[Kde-hardware-devel] ASSERT: "dev->backendObject()==0" in file /SVN/kdelibs/solid/solid/devicemanager.cpp, line 164

[Christian Esken]

Am Samstag, 17. November 2007 schrieb Christian Esken:
> Am Samstag, 17. November 2007 schrieb Kevin Ottens:
> > Le samedi 17 novembre 2007, Christian Esken a écrit :
> > > it is easily reproducable for me, as it happens frequently (nearly always).
> > > Just unplug and plug the USB sound stick. Depending on some magic, the hit
> > > rate is between 10% and 100%.
> > 
> > It's with kmix from trunk, right? I have a usb sound device, I'll try to 
> > reproduce.
> > 
> > > How can I do use the Fake backend? And how can I plug/uplug OSS devices
> > > from the Fake backend?
> > 
> > Using the SOLID_FAKEHW env variable, make it point to the fakecomputer.xml 
> > available in solid sources. Then using qdbus on your application you can 
> > simulate plug and unplug events.
> 
> Theoretically: Yes.
> Practically: No
> Explanation: KMix can not use the device list from Solid for building its internal list of devices. The main reason is that there is no support of the Solaris Sound System (according to the Solid AudioDriver enum). At the current state I would need to implement another Backend, e.g. Mixer_OSSFake or Mixer_ALSAFake. Due to time and effort this is currently not an option.
> 
> > > Unfortunately there is no backtrace, as the
> > > "Q_ASSERT(dev->backendObject()==0);" just makes the application exit.
> > 
> > Make it run from gdb.
> 
> This also produces no backtrace. I now added a breakpoint directly before the ASSERT to produce a backtrace, and found this:
> 
> (gdb) run --nofork --nocrashhandler
> [...]
> (gdb) b 164
> Breakpoint 4 at 0x2ab514f8546d: file /SVN/kdelibs/solid/solid/devicemanager.cpp, line 164.
> (gdb) c
> [...]
> (gdb) bt
> #0  Solid::DeviceManagerPrivate::_k_deviceAdded (this=0x730900, udi=@0x623320)
>     at /SVN/kdelibs/solid/solid/devicemanager.cpp:164
> #1  0x00002b4a7e04a5af in Solid::DeviceManagerPrivate::qt_metacall (this=0x730900, _c=QMetaObject::InvokeMetaMethod,
>     _id=0, _a=0x7fff3109a010) at /SVN/kdelibs/obj/solid/solid/devicemanager_p.moc:71
> #2  0x00002b4a7a231e1e in QMetaObject::activate () from /usr/lib64/libQtCore.so.4
> #3  0x00002b4a7e05d15f in Solid::Ifaces::DeviceManager::deviceAdded (this=0x730b30, _t1=@0x623320)
>     at /SVN/kdelibs/obj/solid/solid/ifaces/devicemanager.moc:78
> #4  0x00002b4a7e06a836 in Solid::Backends::Hal::HalManager::slotDeviceAdded (this=0x730b30, udi=@0x623320)
>     at /SVN/kdelibs/solid/solid/backends/hal/halmanager.cpp:191
> #5  0x00002b4a7e06a8a3 in Solid::Backends::Hal::HalManager::qt_metacall (this=0x730b30, _c=QMetaObject::InvokeMetaMethod,
>     _id=0, _a=0x7fff3109a2e0) at /SVN/kdelibs/obj/solid/solid/backends/hal/halmanager.moc:69
> #6  0x00002b4a7ed50f28 in QDBusConnectionPrivate::deliverCall () from /usr/lib64/libQtDBus.so.4
> #7  0x00002b4a7ed597af in ?? () from /usr/lib64/libQtDBus.so.4
> #8  0x00002b4a7a22ee88 in QObject::event () from /usr/lib64/libQtCore.so.4
> #9  0x00002b4a7f1715db in QApplicationPrivate::notify_helper () from /usr/lib64/libQtGui.so.4
> #10 0x00002b4a7f172bd5 in QApplication::notify () from /usr/lib64/libQtGui.so.4
> #11 0x00002b4a7b3f704a in KApplication::notify (this=0x61b830, receiver=0x730b30, event=0xacd550)
>     at /SVN/kdelibs/kdeui/kernel/kapplication.cpp:319
> #12 0x00002b4a7a220bc0 in QCoreApplication::notifyInternal () from /usr/lib64/libQtCore.so.4
> #13 0x00002b4a7a22200a in QCoreApplicationPrivate::sendPostedEvents () from /usr/lib64/libQtCore.so.4
> #14 0x00002b4a7a24045c in ?? () from /usr/lib64/libQtCore.so.4
> #15 0x00002b4a81232064 in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
> #16 0x00002b4a8123535d in ?? () from /usr/lib64/libglib-2.0.so.0
> #17 0x00002b4a8123582e in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
> #18 0x00002b4a7a240081 in QEventDispatcherGlib::processEvents () from /usr/lib64/libQtCore.so.4
> #19 0x00002b4a7f1e18df in QGuiEventDispatcherGlib::processEvents () from /usr/lib64/libQtGui.so.4
> #20 0x00002b4a7a220360 in QEventLoop::processEvents () from /usr/lib64/libQtCore.so.4
> #21 0x00002b4a7a22047d in QEventLoop::exec () from /usr/lib64/libQtCore.so.4
> #22 0x00002b4a7a222377 in QCoreApplication::exec () from /usr/lib64/libQtCore.so.4
> #23 0x00002b4a79c58345 in kdemain (argc=3, argv=0x7fff3109b088) at /SVN/kdemultimedia/kmix/main.cpp:69
> #24 0x00000000004009b3 in main (argc=3, argv=0x7fff3109b088) at /SVN/kdemultimedia/obj/kmix/kmix_dummy.cpp:3
> 
> (gdb) p *dev
> $3 = {<QObject> = {_vptr.QObject = 0x2ab5151d90b0, d_ptr = 0xbffa50}, <QSharedData> = {ref = {<QBasicAtomic> = {
>         value = 1}, <No data fields>}}, m_udi = {d = 0x70a320}, m_backendObject = {o = 0xb5c2c0}, m_ifaces = {{
>       d = 0x7b5610, e = 0x7b5610}}, m_refToSelf = {d = 0x7a7900}}
> (gdb) printq4string dev->m_udi
> /org/freedesktop/Hal/devices/usb_device_d8c_1_noserial_if0_sound_card_0_0_alsa_control__1
> (gdb) n
> ASSERT: "dev->backendObject()==0" in file /SVN/kdelibs/solid/solid/devicemanager.cpp, line 164
> 
> Program exited with code 01.
> (gdb) bt
> No stack.
> 
> Any ideas here? 
> 
> This is very interesting because the card "/org/freedesktop/Hal/devices/usb_device_d8c_1_noserial_if0_sound_card_0_0_alsa_control__1" was *not* plugged. It is a built-in PCI card. It is not very staggering to already find that in Solid's device map.

I ran Valgrind to find out what might be going wrong and found "Invalid read of size 8" inside Solid when *unplugging* the device. It looks to me like the device table is already corrupt on unplug.

==13757==
==13757== Invalid read of size 8
==13757==    at 0x9212ECC: QPointer<Solid::Ifaces::Device>::operator Solid::Ifaces::Device*() const (QPointer:73)
==13757==    by 0x9212EEA: Solid::DevicePrivate::backendObject() const (device_p.h:43)
==13757==    by 0x92143FA: Solid::DeviceManagerPrivate::_k_deviceRemoved(QString const&) (devicemanager.cpp:182)
==13757==    by 0x92145C7: Solid::DeviceManagerPrivate::qt_metacall(QMetaObject::Call, int, void**) (devicemanager_p.moc:72)
==13757==    by 0x5403E1D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQtCore.so.4.3.1)
==13757==    by 0x922711A: Solid::Ifaces::DeviceManager::deviceRemoved(QString const&) (devicemanager.moc:85)
==13757==    by 0x9234801: Solid::Backends::Hal::HalManager::slotDeviceRemoved(QString const&) (halmanager.cpp:197)
==13757==    by 0x92348BB: Solid::Backends::Hal::HalManager::qt_metacall(QMetaObject::Call, int, void**) (halmanager.moc:70)
==13757==    by 0x9F18F27: QDBusConnectionPrivate::deliverCall(QObject*, int, QDBusMessage const&, QList<int> const&, int) (in /usr/lib64/l
ibQtDBus.so.4.3.1)
==13757==    by 0x9F217AE: (within /usr/lib64/libQtDBus.so.4.3.1)
==13757==    by 0x5400E87: QObject::event(QEvent*) (in /usr/lib64/libQtCore.so.4.3.1)
==13757==    by 0xA3385DA: QApplicationPrivate::notify_helper(QObject*, QEvent*) (in /usr/lib64/libQtGui.so.4.3.1)
==13757==  Address 0xF47D950 is 32 bytes inside a block of size 56 free'd
==13757==    at 0x4C2162D: operator delete(void*) (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==13757==    by 0x9211EE4: Solid::DevicePrivate::~DevicePrivate() (device.cpp:245)
==13757==    by 0x9213743: QExplicitlySharedDataPointer<Solid::DevicePrivate>::operator=(Solid::DevicePrivate*) (QSharedData:158)
==13757==    by 0x9211DB3: Solid::DevicePrivate::setBackendObject(Solid::Ifaces::Device*) (device.cpp:269)
==13757==    by 0x9211DD9: Solid::DevicePrivate::_k_destroyed(QObject*) (device.cpp:250)
==13757==    by 0x9211E3B: Solid::DevicePrivate::qt_metacall(QMetaObject::Call, int, void**) (device_p.moc:67)
==13757==    by 0x5403E1D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQtCore.so.4.3.1)
==13757==    by 0x5404153: QObject::destroyed(QObject*) (in /usr/lib64/libQtCore.so.4.3.1)
==13757==    by 0x5404686: QObject::~QObject() (in /usr/lib64/libQtCore.so.4.3.1)
==13757==    by 0x9226FCA: Solid::Ifaces::Device::~Device() (device.cpp:31)
==13757==    by 0x92311CC: Solid::Backends::Hal::HalDevice::~HalDevice() (haldevice.cpp:105)

Also (but probably harmless):
==13757== 576 bytes in 36 blocks are definitely lost in loss record 440 of 687
==13757==    at 0x4C22515: operator new(unsigned long) (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==13757==    by 0x921E128: Solid::AudioInterface::AudioInterface(QObject*) (audiointerface.cpp:29)
==13757==    by 0x9212612: Solid::Device::asDeviceInterface(Solid::DeviceInterface::Type const&) const (device.cpp:205)
==13757==    by 0x92126CE: Solid::Device::asDeviceInterface(Solid::DeviceInterface::Type const&) (device.cpp:140)
==13757==    by 0x4E7DFF4: Solid::AudioInterface* Solid::Device::as<Solid::AudioInterface>() (device.h:217)
==13757==    by 0x4E7D00B: KMixDeviceManager::pluggedSlot(QString const&) (kmixdevicemanager.cpp:127)
==13757==    by 0x4E7D3FE: KMixDeviceManager::qt_metacall(QMetaObject::Call, int, void**) (kmixdevicemanager.moc:74)
==13757==    by 0x5403E1D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQtCore.so.4.3.1)
==13757==    by 0x9214058: Solid::DeviceNotifier::deviceAdded(QString const&) (devicenotifier.moc:78)
==13757==    by 0x92144E8: Solid::DeviceManagerPrivate::_k_deviceAdded(QString const&) (devicemanager.cpp:169)
==13757==    by 0x92145AE: Solid::DeviceManagerPrivate::qt_metacall(QMetaObject::Call, int, void**) (devicemanager_p.moc:71)
==13757==    by 0x5403E1D: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib64/libQtCore.so.4.3.1)

I don't delete the pointer returned by Solid::Device::as<Solid::AudioInterface>(), but should I at all? Anyhow, this is just a minor leak.