#28 reproducible core dump in Qt::Table

[Marc Horowitz]

System: Debian/x86

Package versions:

ii libperl5.8 5.8.3-2 Shared Perl library.
ii libqt-perl 3.008-1 Perl bindings for the
Qt library

The simplest way to reproduce this is to use pqtsh.
When I run the
following commands:

use Qt::attributes qw(table);
table = Qt::Table();
table->show;
table->setNumRows(1);
table->setNumCols(1);
table->setText(0,0,"hello");
table->removeRow(0);

the final command causes a segmentation fault.
valgrind strongly
indicates that this is a double-free bug (logs attached).
Interestingly, if I keep running (which is possible
only under
valgrind), I don't see the problem again.

[Marc Horowitz]

valgrind output

[Marc Horowitz]

Logged In: YES
user_id=181461

Since my original report to kde-perl@kde.org (resubmitted
here at Germain's request), I tried to use
table->takeItem(), also at his suggestion. This works
without crashing anything, but I have to do a lot more work
to get the behavior I want:

sub removeRowFromTable
{
my ($deadRow) = @_;

for my $col (0..messageTable->numCols()-1) {
messageTable->takeItem(messageTable->item($deadRow, $col));
for my $row ($deadRow..messageTable->numRows()-2) {
my $item = messageTable->item($row+1, $col);
messageTable->takeItem($item);
messageTable->setItem($row, $col, $item);
}
}
messageTable->setNumRows(messageTable->numRows()-1);
}

messageTable is an attribute which contains a Qt::table
reference.

For now, though, this is at least a suitable workaround.

[Terry Fleury]

Logged In: YES
user_id=116599

I am also getting the segmentation fault when removing rows
from a QTable. However, I get the segmentation fault ALSO
when I try the 'takeItem' solution offered by mhh14.

I am using RedHat 9 (Perl 5.8.0, Qt 3.1.1, KDE 3.1) and the
latest CVS version of PerlQt-3. Below is the output from
'valgrind --tool=memcheck ...'. Note that I am using a
different table, but using the "removeRowFromTable" function
submitted by mhh14 (so it's doing takeItem rather than
removeRow).

Removing row 8
==13882==
==13882== Invalid read of size 4
==13882== at 0x3CF81E28: QTableItem::~QTableItem() (in
/usr/lib/qt-3.1/lib/libqt-mt.so.3.1.1)
==13882== by 0x3CA542AD: xcall_QTableItem(short, void*,
Smoke::StackItem*) (in /usr/local/kde/lib/libsmokeqt.so.1.2.1)
==13882== by 0x3C7222F4: invoke_dtor(smokeperl_object*)
(handlers.cpp:86)
==13882== by 0x3C722151: smokeperl_free(interpreter*,
sv*, magic*) (handlers.cpp:61)
==13882== Address 0x0 is not stack'd, malloc'd or free'd
==13882==
==13882== Process terminating with default action of signal
11 (SIGSEGV): dumping core
==13882== Access not within mapped region at address 0x0
==13882== at 0x3CF81E28: QTableItem::~QTableItem() (in
/usr/lib/qt-3.1/lib/libqt-mt.so.3.1.1)
==13882== by 0x3CA542AD: xcall_QTableItem(short, void*,
Smoke::StackItem*) (in /usr/local/kde/lib/libsmokeqt.so.1.2.1)
==13882== by 0x3C7222F4: invoke_dtor(smokeperl_object*)
(handlers.cpp:86)
==13882== by 0x3C722151: smokeperl_free(interpreter*,
sv*, magic*) (handlers.cpp:61)
==13882==
==13882== ERROR SUMMARY: 87 errors from 13 contexts
(suppressed: 109 from 3)
==13882== malloc/free: in use at exit: 7458700 bytes in
156815 blocks.
==13882== malloc/free: 408619 allocs, 251804 frees, 72452546
bytes allocated.
==13882== For a detailed leak analysis, rerun with:
--leak-check=yes
==13882== For counts of detected errors, rerun with: -v
Segmentation fault

[Michaël Houzé]

Logged In: YES
user_id=824859

Hi,

about removeRowFromTable, it's better to add temporary
assignment of item and check it if it's defined, cause
QTable::takeItem don't like undefined value.

Thanks to mhh14 for this great workaround.

[chr()]

Logged In: YES
user_id=1408628

Hi!

I found a smarter solution to workaround:

sub Qt::Table::takeItem {
#print "CALL Qt::Table::takeItem \n";
}

Thats it. Simply drop this to the .pm where you create
QTable. takeItem is virtual so its ok to do nothing.