Trenchbroom: Crash when clicking a spawnflag checkbox while the spawnflags value cell editor is open

Created on 17 Apr 2020 · 8Comments · Source: TrenchBroom/TrenchBroom

System Information

TrenchBroom Build v0000.0 Release Qt 5.12.7 - Windows 7 Ultimate

Steps to Reproduce

Select an entity to change it's spawnflags
Type in a number as needed in spawnflags field
before pressing enter to confirm, click on the option below instead
This is when it crashes and I have reproduced it a few times in a row.
TB_Crash_17-04-2020.zip

2 Bug

Source

oGkspAz

All 8 comments

I haven't had any luck reproducing this yet. If it's not too hard to capture a video that might help narrow down what's happening!

ericwa on 17 Apr 2020

Accidently closed when trying to cancel comment...

oGkspAz on 17 Apr 2020

HERE is the video @oGkspAz recorded: https://youtu.be/C4kliHJlmZM

I was able to duplicate this using last built build 2.0.0-appveyor-4801 on my 1st attempt using a new quake 2 map, placing down any entity with spawn flags and repeating the steps described by @oGkspAz. I can crash TB under WINE, or Windows 7 in a VM, and Manjaro Linux KDE.

It's not random either, it is every time I attempt it.

eGax on 17 Apr 2020

I went back as far as Linux build 836-g794ca431 and I can crash that as well.

eGax on 17 Apr 2020

👍1

Great, to repro you just have to open the cell editor for an empty spawnflags Value cell, type something, then click on a spawnflags checkbox while it's open.

ericwa on 17 Apr 2020

👍1

I was getting useless back traces on all OS'es, and ASan wasn't outputting anything (maybe you need to compile Qt with ASan to get any useful output for this bug?), so turned to valgrind.

As hoped, it gives useful output. (edit: better stack trace)

==17631== Thread 1:
==17631== Invalid read of size 8
==17631==    at 0x598C7EF: inherits (qobject.h:417)
==17631==    by 0x598C7EF: QWidget::setFocus(Qt::FocusReason) (qwidget.cpp:6592)
==17631==    by 0x5953DB8: QApplicationPrivate::giveFocusAccordingToFocusPolicy(QWidget*, QEvent*, QPoint) (qapplication.cpp:4199)
==17631==    by 0x595CC3C: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3161)
==17631==    by 0x821093: TrenchBroom::View::TrenchBroomApp::notify(QObject*, QEvent*) (TrenchBroomApp.cpp:523)
==17631==    by 0x6A398D7: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1024)
==17631==    by 0x595A631: sendEvent (qcoreapplication.h:233)
==17631==    by 0x595A631: QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) (qapplication.cpp:2704)
==17631==    by 0x59AD16A: QWidgetWindow::handleMouseEvent(QMouseEvent*) (qwidgetwindow.cpp:628)
==17631==    by 0x59AF7D9: QWidgetWindow::event(QEvent*) (qwidgetwindow.cpp:250)
==17631==    by 0x595383B: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3722)
==17631==    by 0x595B103: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3481)
==17631==    by 0x821093: TrenchBroom::View::TrenchBroomApp::notify(QObject*, QEvent*) (TrenchBroomApp.cpp:523)
==17631==    by 0x6A398D7: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1024)
==17631==    by 0x6147582: QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) (in /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5.9.5)
==17631==    by 0x6149054: QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) (in /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5.9.5)
==17631==    by 0x61202EA: QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) (in /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5.9.5)
==17631==    by 0xFEF225F: ??? (in /usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5.9.5)
==17631==    by 0xB429416: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4)
==17631==    by 0xB42964F: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4)
==17631==    by 0xB4296DB: g_main_context_iteration (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4)
==17631==    by 0x6A9288E: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:423)
==17631==    by 0x6A37909: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:212)
==17631==    by 0x6A409B3: QCoreApplication::exec() (qcoreapplication.cpp:1297)
==17631==    by 0x1E0F73: main (Main.cpp:66)
==17631==  Address 0x320e9c30 is 0 bytes inside a block of size 48 free'd
==17631==    at 0x4C3123B: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==17631==    by 0x804C61: void qDeleteAll<QList<QWidget*>::const_iterator>(QList<QWidget*>::const_iterator, QList<QWidget*>::const_iterator) (qalgorithms.h:320)
==17631==    by 0x804A12: void qDeleteAll<QList<QWidget*> >(QList<QWidget*> const&) (qalgorithms.h:328)
==17631==    by 0x8046F6: TrenchBroom::View::deleteChildWidgetsAndLayout(QWidget*) (QtUtils.cpp:406)
==17631==    by 0x662DEE: TrenchBroom::View::FlagsEditor::setFlags(QList<int> const&, QStringList const&, QStringList const&) (FlagsEditor.cpp:60)
==17631==    by 0x662C14: TrenchBroom::View::FlagsEditor::setFlags(QStringList const&, QStringList const&) (FlagsEditor.cpp:46)
==17631==    by 0x793C02: TrenchBroom::View::SmartSpawnflagsEditor::doUpdateVisual(std::vector<TrenchBroom::Model::AttributableNode*, std::allocator<TrenchBroom::Model::AttributableNode*> > const&) (SmartSpawnflagsEditor.cpp:97)
==17631==    by 0x788E30: TrenchBroom::View::SmartAttributeEditor::update(std::vector<TrenchBroom::Model::AttributableNode*, std::allocator<TrenchBroom::Model::AttributableNode*> > const&) (SmartAttributeEditor.cpp:48)
==17631==    by 0x78AB57: TrenchBroom::View::SmartAttributeEditorManager::updateEditor() (SmartAttributeEditorManager.cpp:149)
==17631==    by 0x789AA5: TrenchBroom::View::SmartAttributeEditorManager::switchEditor(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<TrenchBroom::Model::AttributableNode*, std::allocator<TrenchBroom::Model::AttributableNode*> > const&) (SmartAttributeEditorManager.cpp:56)
==17631==    by 0x78A7A8: TrenchBroom::View::SmartAttributeEditorManager::nodesDidChange(std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&) (SmartAttributeEditorManager.cpp:108)
==17631==    by 0x78D8B9: TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::CObserver<TrenchBroom::View::SmartAttributeEditorManager>::operator()(std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&) (Notifier.h:199)
==17631==    by 0x6CA116: void TrenchBroom::NotifierState<TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::Observer>::notify<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > >(std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> >) (Notifier.h:108)
==17631==    by 0x6C7F4D: TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::notify(std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&) (Notifier.h:352)
==17631==    by 0x6C4B26: TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::operator()(std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&) (Notifier.h:361)
==17631==    by 0x6C4B4F: TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::NotifyAfter::createLambda(TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>&, std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&)::{lambda()#1}::operator()() const (Notifier.h:277)
==17631==    by 0x6CF333: TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::NotifyAfter::Holder<TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::NotifyAfter::createLambda(TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>&, std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&)::{lambda()#1}>::apply() (Notifier.h:257)
==17631==    by 0x6C135C: TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::NotifyAfter::~NotifyAfter() (Notifier.h:273)
==17631==    by 0x6CEF7D: TrenchBroom::Notifier<std::vector<TrenchBroom::Model::Node*, std::allocator<TrenchBroom::Model::Node*> > const&>::NotifyBeforeAndAfter::~NotifyBeforeAndAfter() (Notifier.h:286)
==17631==    by 0x6D3EBB: TrenchBroom::View::MapDocumentCommandFacade::performSetAttribute(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (MapDocumentCommandFacade.cpp:523)
==17631==    by 0x5A9A0C: TrenchBroom::View::ChangeEntityAttributesCommand::doPerformDo(TrenchBroom::View::MapDocumentCommandFacade*) (ChangeEntityAttributesCommand.cpp:86)
==17631==    by 0x5C0315: TrenchBroom::View::Command::performDo(TrenchBroom::View::MapDocumentCommandFacade*) (Command.cpp:65)
==17631==    by 0x5FDA96: TrenchBroom::View::DocumentCommand::performDo(TrenchBroom::View::MapDocumentCommandFacade*) (DocumentCommand.cpp:34)
==17631==    by 0x5C1BBE: TrenchBroom::View::CommandProcessor::executeCommand(TrenchBroom::View::Command*) (CommandProcessor.cpp:300)
==17631==    by 0x5C19FC: TrenchBroom::View::CommandProcessor::executeAndStoreCommand(std::unique_ptr<TrenchBroom::View::UndoableCommand, std::default_delete<TrenchBroom::View::UndoableCommand> >, bool, bool) (CommandProcessor.cpp:288)
==17631==    by 0x5C0EA0: TrenchBroom::View::CommandProcessor::executeAndStore(std::unique_ptr<TrenchBroom::View::UndoableCommand, std::default_delete<TrenchBroom::View::UndoableCommand> >) (CommandProcessor.cpp:214)
==17631==    by 0x6D861B: TrenchBroom::View::MapDocumentCommandFacade::doExecuteAndStore(std::unique_ptr<TrenchBroom::View::UndoableCommand, std::default_delete<TrenchBroom::View::UndoableCommand> >&&) (MapDocumentCommandFacade.cpp:1050)
==17631==    by 0x6B395C: TrenchBroom::View::MapDocument::executeAndStore(std::unique_ptr<TrenchBroom::View::UndoableCommand, std::default_delete<TrenchBroom::View::UndoableCommand> >&&) (MapDocument.cpp:1571)
==17631==    by 0x6B16DA: TrenchBroom::View::MapDocument::setAttribute(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (MapDocument.cpp:1297)
==17631==    by 0x62478B: TrenchBroom::View::EntityAttributeModel::updateAttribute(unsigned long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<TrenchBroom::Model::AttributableNode*, std::allocator<TrenchBroom::Model::AttributableNode*> > const&) (EntityAttributeModel.cpp:740)
==17631==    by 0x6239F2: TrenchBroom::View::EntityAttributeModel::setData(QModelIndex const&, QVariant const&, int) (EntityAttributeModel.cpp:622)
==17631==    by 0x69FA6D9: QSortFilterProxyModel::setData(QModelIndex const&, QVariant const&, int) (qsortfilterproxymodel.cpp:1935)
==17631==    by 0x5BC1A64: QStyledItemDelegate::setModelData(QWidget*, QAbstractItemModel*, QModelIndex const&) const (qstyleditemdelegate.cpp:486)
==17631==    by 0x5BA0784: QAbstractItemView::commitData(QWidget*) (qabstractitemview.cpp:2896)
==17631==    by 0x5B9FA9F: QAbstractItemView::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (moc_qabstractitemview.cpp:424)
==17631==    by 0x6A68554: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3767)
==17631==    by 0x5BB9B4E: QAbstractItemDelegate::commitData(QWidget*) (moc_qabstractitemdelegate.cpp:198)
==17631==    by 0x5BB9F5F: QAbstractItemDelegatePrivate::editorEventFilter(QObject*, QEvent*) (qabstractitemdelegate.cpp:526)
==17631==    by 0x6A395BB: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:1135)
==17631==    by 0x5953814: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3718)
==17631==    by 0x595B103: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3481)
==17631==    by 0x821093: TrenchBroom::View::TrenchBroomApp::notify(QObject*, QEvent*) (TrenchBroomApp.cpp:523)
==17631==    by 0x6A398D7: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1024)
==17631==    by 0x5958B70: sendEvent (qcoreapplication.h:233)
==17631==    by 0x5958B70: QApplicationPrivate::setFocusWidget(QWidget*, Qt::FocusReason) (qapplication.cpp:1811)
==17631==    by 0x598C7EE: QWidget::setFocus(Qt::FocusReason) (qwidget.cpp:6584)
==17631==    by 0x5953DB8: QApplicationPrivate::giveFocusAccordingToFocusPolicy(QWidget*, QEvent*, QPoint) (qapplication.cpp:4199)
==17631==    by 0x595CC3C: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3161)
==17631==    by 0x821093: TrenchBroom::View::TrenchBroomApp::notify(QObject*, QEvent*) (TrenchBroomApp.cpp:523)
==17631==    by 0x6A398D7: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1024)
==17631==    by 0x595A631: sendEvent (qcoreapplication.h:233)
==17631==    by 0x595A631: QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) (qapplication.cpp:2704)
==17631==    by 0x59AD16A: QWidgetWindow::handleMouseEvent(QMouseEvent*) (qwidgetwindow.cpp:628)
==17631==    by 0x59AF7D9: QWidgetWindow::event(QEvent*) (qwidgetwindow.cpp:250)
==17631==    by 0x595383B: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3722)
==17631==    by 0x595B103: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:3481)
==17631==    by 0x821093: TrenchBroom::View::TrenchBroomApp::notify(QObject*, QEvent*) (TrenchBroomApp.cpp:523)
==17631==    by 0x6A398D7: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1024)
==17631==    by 0x6147582: QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) (in /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5.9.5)
==17631==    by 0x6149054: QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) (in /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5.9.5)
==17631==    by 0x61202EA: QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) (in /usr/lib/x86_64-linux-gnu/libQt5Gui.so.5.9.5)
==17631==    by 0xFEF225F: ??? (in /usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5.9.5)
==17631==    by 0xB429416: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4)
==17631==    by 0xB42964F: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4)
==17631==    by 0xB4296DB: g_main_context_iteration (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4)
==17631==    by 0x6A9288E: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:423)
==17631==    by 0x6A37909: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:212)
==17631==    by 0x6A409B3: QCoreApplication::exec() (qcoreapplication.cpp:1297)
==17631==    by 0x1E0F73: main (Main.cpp:66)

I don't have Qt debug symbols yet so the stack trace is missing Qt stack frames. But it appears that Qt is trying to give focus to a QCheckBox that we've already deleted. Will continue seeing what we should do to fix it.

ericwa on 19 Apr 2020

I could imagine something like this: When the text box loses focus, the edit is committed, which results in new spawnflags being set. This will then lead to the check boxes being updated (recreated?), but the onFocus is already happening to the old checkbox that was clicked on. But that checkbox has possibly been deleted in a reaction to the new spawnflags value being set...

kduske on 19 Apr 2020

Yeah, I think it's deleting the checkbox during the execution of setFocus on that checkbox (which triggers the field editor to close, and the value in the text box to be saved, which triggers the checkboxes to be deleted and recreated).

ericwa on 19 Apr 2020

Was this page helpful?

0 / 5 - 0 ratings