Sanitizer: heap-use-after-free on address 0x6110003bda28
I think if you try to render with track effects hidden this happens:
Project: video-extra.kdenlive Full: sanitizer.txt
================================================================= ==32652==ERROR: AddressSanitizer: at pc 0x560ae82c96fb bp 0x7ffee3babb30 sp 0x7ffee3babb28 READ of size 1 at 0x6110003bda28 thread T0 #0 0x560ae82c96fa in TimelineController::setModel(std::shared_ptr)::$_1::operator()(int) const /home/farid/kdenlive/src/timeline2/view/timelinecontroller.cpp:109:13 #1 0x560ae82c93a7 in QtPrivate::FunctorCall, QtPrivate::List, void, TimelineController::setModel(std::shared_ptr)::$_1>::call(TimelineController::setModel(std::shared_ptr)::$_1&, void**) /usr/include/qt/QtCore/qobjectdefs_impl.h:146:13 #2 0x560ae82c9220 in void QtPrivate::Functor)::$_1, 1>::call, void>(TimelineController::setModel(std::shared_ptr)::$_1&, void*, void**) /usr/include/qt/QtCore/qobjectdefs_impl.h:256:13 #3 0x560ae82c91cb in QtPrivate::QFunctorSlotObject)::$_1, 1, QtPrivate::List, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/qt/QtCore/qobjectdefs_impl.h:443:17 #4 0x7f1ca1727905 (/usr/lib/libQt5Core.so.5+0x2e9905) #5 0x560ae712c2d7 in TimelineModel::checkItemDeletion(int) /home/farid/kdenlive/build/src/kdenliveLib_autogen/GGT3SG7UAR/moc_timelinemodel.cpp:551:5 #6 0x560ae808be1a in TimelineModel::deregisterClip_lambda(int)::$_137::operator()() const /home/farid/kdenlive/src/timeline2/model/timelinemodel.cpp:2702:14 #7 0x560ae808bc0c in bool std::__invoke_impl(std::__invoke_other, TimelineModel::deregisterClip_lambda(int)::$_137&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/invoke.h:60:14 #8 0x560ae808bbac in std::enable_if<__and_ >, std::is_convertible::type, bool> >::value, bool>::type std::__invoke_r(TimelineModel::deregisterClip_lambda(int)::$_137&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/invoke.h:141:14 #9 0x560ae808ba5c in std::_Function_handler::_M_invoke(std::_Any_data const&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/std_function.h:291:9 #10 0x560ae71be000 in std::function::operator()() const /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/std_function.h:622:14 #11 0x560ae7fddd2d in TimelineModel::requestClipDeletion(int, std::function&, std::function&) /home/farid/kdenlive/src/timeline2/model/timelinemodel.cpp:1345:9 #12 0x560ae7fdc372 in TimelineModel::requestItemDeletion(int, std::function&, std::function&) /home/farid/kdenlive/src/timeline2/model/timelinemodel.cpp:1293:16 #13 0x560ae75bb350 in ProjectClip::selfSoftDelete(std::function&, std::function&) /home/farid/kdenlive/src/bin/projectclip.cpp:1465:23 #14 0x560ae745bce7 in AbstractProjectItem::selfSoftDelete(std::function&, std::function&) /home/farid/kdenlive/src/bin/abstractprojectitem.cpp:289:74 #15 0x560ae76143ab in ProjectItemModel::requestBinClipDeletion(std::shared_ptr const&, std::function&, std::function&) /home/farid/kdenlive/src/bin/projectitemmodel.cpp:573:11 #16 0x560ae7613891 in ProjectItemModel::clean() /home/farid/kdenlive/src/bin/projectitemmodel.cpp:488:9 #17 0x560ae747f7ed in Bin::~Bin() /home/farid/kdenlive/src/bin/bin.cpp:1194:18 #18 0x560ae747ff5b in Bin::~Bin() /home/farid/kdenlive/src/bin/bin.cpp:1187:1 #19 0x7f1ca171ac3d in QObjectPrivate::deleteChildren() (/usr/lib/libQt5Core.so.5+0x2dcc3d) #20 0x7f1ca5bda1dd in QWidget::~QWidget() (/usr/lib/libQt5Widgets.so.5+0x1991dd) #21 0x7f1ca5cbadd9 in QDockWidget::~QDockWidget() (/usr/lib/libQt5Widgets.so.5+0x279dd9) #22 0x7f1ca171ac3d in QObjectPrivate::deleteChildren() (/usr/lib/libQt5Core.so.5+0x2dcc3d) #23 0x7f1ca5bda1dd in QWidget::~QWidget() (/usr/lib/libQt5Widgets.so.5+0x1991dd) #24 0x560ae85e025c in MainWindow::~MainWindow() /home/farid/kdenlive/src/mainwindow.cpp:845:1 #25 0x560ae85e0292 in MainWindow::~MainWindow() /home/farid/kdenlive/src/mainwindow.cpp:827:1 #26 0x560ae85e03ab in MainWindow::~MainWindow() /home/farid/kdenlive/src/mainwindow.cpp:827:1 #27 0x7f1ca171ce6f in QObject::event(QEvent*) (/usr/lib/libQt5Core.so.5+0x2dee6f) #28 0x7f1ca702eb29 in KXmlGuiWindow::event(QEvent*) (/usr/lib/libKF5XmlGui.so.5+0x91b29) #29 0x7f1ca5b9d701 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/libQt5Widgets.so.5+0x15c701) #30 0x7f1ca16f0699 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/libQt5Core.so.5+0x2b2699) #31 0x7f1ca16f3182 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/libQt5Core.so.5+0x2b5182) #32 0x7f1ca16f74bc in QCoreApplication::exec() (/usr/lib/libQt5Core.so.5+0x2b94bc) #33 0x560ae706ecc4 in main /home/farid/kdenlive/src/main.cpp:266:18 #34 0x7f1ca0f23001 in __libc_start_main (/usr/lib/libc.so.6+0x27001) #35 0x560ae6f8dcbd in _start (/usr/bin/kdenlive+0x364cbd) 0x6110003bda28 is located 168 bytes inside of 216-byte region [0x6110003bd980,0x6110003bda58) freed by thread T0 here: #0 0x560ae7066ca9 in operator delete(void*) (/usr/bin/kdenlive+0x43dca9) #1 0x560ae8273357 in TimelineController::~TimelineController() /home/farid/kdenlive/src/timeline2/view/timelinecontroller.cpp:86:1 #2 0x560ae830a828 in TimelineWidget::~TimelineWidget() /home/farid/kdenlive/src/timeline2/view/timelinewidget.cpp:82:5 #3 0x560ae830a89b in TimelineWidget::~TimelineWidget() /home/farid/kdenlive/src/timeline2/view/timelinewidget.cpp:81:1 #4 0x7f1ca171ac3d in QObjectPrivate::deleteChildren() (/usr/lib/libQt5Core.so.5+0x2dcc3d) previously allocated by thread T0 here: #0 0x560ae7066289 in operator new(unsigned long) (/usr/bin/kdenlive+0x43d289) #1 0x560ae8309b80 in TimelineWidget::TimelineWidget(QWidget*) /home/farid/kdenlive/src/timeline2/view/timelinewidget.cpp:66:15 #2 0x560ae82fa2de in TimelineTabs::TimelineTabs(QWidget*) /home/farid/kdenlive/src/timeline2/view/timelinetabs.cpp:44:26 #3 0x560ae8592e7e in MainWindow::init() /home/farid/kdenlive/src/mainwindow.cpp:298:26 #4 0x560ae8503139 in Core::initGUI(QUrl const&, QString const&) /home/farid/kdenlive/src/core.cpp:203:19 #5 0x560ae706ecbf in main /home/farid/kdenlive/src/main.cpp:265:12 #6 0x7f1ca0f23001 in __libc_start_main (/usr/lib/libc.so.6+0x27001) SUMMARY: AddressSanitizer: heap-use-after-free /home/farid/kdenlive/src/timeline2/view/timelinecontroller.cpp:109:13 in TimelineController::setModel(std::shared_ptr)::$_1::operator()(int) const Shadow bytes around the buggy address: 0x0c228006faf0: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c228006fb00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c228006fb10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c228006fb20: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c228006fb30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c228006fb40: fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa fa 0x0c228006fb50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c228006fb60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c228006fb70: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa 0x0c228006fb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c228006fb90: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==32652==ABORTING
Edited by Farid Abdelnour