Ticket #41527

AddressSanitizer: SEGV on unknown address (3.0.0-beta0 8a225b6be0, civ2civ3, qt)

Date d'ouverture: 2021-02-09 22:31 Dernière mise à jour: 2021-02-10 18:33

Rapporteur:
Propriétaire:
(Aucun)
Type:
État:
Ouvert
Composant:
Jalon:
(Aucun)
Priorité:
5 - moyen
Sévérité:
5 - moyen
Résolution:
Aucun
Fichier:
Aucun

Détails

I got this SEGV:

chippo@chippo-Aspire-V3-731:~/Downloads/git_clones/freeciv/freeciv-30$ UBSAN_OPTIONS="print_stacktrace=1" ASAN_OPTIONS="abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1:detect_leaks=1" ./fcgui --gui qt 2>&1 | tee leak_dump.out
Running ./client/freeciv-qt
2: Loading tileset "alio".
AddressSanitizer:DEADLYSIGNAL
=================================================================
==396152==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7ff8c0cbadc9 bp 0x7fffed20cea0 sp 0x7fffed20c350 T0)
==396152==The signal is caused by a READ memory access.
==396152==Hint: this fault was caused by a dereference of a high value address (see register values below).  Dissassemble the provided pc to learn which register was used.
    #0 0x7ff8c0cbadc9 in QWidget::setEnabled(bool) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1a7dc9)
    #1 0x55dc5369a312 in mr_menu::menus_sensitive() /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/menu.cpp:2024
    #2 0x55dc536a825a in real_menus_update /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/menu.cpp:601
    #3 0x55dc5367d885 in fc_client::update_info_label() /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/mapview.cpp:1019
    #4 0x55dc535eb72f in fc_client::switch_page(int) /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/fc_client.cpp:374
    #5 0x55dc53708f1d in qtg_real_set_client_page(client_pages) /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/pages.cpp:105
    #6 0x55dc53433c2c in real_set_client_page /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui_interface.c:394
    #7 0x55dc5350b36e in set_client_page_callback /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/update_queue.c:481
    #8 0x55dc5350bbef in update_unqueue /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/update_queue.c:320
    #9 0x55dc53684d0a in mr_idle::idling() /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/mapview.cpp:179
    #10 0x55dc53687220 in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (mr_idle::*)()>::call(void (mr_idle::*)(), mr_idle*, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:152
    #11 0x55dc53687220 in void QtPrivate::FunctionPointer<void (mr_idle::*)()>::call<QtPrivate::List<>, void>(void (mr_idle::*)(), mr_idle*, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:185
    #12 0x55dc53687220 in QtPrivate::QSlotObject<void (mr_idle::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:414
    #13 0x7ff8c1462457 in QMetaObject::activate(QObject*, int, int, void**) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b2457)
    #14 0x7ff8c146f51d in QTimer::timeout(QTimer::QPrivateSignal) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bf51d)
    #15 0x7ff8c1462cf4 in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b2cf4)
    #16 0x7ff8c0c7da65 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x16aa65)
    #17 0x7ff8c0c870ef in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1740ef)
    #18 0x7ff8c1436939 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x286939)
    #19 0x7ff8c148d8af in QTimerInfoList::activateTimers() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2dd8af)
    #20 0x7ff8c148e1e3  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2de1e3)
    #21 0x7ff8bd36d4da in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x534da)
    #22 0x7ff8bd36d787  (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x53787)
    #23 0x7ff8bd36d852 in g_main_context_iteration (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x53852)
    #24 0x7ff8c148e564 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2de564)
    #25 0x7ff8c14354da in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2854da)
    #26 0x7ff8c143d245 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28d245)
    #27 0x55dc535ea823 in fc_client::fc_main(QApplication*) /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/fc_client.cpp:256
    #28 0x55dc534359c2 in qtg_ui_main(int, char**) /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/gui_main.cpp:194
    #29 0x55dc53433976 in ui_main /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui_interface.c:59
    #30 0x55dc5343a33a in client_main /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/client_main.c:685
    #31 0x55dc5343537a in main /home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/gui-qt/gui_main.cpp:103
    #32 0x7ff8c05e4cb1 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28cb1)
    #33 0x55dc5343387d in _start (/home/chippo/Downloads/git_clones/freeciv/freeciv-30/client/freeciv-qt+0x16987d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1a7dc9) in QWidget::setEnabled(bool)
==396152==ABORTING

And there was a core, so:

Core was generated by `./client/freeciv-qt'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007ff8c05fd8cb in raise () from /lib/x86_64-linux-gnu/libc.so.6
[Current thread is 1 (Thread 0x7ff8b95bbb80 (LWP 396152))]
gef➤  bt
#0  0x00007ff8c05fd8cb in raise () at /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007ff8c05e2864 in abort () at /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007ff8c23670b2 in  () at /usr/lib/x86_64-linux-gnu/libasan.so.6
#3  0x00007ff8c237276c in  () at /usr/lib/x86_64-linux-gnu/libasan.so.6
#4  0x00007ff8c235269c in  () at /usr/lib/x86_64-linux-gnu/libasan.so.6
#5  0x00007ff8c23500ee in  () at /usr/lib/x86_64-linux-gnu/libasan.so.6
#6  0x00007ff8c234f482 in  () at /usr/lib/x86_64-linux-gnu/libasan.so.6
#7  0x00007ff8c0b05bb0 in <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0
#8  0x00007ff8c0cbadc9 in QWidget::setEnabled(bool) () at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#9  0x000055dc5369a313 in mr_menu::menus_sensitive() (this=0x61100007f340) at menu.cpp:2024
#10 0x000055dc536a825b in real_menus_update() () at menu.cpp:601
#11 0x000055dc5367d886 in fc_client::update_info_label() (this=this@entry=0x61b00001b280) at mapview.cpp:1019
#12 0x000055dc535eb730 in fc_client::switch_page(int) (this=0x61b00001b280, new_pg=new_pg@entry=0x5) at fc_client.cpp:374
#13 0x000055dc53708f1e in qtg_real_set_client_page(client_pages) (page=PAGE_GAME) at pages.cpp:105
#14 0x000055dc53433c2d in real_set_client_page (page=page@entry=PAGE_GAME) at gui_interface.c:394
#15 0x000055dc5350b36f in set_client_page_callback (data=0x5) at update_queue.c:481
#16 0x000055dc5350bbf0 in update_unqueue (data=<optimized out>) at update_queue.c:320
#17 0x000055dc53684d0b in mr_idle::idling() (this=0x61b00001b490) at mapview.cpp:179
#18 0x000055dc53687221 in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (mr_idle::*)()>::call(void (mr_idle::*)(), mr_idle*, void**) (arg=0x7fffed20d910, o=0x61b00001b490, f=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:184
#19 QtPrivate::FunctionPointer<void (mr_idle::*)()>::call<QtPrivate::List<>, void>(void (mr_idle::*)(), mr_idle*, void**) (arg=0x7fffed20d910, o=0x61b00001b490, f=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:185
#20 QtPrivate::QSlotObject<void (mr_idle::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (which=0x1, this_=0x60300025cf30, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:414
#21 0x00007ff8c1462458 in QMetaObject::activate(QObject*, int, int, void**) () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#22 0x00007ff8c146f51e in QTimer::timeout(QTimer::QPrivateSignal) () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#23 0x00007ff8c1462cf5 in QObject::event(QEvent*) () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#24 0x00007ff8c0c7da66 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#25 0x00007ff8c0c870f0 in QApplication::notify(QObject*, QEvent*) () at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#26 0x00007ff8c143693a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#27 0x00007ff8c148d8b0 in QTimerInfoList::activateTimers() () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#28 0x00007ff8c148e1e4 in  () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#29 0x00007ff8bd36d4db in g_main_context_dispatch () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#30 0x00007ff8bd36d788 in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#31 0x00007ff8bd36d853 in g_main_context_iteration () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#32 0x00007ff8c148e565 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#33 0x00007ff8c14354db in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#34 0x00007ff8c143d246 in QCoreApplication::exec() () at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#35 0x000055dc535ea824 in fc_client::fc_main(QApplication*) (this=0x61b00001b280, qapp=<optimized out>) at fc_client.cpp:256
#36 0x000055dc534359c3 in qtg_ui_main(int, char**) (argc=<optimized out>, argv=<optimized out>) at gui_main.cpp:194
#37 0x000055dc53433977 in ui_main (argc=argc@entry=0x1, argv=argv@entry=0x7fffed20e598) at gui_interface.c:59
#38 0x000055dc5343a33b in client_main (argc=0x1, argv=0x7fffed20e598) at client_main.c:685
#39 0x000055dc5343537b in main(int, char**) (argc=0x1, argv=0x7fffed20e598) at gui_main.cpp:103
gef➤  

Is it possible to attach files to a ticket while you are creating it? If so, I am not working out how. :-(

Ticket History (3/8 Histories)

2021-02-09 22:31 Updated by: chippo
  • New Ticket "AddressSanitizer: SEGV on unknown address (3.0.0-beta0 8a225b6be0, civ2civ3, qt)" created
2021-02-10 00:32 Updated by: chippo
Commentaire

The problem goes away when I re-compile without ASAN or UBSAN. Since I always compile with *SAN and usually do a 'git pull; make' about once a day, I suspect the problem was introduced in one of the most recent commits.

2021-02-10 04:37 Updated by: cazfi
Commentaire

Can you reproduce this consistently from current S3_0, then? Can you test when (which commit) it started?

2021-02-10 04:38 Updated by: cazfi
Commentaire

Reply To cazfi

Can you test when (which commit) it started?

The only one that has touched Qt-client menu.cpp lately is hrm Bug #918786, so that's one to check first.

2021-02-10 05:18 Updated by: chippo
Commentaire

Reply To cazfi

Can you reproduce this consistently from current S3_0, then?

Yup.

Reply To cazfi

Can you test when (which commit) it started?

Already in the process of doing that. Well, I'm busy re-reading my git cheat-sheets and notes to work out how to rewind my checked-out copy to a particular commit.

2021-02-10 15:56 Updated by: chippo
Commentaire

Strangely, it wasn't that menu.cpp commit. Since it takes me more than an hour to recompile, it is going to take me a while to find it. But should I bother? The problem has disappeared in 4aba0703a1. The only version (that I've found) that displays the problem is 8a225b6be0.

2021-02-10 16:03 Updated by: cazfi
Commentaire

Reply To chippo

Since it takes me more than an hour to recompile, it is going to take me a while to find it. But should I bother? The problem has disappeared in 4aba0703a1. The only version (that I've found) that displays the problem is 8a225b6be0.

If it comes and goes like that, there's no point in wasting time in testing with which commits it happens. That won't show the root cause that is there even in the commits that seemingly work.

2021-02-10 18:33 Updated by: chippo
Commentaire

Reply To cazfi

If it comes and goes like that, there's no point in wasting time in testing with which commits it happens. That won't show the root cause that is there even in the commits that seemingly work.

Agreed. If it rears its ugly head again, I can put some more effort into it.

Attachment File List

No attachments

Modifier

You are not logged in. I you are not logged in, your comment will be treated as an anonymous post. » Connexion