[KPhotoAlbum] Crash when reducing number of pictures

[Robert Krawitz]

On 7/27/21 6:57 PM, Harald Barth wrote:
> Late night find:
> 
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  operator!= (s1=..., s1=..., s2=..., s2=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qsize.h:173
> 173	/usr/include/x86_64-linux-gnu/qt5/QtCore/qsize.h: No such file or directory.
> [Current thread is 1 (Thread 0x7f10174d4e40 (LWP 631874))]
> (gdb) bt
> #0  operator!= (s1=..., s1=..., s2=..., s2=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qsize.h:173
> #1  DB::ImageInfo::setSize (this=0x0, size=...) at ./DB/ImageInfo.cpp:461
> #2  0x000055d17939107a in ImageManager::ThumbnailBuilder::pixmapLoaded (this=0x55d179a3bee0, request=<optimized out>)
>     at ./ImageManager/ThumbnailBuilder.cpp:86

That might not be too easy to reproduce, since it looks like a timing window, but I can guess
roughly speaking what's going on here: the thumbnail builder has a list of images it's going through
building thumbnails for, but the image has gone away in the interim.  The code looks like this:

    DB::ImageInfoPtr info = DB::ImageDB::instance()->info(fileName);

    // We probably shouldn't do this at all, since the "full size"
    // of the request could be the size of the embedded thumbnail
    // or even a scaled-down such.  But if this hasn't been
    // set orrectly earlier, we have nothing else to go on.
    if (fullSize.width() != -1 && info->size().width() == -1) {
        info->setSize(fullSize);
    }

The obvious thing to do is check whether info is a null pointer.  Even that might not be good
enough, though, since there's still a race condition between the check and actually setting the size.

> #3  0x000055d1793846ff in ImageManager::AsyncLoader::customEvent (this=0x55d189aa9670, ev=<optimized out>)
>     at ./ImageManager/AsyncLoader.cpp:237
> #4  0x00007f1020021cf5 in QObject::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
> #5  0x00007f1020aeba66 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
> #6  0x00007f1020af50f0 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
> #7  0x00007f101fff593a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
> #8  0x00007f101fff85b8 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) ()
>    from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
> #9  0x00007f102004df67 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
> #10 0x00007f101de4d17d in g_main_context_dispatch () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
> #11 0x00007f101de4d400 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
> #12 0x00007f101de4d4a3 in g_main_context_iteration () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
> #13 0x00007f102004d565 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
>    from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
> #14 0x00007f101fff44db in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
> #15 0x00007f101fffc246 in QCoreApplication::exec() () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
> #16 0x000055d179256b74 in main (argc=<optimized out>, argv=<optimized out>) at ./main.cpp:132