qt: use-after-free related to medialib
On master
(currently a6afae08) on exit:
/usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:418:94: runtime error: downcast of address 0x60e0000b4fa0 which does not point to an object of type 'MediaLib'
0x60e0000b4fa0: note: object is of type 'QObject'
09 00 00 00 e0 1e 7c 02 91 7f 00 00 20 26 07 00 80 60 00 00 40 4a 01 00 c0 60 00 00 01 00 be be
^~~~~~~~~~~~~~~~~~~~~~~
vptr for 'QObject'
/usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:152:20: runtime error: member call on address 0x60e0000b4fa0 which does not point to an object of type 'MediaLib'
0x60e0000b4fa0: note: object is of type 'QObject'
09 00 00 00 e0 1e 7c 02 91 7f 00 00 20 26 07 00 80 60 00 00 40 4a 01 00 c0 60 00 00 01 00 be be
^~~~~~~~~~~~~~~~~~~~~~~
vptr for 'QObject'
=================================================================
==1731858==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040004fde60 at pc 0x7f9106bd09eb bp 0x7f90ff5cee30 sp 0x7f90ff5cee28
READ of size 8 at 0x6040004fde60 thread T9
#0 0x7f9106bd09ea in QMapData<QObject const*, unsigned long long>::root() const /usr/include/x86_64-linux-gnu/qt5/QtCore/qmap.h:207
#1 0x7f9106bcf46a (/home/rom/projects/vlc/buildasan/modules/.libs/libqt_plugin.so+0x29cf46a)
#2 0x7f9106bc763e (/home/rom/projects/vlc/buildasan/modules/.libs/libqt_plugin.so+0x29c763e)
#3 0x7f9106b83e49 in MediaLib::runOnMLThreadTargetDestroyed(QObject*) ../../modules/gui/qt/medialibrary/medialib.cpp:497
#4 0x7f9106bdcb24 in QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QObject*>, void, void (MediaLib::*)(QObject*)>::call(void (MediaLib::*)(QObject*), MediaLib*, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:152
#5 0x7f9106bdab45 in void QtPrivate::FunctionPointer<void (MediaLib::*)(QObject*)>::call<QtPrivate::List<QObject*>, void>(void (MediaLib::*)(QObject*), MediaLib*, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:185
#6 0x7f9106bd7afc in QtPrivate::QSlotObject<void (MediaLib::*)(QObject*), QtPrivate::List<QObject*>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:418
#7 0x7f910255f182 (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e6182)
#8 0x7f91025586fe in QObject::destroyed(QObject*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2df6fe)
#9 0x7f910255d52c in QObject::~QObject() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e452c)
#10 0x7f9106b756ec in MediaLib::~MediaLib() ../../modules/gui/qt/medialibrary/medialib.cpp:45
#11 0x7f9106b7570b in MediaLib::~MediaLib() ../../modules/gui/qt/medialibrary/medialib.cpp:45
#12 0x7f9102554ece in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2dbece)
#13 0x7f91030016be in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1636be)
#14 0x7f9102528b19 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2afb19)
#15 0x7f910252bb66 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b2b66)
#16 0x7f9102580ad2 (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x307ad2)
#17 0x7f910187bcda in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x53cda)
#18 0x7f910187bf87 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x53f87)
#19 0x7f910187c03e in g_main_context_iteration (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5403e)
#20 0x7f9102580153 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x307153)
#21 0x7f910252752a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2ae52a)
#22 0x7f910252f7ff in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b67ff)
#23 0x7f910633b2b6 in Thread ../../modules/gui/qt/qt.cpp:855
#24 0x7f9114570d7f in start_thread nptl/pthread_create.c:481
#25 0x7f911449bb6e in clone (/lib/x86_64-linux-gnu/libc.so.6+0xfcb6e)
0x6040004fde60 is located 16 bytes inside of 40-byte region [0x6040004fde50,0x6040004fde78)
freed by thread T9 here:
#0 0x7f911643ddb7 in operator delete(void*, unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:172
#1 0x7f9106bc8fe4 in QMapData<QObject const*, unsigned long long>::destroy() /usr/include/x86_64-linux-gnu/qt5/QtCore/qmap.h:248
#2 0x7f9106bc1480 in QMap<QObject const*, unsigned long long>::~QMap() /usr/include/x86_64-linux-gnu/qt5/QtCore/qmap.h:334
#3 0x7f9106bc0761 in QMultiMap<QObject const*, unsigned long long>::~QMultiMap() /usr/include/x86_64-linux-gnu/qt5/QtCore/qmap.h:1116
#4 0x7f9106b753c0 in MediaLib::~MediaLib() ../../modules/gui/qt/medialibrary/medialib.cpp:45
#5 0x7f9106b7570b in MediaLib::~MediaLib() ../../modules/gui/qt/medialibrary/medialib.cpp:45
#6 0x7f9102554ece in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2dbece)
#7 0x7f91030016be in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1636be)
previously allocated by thread T9 here:
#0 0x7f911643cf37 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
#1 0x7f910238267d in QMapDataBase::createData() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x10967d)
#2 0x7f9106bd0b51 in QMap<QObject const*, unsigned long long>::detach_helper() /usr/include/x86_64-linux-gnu/qt5/QtCore/qmap.h:970
#3 0x7f9106bc9268 in QMap<QObject const*, unsigned long long>::detach() /usr/include/x86_64-linux-gnu/qt5/QtCore/qmap.h:357
#4 0x7f9106bcc97e in QMultiMap<QObject const*, unsigned long long>::insert(QObject const* const&, unsigned long long const&) /usr/include/x86_64-linux-gnu/qt5/QtCore/qmap.h:1230
#5 0x7f9106cc9c0b in runOnMLThread<MLListCache::asyncCount()::Ctx> ../../modules/gui/qt/medialibrary/medialib.hpp:301
#6 0x7f9106cc6b8c in MLListCache::asyncCount() ../../modules/gui/qt/medialibrary/mllistcache.cpp:92
#7 0x7f9106cc50e4 in MLListCache::initCount() ../../modules/gui/qt/medialibrary/mllistcache.cpp:57
#8 0x7f9106c1d8cb in MLBaseModel::validateCache() const ../../modules/gui/qt/medialibrary/mlbasemodel.cpp:448
#9 0x7f9106c1adf4 in MLBaseModel::rowCount(QModelIndex const&) const ../../modules/gui/qt/medialibrary/mlbasemodel.cpp:363
#10 0x7f91024c9fdd (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x250fdd)
Edited by Romain Vimont