Bug 226224 - devel/qtcreator: segfaults when trying to parse a QML file
Summary: devel/qtcreator: segfaults when trying to parse a QML file
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: kde
URL: https://bugreports.qt.io/browse/QTCRE...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-02-26 21:26 UTC by q5sys
Modified: 2018-11-24 00:17 UTC (History)
5 users (show)

See Also:
tcberner: maintainer-feedback+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description q5sys 2018-02-26 21:26:17 UTC
Qt Creator will segfault when trying to parse a QML file.

Steps to reproduce:
1) Open Qt Creator
2) Open any QML example that ships with Qt Creator.
3) Attempt to open any QML file in the editor.

Alternatively

1) Open Qt Creator
2) Create new QML project
3) Attempt to open any QML file

Alternatively

1) Open Qt Creator
2) Open any QML project
3) Attempt to add a new blank QML file
4) Qt Creator will segfault as soon as you type brackets


In doing testing, it appears that Qt Creator is loading the file in the editor properly, but when it attempt to parse the text it crashes.  Adding import statements does not crash the editor, but the moment you type any brackets it will.

TRUSS Output:

fstatat(AT_FDCWD,"/usr/local/lib/qt5/qml/QtQuick/Controls",{ mode=drwxr-xr-x ,inode=138124,size=37,blksize=4096 },0x0) = 0 (0x0)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35253723136 (0x835492000)
mmap(0x0,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264684032 (0x835f06000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35253727232 (0x835493000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264696320 (0x835f09000)
mmap(0x0,20480,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264700416 (0x835f0a000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264720896 (0x835f0f000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264724992 (0x835f10000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264729088 (0x835f11000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264733184 (0x835f12000)
poll({ 11/POLLIN 26/POLLIN 148/POLLIN 135/POLLIN 16/POLLIN 6/POLLIN },6,219) = 0 (0x0)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264737280 (0x835f13000)
poll({ 11/POLLIN 26/POLLIN 148/POLLIN 135/POLLIN 16/POLLIN 6/POLLIN },6,0) = 0 (0x0)
write(7,"\0",1)                                  = 1 (0x1)
poll({ 3/POLLIN|POLLOUT },1,-1)                  = 1 (0x1)
writev(0x3,0x7fffffffdae8,0x1)                   = 4 (0x4)
poll({ 3/POLLIN },1,-1)                          = 1 (0x1)
recvmsg(3,0x7fffdfffdcf8,0)                      = 32 (0x20)
_umtx_op(0x8006ee0b8,UMTX_OP_NWAKE_PRIVATE,0x1,0x0,0x0) = 0 (0x0)
_umtx_op(0x803c97210,UMTX_OP_WAIT_UINT_PRIVATE,0x0,0x0,0x0) = 0 (0x0)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264741376 (0x835f14000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264745472 (0x835f15000)
mmap(0x0,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264749568 (0x835f16000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264761856 (0x835f19000)
poll({ 3/POLLIN|POLLOUT },1,-1)                  = 1 (0x1)
writev(0x3,0x7fffffffdab8,0x1)                   = 76 (0x4c)
poll({ 11/POLLIN 26/POLLIN 148/POLLIN 135/POLLIN 16/POLLIN 6/POLLIN },6,57) = 1 (0x1)
read(6,"\0",16)                                  = 1 (0x1)
read(6,0x7fffffffe370,16)                        ERR#35 'Resource temporarily unavailable'
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264765952 (0x835f1a000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264770048 (0x835f1b000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264774144 (0x835f1c000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264778240 (0x835f1d000)
mmap(0x0,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264782336 (0x835f1e000)
mmap(0x0,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264794624 (0x835f21000)
mmap(0x0,20480,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264806912 (0x835f24000)
mmap(0x0,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264827392 (0x835f29000)
mmap(0x0,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35264839680 (0x835f2c000)
SIGNAL 10 (SIGBUS) code=BUS_OBJERR trapno=9 addr=0x818d200b7
<thread 101547 exited>
<thread 101548 exited>
<thread 100812 exited>
<thread 101551 exited>
<thread 101550 exited>
<thread 101549 exited>
<thread 101563 exited>
process killed, signal = 10
[q5sys@skynet] ~/code/dashboard/qml% 


LLDB

[q5sys@skynet] ~% lldb
(lldb) process attach --pid 5104
Process 5104 stopped

Executable module set to "/usr/local/bin/qtcreator".
Architecture set to: x86_64--freebsd12.0.
(lldb) c
Process 5104 resuming
(lldb) Info: creating stash file /usr/home/q5sys/git/build-qmltest-Desktop-Debug/.qmake.stash
SOFT ASSERT: "item" in file treemodel.cpp, line 1108
Process 5104 stopped
* thread #12, name = 'qtcreator', stop reason = signal SIGSEGV: invalid address (fault address: 0x84793e4d0)
    frame #0: 0x0000000818d200e2 libQmlJS.so.4`QmlJS::Context::imports(QmlJS::Document const*) const + 66
libQmlJS.so.4`QmlJS::Context::imports:
->  0x818d200e2 <+66>: movq   (%r8,%rdx,8), %rax
    0x818d200e6 <+70>: xorl   %ebx, %ebx
    0x818d200e8 <+72>: cmpq   %rdi, %rax
    0x818d200eb <+75>: je     0x818d20154               ; <+180>
(lldb) bt
* thread #12, name = 'qtcreator', stop reason = signal SIGSEGV: invalid address (fault address: 0x84793e4d0)
  * frame #0: 0x0000000818d200e2 libQmlJS.so.4`QmlJS::Context::imports(QmlJS::Document const*) const + 66
    frame #1: 0x0000000818d20190 libQmlJS.so.4`QmlJS::Context::lookupType(QmlJS::Document const*, QmlJS::AST::UiQualifiedId*, QmlJS::AST::UiQualifiedId) const + 32
    frame #2: 0x0000000818d206ec libQmlJS.so.4`QmlJS::Context::lookupReference(QmlJS::Value const*) const + 252
    frame #3: 0x0000000818caa4f8 libQmlJS.so.4`QmlJS::PrototypeIterator::hasNext(void) + 168
    frame #4: 0x0000000818cd2c98 libQmlJS.so.4`QmlJS::ScopeBuilder::setQmlScopeObject(QmlJS::AST::Node*) + 440
    frame #5: 0x0000000818cd2529 libQmlJS.so.4`QmlJS::ScopeBuilder::push(QmlJS::AST::Node*) + 169
    frame #6: 0x0000000818cc39aa libQmlJS.so.4`QmlJS::Check::visitQmlObject(QmlJS::AST::Node*, QmlJS::Check::visitQmlObject::UiQualifiedId*, QmlJS::Check::visitQmlObject::UiObjectInitializer*) + 5466
    frame #7: 0x0000000818cc2441 libQmlJS.so.4`QmlJS::Check::visit(QmlJS::AST::UiObjectDefinition*) + 17
    frame #8: 0x0000000818c6557c libQmlJS.so.4`QmlJS::AST::UiObjectDefinition::accept0(QmlJS::AST::Visitor*) + 28
    frame #9: 0x0000000818c65916 libQmlJS.so.4`QmlJS::AST::UiObjectMemberList::accept0(QmlJS::AST::Visitor*) + 86
    frame #10: 0x0000000818c65496 libQmlJS.so.4`QmlJS::AST::UiProgram::accept0(QmlJS::AST::Visitor*) + 118
    frame #11: 0x0000000818c62c8e libQmlJS.so.4`QmlJS::AST::Node::accept(QmlJS::AST::Node*, QmlJS::AST::Visitor*) + 46
    frame #12: 0x0000000818cc0d45 libQmlJS.so.4`QmlJS::Check::operator()(void) + 101
    frame #13: 0x0000000827d8b7b0 libQmlJSEditor.so`___lldb_unnamed_symbol1033$$libQmlJSEditor.so + 1456
    frame #14: 0x0000000827d8b05c libQmlJSEditor.so`___lldb_unnamed_symbol1032$$libQmlJSEditor.so + 428
    frame #15: 0x00000008028abd4a libQt5Core.so.5`___lldb_unnamed_symbol244$$libQt5Core.so.5 + 234
    frame #16: 0x0000000803a7ac55 libthr.so.3`___lldb_unnamed_symbol1$$libthr.so.3 + 325
(lldb)
Comment 1 Tobias C. Berner freebsd_committer 2018-03-03 20:23:38 UTC
Hi there

Yes, I can confirm this behaviour. 


mfg Tobias
Comment 2 q5sys 2018-03-07 21:03:20 UTC
Interestingly enough in an attempt to dig into this more I manually built qtcreator with "qmake qtcreator.pro CONFIG+=debug && make && make install" and this crash no longer occurs.
Comment 3 Adriaan de Groot freebsd_committer 2018-04-10 09:41:09 UTC
So the upstream bug reaction is "yeah, whatevs".

I have never used qtcreator before, so the instructions to reproduce were slightly mystifying to me. Here's what I did:

 1) run qtcreator from command line
 2) click *projects* button, then *new project*
 3) select *qt quick application - empty* and click *choose*
 4) leave all project settings at default; click *next* four times and then *finish*
 5) a window appears, briefly, and then it cores out

Backtrace is basically the same as already reported:

(gdb) bt
#0  0x000000081c108d02 in QmlJS::Context::imports ()
   from /usr/local/lib/qtcreator/libQmlJS.so.4
#1  0x000000081c108db0 in QmlJS::Context::lookupType ()
   from /usr/local/lib/qtcreator/libQmlJS.so.4
#2  0x000000081c10930c in QmlJS::Context::lookupReference ()
   from /usr/local/lib/qtcreator/libQmlJS.so.4
#3  0x000000081c094758 in QmlJS::PrototypeIterator::hasNext ()
Comment 4 commit-hook freebsd_committer 2018-04-13 11:57:09 UTC
A commit references this bug:

Author: adridg
Date: Fri Apr 13 11:56:51 UTC 2018
New revision: 467236
URL: https://svnweb.freebsd.org/changeset/ports/467236

Log:
  Massage devel/qtcreator to not crash on opening files.

  The patch describes itself as a hack. It is.

  PR:		226224
  Reported by:	jt@ixsystems.com
  Approved by:	tcberner (mentor, implicit)

Changes:
  head/devel/qtcreator/Makefile
  head/devel/qtcreator/files/
  head/devel/qtcreator/files/patch-src_libs_qmljs_qmljscontext.cpp
Comment 5 Adriaan de Groot freebsd_committer 2018-04-13 12:04:54 UTC
I didn't want to dig much deeper than qmljscontext, but I suspect there's an underlying problem with memory management. During debug-by-printf I found that there were weird values for *this ending up in Context::imports() -- for objects that were never allocated. Inserting this silly qDebug() stops that.

qtcreator still hangs on exit, sometimes.

I'm hoping, actually, that this goes away by magic with the next version of qtcreator, in spite of upstream's "meh" attitude.
Comment 6 Raul Becker 2018-11-17 18:35:59 UTC
Just informing you that I tried to compile/build qtcreator 4.8 beta as a normal release version (no changes) and this bug has magically disappeared. QML(javascript) designer tool works without issues.
Comment 7 Tobias C. Berner freebsd_committer 2018-11-24 00:17:34 UTC
(In reply to Raul Becker from comment #6)
Thanks for following up on this. In this case I will close this now, and remove the patch with the next update.