[Kde-perl] reproducible core dump in Qt::Table

[Marc Horowitz]

System: Debian/x86

Package versions:

ii  libperl5.8     5.8.3-2        Shared Perl library.
ii  libqt-perl     3.008-1        Perl bindings for the Qt library

The simplest way to reproduce this is to use pqtsh.  When I run the
following commands:

    use Qt::attributes qw(table);
    table = Qt::Table();
    table->show;
    table->setNumRows(1);
    table->setNumCols(1);
    table->setText(0,0,"hello");
    table->removeRow(0);

the final command causes a segmentation fault.  valgrind strongly
indicates that this is a double-free bug (logs appended).
Interestingly, if I keep running (which is possible only under
valgrind), I don't see the problem again.

Is there any other way for me to remove rows from a table using
PerlQt?

                Marc

==3863== 
==3863== Invalid read of size 4
==3863==    at 0x4241AD66: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x42427235: QTable::restoreContents(QPtrVector<QTableItem>&, QPtrVector<QTable::TableWidget>&) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x424277C8: QTable::setNumRows(int) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x435D9D51: x_QTable::setNumRows(int) (in /u1/usr/lib/libsmokeqt.so.1.2.1)
==3863==  Address 0x41AEAB10 is 4 bytes inside a block of size 60 free'd
==3863==    at 0x4002D466: operator delete(void*) (vg_replace_malloc.c:188)
==3863==    by 0x4241AD97: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x435C4029: xcall_QTableItem(short, void*, Smoke::StackItem*) (in /u1/usr/lib/libsmokeqt.so.1.2.1)
==3863==    by 0x41F26F31: smokeperl_free(interpreter*, sv*, magic*) (in /u1/usr/lib/perl5/auto/Qt/Qt.so)
==3863== 
==3863== Invalid read of size 4
==3863==    at 0x4241AD69: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x42427235: QTable::restoreContents(QPtrVector<QTableItem>&, QPtrVector<QTable::TableWidget>&) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x424277C8: QTable::setNumRows(int) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x435D9D51: x_QTable::setNumRows(int) (in /u1/usr/lib/libsmokeqt.so.1.2.1)
==3863==  Address 0x449EDC4C is 0 bytes inside a block of size 20 free'd
==3863==    at 0x4002D466: operator delete(void*) (vg_replace_malloc.c:188)
==3863==    by 0x424D20A3: QStringData::deleteSelf() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x4241AD83: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x435C4029: xcall_QTableItem(short, void*, Smoke::StackItem*) (in /u1/usr/lib/libsmokeqt.so.1.2.1)
==3863== 
==3863== Invalid write of size 4
==3863==    at 0x4241AD6C: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x42427235: QTable::restoreContents(QPtrVector<QTableItem>&, QPtrVector<QTable::TableWidget>&) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x424277C8: QTable::setNumRows(int) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x435D9D51: x_QTable::setNumRows(int) (in /u1/usr/lib/libsmokeqt.so.1.2.1)
==3863==  Address 0x449EDC4C is 0 bytes inside a block of size 20 free'd
==3863==    at 0x4002D466: operator delete(void*) (vg_replace_malloc.c:188)
==3863==    by 0x424D20A3: QStringData::deleteSelf() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x4241AD83: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x435C4029: xcall_QTableItem(short, void*, Smoke::StackItem*) (in /u1/usr/lib/libsmokeqt.so.1.2.1)
==3863== 
==3863== Invalid free() / delete / delete[]
==3863==    at 0x4002D466: operator delete(void*) (vg_replace_malloc.c:188)
==3863==    by 0x4241AD97: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x42427235: QTable::restoreContents(QPtrVector<QTableItem>&, QPtrVector<QTable::TableWidget>&) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x424277C8: QTable::setNumRows(int) (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==  Address 0x41AEAB0C is 0 bytes inside a block of size 60 free'd
==3863==    at 0x4002D466: operator delete(void*) (vg_replace_malloc.c:188)
==3863==    by 0x4241AD97: QTableItem::~QTableItem() (in /u1/usr/lib/libqt-mt.so.3.2.3)
==3863==    by 0x435C4029: xcall_QTableItem(short, void*, Smoke::StackItem*) (in /u1/usr/lib/libsmokeqt.so.1.2.1)
==3863==    by 0x41F26F31: smokeperl_free(interpreter*, sv*, magic*) (in /u1/usr/lib/perl5/auto/Qt/Qt.so)