Skip to content

lspclient: fix possible use-after-free

Georg Gadinger requested to merge ggadinger/kate:fix-rare-crash into master

This hopefully fixes a rare crash I had only once:

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x000000000022007d
Exception Codes:       0x0000000000000001, 0x000000000022007d
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    Namespace SIGNAL, Code 11 Segmentation fault: 11
Terminating Process:   exc handler [95698]

VM Region Info: 0x22007d is not in any region.  Bytes before following region: 4294934403
      REGION TYPE                    START - END         [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                      100218000-10036c000    [ 1360K] r-x/r-x SM=COW  ...ts/MacOS/kate

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   QtGui                         	       0x105383230 QIcon::pixmap(QWindow*, QSize const&, QIcon::Mode, QIcon::State) const + 428
1   QtGui                         	       0x10538322c QIcon::pixmap(QWindow*, QSize const&, QIcon::Mode, QIcon::State) const + 424
2   lspclientplugin.so            	       0x12d7ab788 Utils::colorIcon(QIcon const&, QColor const&, QSize) + 68 (drawing_utils.h:18)
3   lspclientplugin.so            	       0x12d7aa7e4 CompletionIcons::colorIcons(KTextEditor::Editor*) + 128 (lspclientcompletion.cpp:152)
4   lspclientplugin.so            	       0x12d7ab4bc CompletionIcons::CompletionIcons()::'lambda'(KTextEditor::Editor*)::operator()(KTextEditor::Editor*) const + 36 (lspclientcompletion.cpp:113)
5   lspclientplugin.so            	       0x12d7ab47c QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<KTextEditor::Editor*>, void, CompletionIcons::CompletionIcons()::'lambda'(KTextEditor::Editor*)>::call(CompletionIcons::CompletionIcons()::'lambda'(KTextEditor::Editor*)&, void**) + 40 (qobjectdefs_impl.h:146)
6   lspclientplugin.so            	       0x12d7ab408 void QtPrivate::Functor<CompletionIcons::CompletionIcons()::'lambda'(KTextEditor::Editor*), 1>::call<QtPrivate::List<KTextEditor::Editor*>, void>(CompletionIcons::CompletionIcons()::'lambda'(KTextEditor::Editor*)&, void*, void**) + 36 (qobjectdefs_impl.h:256)
7   lspclientplugin.so            	       0x12d7ab36c QtPrivate::QFunctorSlotObject<CompletionIcons::CompletionIcons()::'lambda'(KTextEditor::Editor*), 1, QtPrivate::List<KTextEditor::Editor*>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) + 128 (qobjectdefs_impl.h:443)
8   QtCore                        	       0x106021bc8 0x105e1c000 + 2120648
9   libKF5TextEditor.5.92.0.dylib 	       0x10186cbd0 KTextEditor::Editor::configChanged(KTextEditor::Editor*) + 96 (moc_editor.cpp:192)
10  libKF5TextEditor.5.92.0.dylib 	       0x101afea70 KTextEditor::EditorPrivate::emitConfigChanged() + 48 (kateglobal.cpp:509)
11  libKF5TextEditor.5.92.0.dylib 	       0x101b032a0 QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (KTextEditor::EditorPrivate::*)()>::call(void (KTextEditor::EditorPrivate::*)(), KTextEditor::EditorPrivate*, void**) + 120 (qobjectdefs_impl.h:152)
12  libKF5TextEditor.5.92.0.dylib 	       0x101b031f0 void QtPrivate::FunctionPointer<void (KTextEditor::EditorPrivate::*)()>::call<QtPrivate::List<>, void>(void (KTextEditor::EditorPrivate::*)(), KTextEditor::EditorPrivate*, void**) + 80 (qobjectdefs_impl.h:185)
13  libKF5TextEditor.5.92.0.dylib 	       0x101b030fc QtPrivate::QSlotObject<void (KTextEditor::EditorPrivate::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) + 148 (qobjectdefs_impl.h:418)
14  QtCore                        	       0x106019ee4 QObject::event(QEvent*) + 596
15  QtWidgets                     	       0x1047d271c QApplicationPrivate::notify_helper(QObject*, QEvent*) + 292
16  QtWidgets                     	       0x1047d3ab4 QApplication::notify(QObject*, QEvent*) + 548
17  QtCore                        	       0x105ff1924 QCoreApplication::notifyInternal2(QObject*, QEvent*) + 208
18  QtCore                        	       0x105ff2be4 QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) + 864
19  libqcocoa.dylib               	       0x105a427d8 0x105a0c000 + 223192
20  libqcocoa.dylib               	       0x105a42e98 0x105a0c000 + 224920
21  CoreFoundation                	       0x1b155cc5c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28
22  CoreFoundation                	       0x1b155cba8 __CFRunLoopDoSource0 + 208
23  CoreFoundation                	       0x1b155c900 __CFRunLoopDoSources0 + 376
24  CoreFoundation                	       0x1b155b208 __CFRunLoopRun + 820
25  CoreFoundation                	       0x1b155a734 CFRunLoopRunSpecific + 600
26  HIToolbox                     	       0x1ba0f2f68 RunCurrentEventLoopInMode + 292
27  HIToolbox                     	       0x1ba0f2cdc ReceiveNextEventCommon + 552
28  HIToolbox                     	       0x1ba0f2a9c _BlockUntilNextEventMatchingListInModeWithFilter + 72
29  AppKit                        	       0x1b40b1000 _DPSNextEvent + 844
30  AppKit                        	       0x1b40af8a4 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1332
31  AppKit                        	       0x1b40a19b4 -[NSApplication run] + 596
32  libqcocoa.dylib               	       0x105a41cac 0x105a0c000 + 220332
33  QtCore                        	       0x105feda08 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) + 524
34  QtCore                        	       0x105ff1f50 QCoreApplication::exec() + 132
35  kate                          	       0x100226b10 main + 10312 (main.cpp:706)
36  dyld                          	       0x100a010f4 start + 520

it also seems to be similar to what the address sanitiser check discovered in !652 (closed):

==3944==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000461af0 at pc 0x7fc85e5a449c bp 0x7fff57f1c2d0 sp 0x7fff57f1c2c8
READ of size 8 at 0x610000461af0 thread T0
    #0 0x7fc85e5a449b in std::enable_if<std::__and_<std::__not_<std::__is_tuple_like<QIconPrivate*> >, std::is_move_constructible<QIconPrivate*>, std::is_move_assignable<QIconPrivate*> >::value, void>::type std::swap<QIconPrivate*>(QIconPrivate*&, QIconPrivate*&) /usr/include/c++/11/bits/move.h:204
    #1 0x7fc85e59fa5b in void qSwap<QIconPrivate*>(QIconPrivate*&, QIconPrivate*&) /usr/include/qt5/QtCore/qglobal.h:977
    #2 0x7fc85e593530 in QIcon::swap(QIcon&) /usr/include/qt5/QtGui/qicon.h:74
    #3 0x7fc85e5934e2 in QIcon::operator=(QIcon&&) /usr/include/qt5/QtGui/qicon.h:72
    #4 0x7fc85e59714a in CompletionIcons::colorIcons(KTextEditor::Editor*) (/builds/marcosgtavares/kate/_install/lib64/plugins/ktexteditor/lspclientplugin.so+0x39c14a)
    #5 0x7fc85e595e14 in CompletionIcons::CompletionIcons()::{lambda(KTextEditor::Editor*)#6}::operator()(KTextEditor::Editor*) const (/builds/marcosgtavares/kate/_install/lib64/plugins/ktexteditor/lspclientplugin.so+0x39ae14)
    #6 0x7fc85e5b7426 in QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<KTextEditor::Editor*>, void, CompletionIcons::CompletionIcons()::{lambda(KTextEditor::Editor*)#6}>::call(CompletionIcons::CompletionIcons()::{lambda(KTextEditor::Editor*)#6}&, void**) (/builds/marcosgtavares/kate/_install/lib64/plugins/ktexteditor/lspclientplugin.so+0x3bc426)
    #7 0x7fc85e5af34d in void QtPrivate::Functor<CompletionIcons::CompletionIcons()::{lambda(KTextEditor::Editor*)#6}, 1>::call<QtPrivate::List<KTextEditor::Editor*>, void>(CompletionIcons::CompletionIcons()::{lambda(KTextEditor::Editor*)#6}&, void*, void**) (/builds/marcosgtavares/kate/_install/lib64/plugins/ktexteditor/lspclientplugin.so+0x3b434d)
    #8 0x7fc85e5aa41e in QtPrivate::QFunctorSlotObject<CompletionIcons::CompletionIcons()::{lambda(KTextEditor::Editor*)#6}, 1, QtPrivate::List<KTextEditor::Editor*>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (/builds/marcosgtavares/kate/_install/lib64/plugins/ktexteditor/lspclientplugin.so+0x3af41e)
    #9 0x7fc86e26a502  (/lib64/libQt5Core.so.5+0x311502)
    #10 0x7fc87aa4f666 in KTextEditor::Editor::configChanged(KTextEditor::Editor*) /builds/frameworks/ktexteditor/_build/src/KF5TextEditor_autogen/OGSBNZGFXN/moc_editor.cpp:192
    #11 0x7fc87b2c6fad in KTextEditor::EditorPrivate::emitConfigChanged() /builds/frameworks/ktexteditor/src/utils/kateglobal.cpp:509
    #12 0x7fc87b2d493a in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (KTextEditor::EditorPrivate::*)()>::call(void (KTextEditor::EditorPrivate::*)(), KTextEditor::EditorPrivate*, void**) /usr/include/qt5/QtCore/qobjectdefs_impl.h:152
    #13 0x7fc87b2d46aa in void QtPrivate::FunctionPointer<void (KTextEditor::EditorPrivate::*)()>::call<QtPrivate::List<>, void>(void (KTextEditor::EditorPrivate::*)(), KTextEditor::EditorPrivate*, void**) /usr/include/qt5/QtCore/qobjectdefs_impl.h:185
    #14 0x7fc87b2d4071 in QtPrivate::QSlotObject<void (KTextEditor::EditorPrivate::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/qt5/QtCore/qobjectdefs_impl.h:418
    #15 0x7fc86e2604ad in QObject::event(QEvent*) (/lib64/libQt5Core.so.5+0x3074ad)
    #16 0x7fc86f13ca7e in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib64/libQt5Widgets.so.5+0x1a5a7e)
    #17 0x7fc86e233e39 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/lib64/libQt5Core.so.5+0x2dae39)
    #18 0x7fc86e236e76 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/lib64/libQt5Core.so.5+0x2dde76)
    #19 0x7fc86e28bd02  (/lib64/libQt5Core.so.5+0x332d02)
    #20 0x7fc86b526e21 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x56e21)
    #21 0x7fc86b5271b7  (/lib64/libglib-2.0.so.0+0x571b7)
    #22 0x7fc86b52726e in g_main_context_iteration (/lib64/libglib-2.0.so.0+0x5726e)
    #23 0x7fc86e28b383 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x332383)
    #24 0x7fc86e23283a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2d983a)
    #25 0x7fc87037fbb1 in KJob::exec() /builds/frameworks/kcoreaddons/src/lib/jobs/kjob.cpp:195
    #26 0x4bc6d8 in KateSessionManager::renameSession(QExplicitlySharedDataPointer<KateSession>, QString const&) /builds/marcosgtavares/kate/kate/session/katesessionmanager.cpp:307
    #27 0x44f072 in KateSessionManagerTest::renameSession() /builds/marcosgtavares/kate/kate/autotests/session_manager_test.cpp:125
    #28 0x441684 in KateSessionManagerTest::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /builds/marcosgtavares/kate/_build/kate/autotests/session_manager_test_autogen/EWIEGA46WW/moc_session_manager_test.cpp:126
    #29 0x7fc86e23ef0a in QMetaMethod::invoke(QObject*, Qt::ConnectionType, QGenericReturnArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) const (/lib64/libQt5Core.so.5+0x2e5f0a)
    #30 0x7fc87d0bb572  (/lib64/libQt5Test.so.5+0x1d572)
    #31 0x7fc87d0bbfea  (/lib64/libQt5Test.so.5+0x1dfea)
    #32 0x7fc87d0bc530  (/lib64/libQt5Test.so.5+0x1e530)
    #33 0x7fc87d0bca03 in QTest::qRun() (/lib64/libQt5Test.so.5+0x1ea03)
    #34 0x7fc87d0bcdcb in QTest::qExec(QObject*, int, char**) (/lib64/libQt5Test.so.5+0x1edcb)
    #35 0x44a29a in main /builds/marcosgtavares/kate/kate/autotests/session_manager_test.cpp:19
    #36 0x7fc86da4d62f in __libc_start_call_main (/lib64/libc.so.6+0x4062f)
    #37 0x7fc86da4d6ef in __libc_start_main_alias_1 (/lib64/libc.so.6+0x406ef)
    #38 0x441374 in _start (/builds/marcosgtavares/kate/_build/bin/session_manager_test+0x441374)

cc @waqar

Edited by Georg Gadinger

Merge request reports