segfault in QHashData::nextNode

jhirte

I'm seeing occasionally segfaults with digiKam like this one:

#0  QHashData::nextNode (node=node@entry=0x555558722110) at tools/qhash.cpp:617
#1  0x00007ffff5178b3c in QHash<QWidget*, QHashDummyValue>::const_iterator::operator++ (this=<synthetic pointer>) at ../../include/QtCore/../../src/corelib/tools/qhash.h:394
#2  QSet<QWidget*>::const_iterator::operator++ (this=<synthetic pointer>) at ../../include/QtCore/../../src/corelib/tools/qset.h:162
#3  QSet<QWidget*>::toList (this=0x555555908f90) at ../../include/QtCore/../../src/corelib/tools/qset.h:375
#4  QApplication::allWidgets () at kernel/qapplication.cpp:1756
#5  0x00007ffff5178ba6 in QApplication::topLevelWidgets () at kernel/qapplication.cpp:1730
#6  0x00007ffff5178f25 in qt_tlw_for_window (wnd=wnd@entry=0x555555af9950) at kernel/qapplication.cpp:2183
#7  0x00007ffff517c058 in QApplicationPrivate::notifyActiveWindowChange (this=<optimized out>, previous=<optimized out>) at kernel/qapplication.cpp:2198
#8  0x00007ffff4c3c705 in QGuiApplicationPrivate::processActivatedEvent (e=<optimized out>) at kernel/qguiapplication.cpp:2176
#9  0x00007ffff4c3c925 in QGuiApplicationPrivate::processWindowSystemEvent (e=e@entry=0x7fff300c6f20) at kernel/qguiapplication.cpp:1754
#10 0x00007ffff4c171ea in QWindowSystemInterface::sendWindowSystemEvents (flags=...) at kernel/qwindowsysteminterface.cpp:939
#11 0x00007fffdc165860 in userEventSourceDispatch (source=source@entry=0x5555558f86e0) at qeventdispatcher_glib.cpp:77
#12 0x00007fffec62ef3e in g_main_dispatch (context=0x7fffd4004ff0) at /var/tmp/portage/dev-libs/glib-2.52.3/work/glib-2.52.3/glib/gmain.c:3234
#13 g_main_context_dispatch (context=context@entry=0x7fffd4004ff0) at /var/tmp/portage/dev-libs/glib-2.52.3/work/glib-2.52.3/glib/gmain.c:3899
#14 0x00007fffec62f170 in g_main_context_iterate (context=context@entry=0x7fffd4004ff0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at /var/tmp/portage/dev-libs/glib-2.52.3/work/glib-2.52.3/glib/gmain.c:3972
#15 0x00007fffec62f1fc in g_main_context_iteration (context=0x7fffd4004ff0, may_block=may_block@entry=1) at /var/tmp/portage/dev-libs/glib-2.52.3/work/glib-2.52.3/glib/gmain.c:4033
#16 0x00007ffff49399ef in QEventDispatcherGlib::processEvents (this=0x5555558a4730, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#17 0x00007ffff48e8052 in QEventLoop::exec (this=this@entry=0x7fffffffd410, flags=..., flags@entry=...) at kernel/qeventloop.cpp:212
#18 0x00007ffff48f045c in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1291
#19 0x000055555555bb71 in main (argc=<optimized out>, argv=<optimized out>) at /var/tmp/portage/media-gfx/digikam-9999/work/digikam-9999/app/main/main.cpp:285

I'm wondering, if this is a bug in digiKam oder Qt. digiKam is only involved with the main()-funtion in the backtrace. But as digiKam is highly multithreaded and I'm seeing this segfault only here, I'm still suspecting the bug not in Qt but in digiKam itself. So can someone give me a hint to debug this?

kshegunov

@jhirte said in segfault in QHashData::nextNode:

I'm wondering, if this is a bug in digiKam

Probably. Looks either like dereferencing a dangling pointer or some weird race condition.
Either way, load it in the debugger and try to inspect what object it was trying to deliver the event to. My best guess at this point is that the top level widget(s) were deleted (or corrupted in some fashion) while there were still pending window change events for them. You'd need to dig around line 1756 in application.cpp in Qt's sources with the debugger to inspect the variables.
This: this=<synthetic pointer> however also hints that the application object might've been deleted (or corrupted) for some reason before (or while) the event's been delivered. You should also check that.