lib/libQt5Core.so.5
#48 0x00007ffff0623864 in () at /usr/lib/libQt5Core.so.5
#49 0x00007fffea4a9368 in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#50 0x00007fffea4a95b1 in () at /usr/lib/libglib-2.0.so.0
#51 0x00007fffea4a963e in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#52 0x00007ffff0622e49 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt5Core.so.5
#53 0x00007fffe1b74b32 in () at /usr/lib/libQt5XcbQpa.so.5
#54 0x00007ffff05ce85c in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt5Core.so.5
#55 0x00007ffff05d6b56 in QCoreApplication::exec() () at /usr/lib/libQt5Core.so.5
#56 0x000055555565aaf0 in main ()


Any ideas how to debug this?

Cheers.

[Thiago Macieira]

Post by Gaetan Bisson
Any ideas how to debug this?

Can you valgrind? Without debug symbols in Qt it may be a little difficult to
make sense of what we're seeing, but it might help.

[Gaetan Bisson]

Post by Thiago Macieira

Post by Gaetan Bisson
Any ideas how to debug this?

Can you valgrind? Without debug symbols in Qt it may be a little difficult to
make sense of what we're seeing, but it might help.

Sure; see valgrind's log attached. The core dump is too big to send by
email but I can find a way to get it to you if needed. Also, while I was
http://code.qt.io/cgit/qt/qtbase.git/patch/?id=1c0fcbc887459d8963088309e83303eb1a7d2db0
https://github.com/lxqt/libfm-qt/issues/164
https://bugreports.qt.io/browse/QTBUG-68427

Oh, it's also there:

https://bugreports.qt.io/browse/QTBUG-67948

Cheers.

[Gaetan Bisson]

Post by Gaetan Bisson
https://bugreports.qt.io/browse/QTBUG-67948

It turns out removing oldModel->deleteLater(); from DiveListView::reload()
avoids the segfault. See the discussion in the above bug report. However I
have no idea what the proper fix should be.

Cheers.

[Berthold Stoeger]

Post by Gaetan Bisson

Post by Gaetan Bisson
https://bugreports.qt.io/browse/QTBUG-67948

It turns out removing oldModel->deleteLater(); from DiveListView::reload()
avoids the segfault. See the discussion in the above bug report. However I
have no idea what the proper fix should be.

For one, we could delete it directly, c.f. attached patch. Probably it will
still crash (no recent Qt to test, sorry), but at least we might get a useful
back trace. deleteLater() is evil.

Berthold

[Gaetan Bisson]

Post by Berthold Stoeger

Post by Gaetan Bisson

Post by Gaetan Bisson
https://bugreports.qt.io/browse/QTBUG-67948

It turns out removing oldModel->deleteLater(); from DiveListView::reload()
avoids the segfault. See the discussion in the above bug report. However I
have no idea what the proper fix should be.

For one, we could delete it directly, c.f. attached patch.

There's no segfault with that patch.

Weird but good. :)

[Gaetan Bisson]

Post by Thiago Macieira

Post by Gaetan Bisson
Any ideas how to debug this?

Can you valgrind? Without debug symbols in Qt it may be a little difficult to
make sense of what we're seeing, but it might help.

Sure; see valgrind's log attached. The core dump is too big to send by
email but I can find a way to get it to you if needed. Also, while I was
asleep, Arch's Qt packager bisected the faulty commit to:

http://code.qt.io/cgit/qt/qtbase.git/patch/?id=1c0fcbc887459d8963088309e83303eb1a7d2db0

Which I note is also suspected for other segfaults:

https://github.com/lxqt/libfm-qt/issues/164

He has reported this issue there:

https://bugreports.qt.io/browse/QTBUG-68427

Hope this helps.