A crash in QGraphicsScenePrivate::draw()

[platon]

Did somebody encountered such kind of crash:

Thread 1 (LWP 1380):
#0  0x740b70c4 in raise () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/lib/libc.so.0
#1  0x740b0754 in abort () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/lib/libc.so.0
#2  0x742b9f8c in signal_handler () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/usr/lib/libdirect-1.4.so.15
#3  <signal handler called>
#4  0x75db7edc in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#5  0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#6  0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#7  0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#8  0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#9  0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#10 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#11 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#12 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#13 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#14 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#15 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#16 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#17 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#18 0x75dba5e8 in QGraphicsScenePrivate::drawItems(QPainter*, QTransform const*, QRegion*, QWidget*) ()
#19 0x75ddb8fc in QGraphicsView::paintEvent(QPaintEvent*) ()
#20 0x7584f220 in QWidget::event(QEvent*) () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/usr/lib/libQtGui.so.4
#21 0x75bd0da8 in QFrame::event(QEvent*) () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/usr/lib/libQtGui.so.4
#22 0x75ddda24 in QGraphicsView::viewportEvent(QEvent*) ()

Thread 1 (LWP 1380):
#0  0x740b70c4 in raise () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/lib/libc.so.0
#1  0x740b0754 in abort () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/lib/libc.so.0
#2  0x742b9f8c in signal_handler () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/usr/lib/libdirect-1.4.so.15
#3  <signal handler called>
#4  0x75db7edc in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#5  0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#6  0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#7  0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#8  0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#9  0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#10 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#11 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#12 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#13 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#14 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#15 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#16 0x75db7ed4 in QGraphicsScenePrivate::draw(QGraphicsItem*, QPainter*, QTransform const*, QTransform const*, QRegion*, QWidget*, float, QTransform const*, bool, bool) ()
#17 0x75db9db8 in QGraphicsScenePrivate::drawSubtreeRecursive(QGraphicsItem*, QPainter*, QTransform const*, QRegion*, QWidget*, float, QTransform const*) ()
#18 0x75dba5e8 in QGraphicsScenePrivate::drawItems(QPainter*, QTransform const*, QRegion*, QWidget*) ()
#19 0x75ddb8fc in QGraphicsView::paintEvent(QPaintEvent*) ()
#20 0x7584f220 in QWidget::event(QEvent*) () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/usr/lib/libQtGui.so.4
#21 0x75bd0da8 in QFrame::event(QEvent*) () from /home/work/Projects/unistack/repository/unistack-output/pil_packages/p-broadcomnexus-bcm7428/staging_dir/usr/lib/libQtGui.so.4
#22 0x75ddda24 in QGraphicsView::viewportEvent(QEvent*) ()

To copy to clipboard, switch view to plain text mode 

It seems the crash happens when webkit for some reason removes QGraphicsItem in GraphicsLayerQtImpl::~GraphicsLayerQtImpl() while this item is being drawn in QGraphicsScenePrivate::draw().

[wysota]

Show your code.

[platon]

I'm just using QGraphicsWebView for rendering web content

class WebView : public QGraphicsWebView

class WebView : public QGraphicsWebView

To copy to clipboard, switch view to plain text mode 

WebView *Application::newBrowserWindow()
{
    WebView *browser = new WebView();
    browser->setGeometry( geometry );
    scene->addItem( browser );
    browser->show();
    return browser;
}

WebView *Application::newBrowserWindow()
{
    WebView *browser = new WebView();
    browser->setGeometry( geometry );
    scene->addItem( browser );
    browser->show();
    return browser;
}

To copy to clipboard, switch view to plain text mode 

WebView *view = newBrowserWindow();
view->load( uri );

WebView *view = newBrowserWindow();
view->load( uri );

To copy to clipboard, switch view to plain text mode 

[wysota]

Is that the whole code needed to reproduce the problem?

[platon]

No, but the main actions are in this code.
The whole code is executed on embedded system and Qt draws using DirectFB plugin. So I believe it's hard to reproduce it on your side.

Today I found out that the crash disappears when I disable QWebSettings::AcceleratedCompositingEnabled option.
Before while digging in Qt code I notices that the place of code which caused the crash was under #if USE(ACCELERATED_COMPOSITING) define.
It seems this option enables some sophisticated drawing algorithms with caching.

I suppose this crash is some synchronization issue because it happens after some particular page is rendered n times (it may be 5th or 20th time).

As I said previously I managed to find the situation after which crash happens.
I added custom property to QGraphicsItem. I set it when the program enters QGraphicsScenePrivate::draw(QGraphicsItem *item, ...) and reset when the program leaves this method.
I check this property in GraphicsLayerQtImpl::~GraphicsLayerQtImpl(). When the property is set (item is being drawn) the crash happens.

[wysota]

What do you need this property for?

[platon]

Only for testing. Just to detect the situation when the crash happens.
Actually not a property but just custom data set by QGraphicsItem::setData(). it seemed to me a good approach.

[wysota]

What you experience is not really a crash, you can see there is some UNIX signal emitted that causes libdirect to abort. I would assume your framebuffer implementation is incomplete and indeed some optimised code path causes it to malfunction.

Or you are using threads incorrectly... Do you have multiple threads in your app?

[platon]

What you experience is not really a crash, you can see there is some UNIX signal emitted that causes libdirect to abort.

I called it a crash because the signal is SEGFAULT:

(!) [ 1389: 1349881576.870] --> Caught signal 11 (at 0x40, invalid address) <--

(!) [ 1389: 1349881576.870] --> Caught signal 11 (at 0x40, invalid address) <--

To copy to clipboard, switch view to plain text mode 

I would assume your framebuffer implementation is incomplete and indeed some optimised code path causes it to malfunction.

Yes, this seems to be true.

Or you are using threads incorrectly... Do you have multiple threads in your app?

In core dump I can see only a single browser thread... Nevertheless I will double check the code to be sure.
Thanks for your hints.

[platon]

Finally I came to the following solution (workaround):

--- RenderLayer.cpp.org>2011-12-08 07:06:03.000000000 +0200                                                                                                                             
+++ RenderLayer.cpp>2012-10-16 17:03:18.313964345 +0300                                                                                                                                 
@@ -3874,7 +3874,7 @@                                                                                                                                                                   
 #if USE(ACCELERATED_COMPOSITING)                                                                                                                                                       
     if (compositor()->inCompositingMode()) {                                                                                                                                           
         if ((isStackingContext() && m_zOrderListsDirty) || m_normalFlowListDirty)                                                                                                      
-            compositor()->updateCompositingLayers(CompositingUpdateOnPaitingOrHitTest, this);                                                                                          
+//            compositor()->updateCompositingLayers(CompositingUpdateOnPaitingOrHitTest, this);                                                                                        
         return;                                                                                                                                                                        
     }                                                                                                                                                                                  
 #endif

--- RenderLayer.cpp.org>2011-12-08 07:06:03.000000000 +0200                                                                                                                             
+++ RenderLayer.cpp>2012-10-16 17:03:18.313964345 +0300                                                                                                                                 
@@ -3874,7 +3874,7 @@                                                                                                                                                                   
 #if USE(ACCELERATED_COMPOSITING)                                                                                                                                                       
     if (compositor()->inCompositingMode()) {                                                                                                                                           
         if ((isStackingContext() && m_zOrderListsDirty) || m_normalFlowListDirty)                                                                                                      
-            compositor()->updateCompositingLayers(CompositingUpdateOnPaitingOrHitTest, this);                                                                                          
+//            compositor()->updateCompositingLayers(CompositingUpdateOnPaitingOrHitTest, this);                                                                                        
         return;                                                                                                                                                                        
     }                                                                                                                                                                                  
 #endif

To copy to clipboard, switch view to plain text mode