[Psi-Devel] [Psi-devel] The ugliest stack trace in a while

[Norman Rasmussen]

I haven't seen nasties like this in a while.  This is Psi 0.12 + adhoc
(from July '08) on Qt 4.3.4 (so it might be fixed in latest qt's) with
vc9

 	msvcr90d.dll!__CrtDbgReport()  + 0x2b bytes	
 	msvcr90d.dll!__free_dbg_nolock()  + 0x313 bytes	
 	msvcr90d.dll!__free_dbg()  + 0x50 bytes	
 	msvcr90d.dll!_free()  + 0x10 bytes	
>	QtCored4.dll!qFree(void * ptr=0x03a06f38)  Line 1972 + 0xd bytes	C++
 	QtCored4.dll!QList<QObject *>::free(QListData::Data *
data=0x03a06f38)  Line 562 + 0x9 bytes	C++
 	QtCored4.dll!QList<QObject *>::operator=(const QList<QObject *> &
l={...})  Line 376	C++
 	QtCored4.dll!QList<QObject *>::clear()  Line 569 + 0x24 bytes	C++
 	QtCored4.dll!QObjectPrivate::sendPendingChildInsertedEvents()  Line 350	C++
 	QtCored4.dll!QObject::event(QEvent * e=0x035bb698)  Line 1099	C++
 	QtGuid4.dll!QApplicationPrivate::notify_helper(QObject *
receiver=0x022c7e90, QEvent * e=0x035bb698)  Line 3563 + 0x11
bytes	C++
 	QtGuid4.dll!QApplication::notify(QObject * receiver=0x022c7e90,
QEvent * e=0x035bb698)  Line 3122 + 0x10 bytes	C++
 	Psi.exe!PsiApplication::notify(QObject * receiver=0x022c7e90, QEvent
* event=0x035bb698)  Line 251	C++
 	QtCored4.dll!QCoreApplication::notifyInternal(QObject *
receiver=0x022c7e90, QEvent * event=0x035bb698)  Line 538	C++
 	QtCored4.dll!QCoreApplication::sendEvent(QObject *
receiver=0x022c7e90, QEvent * event=0x035bb698)  Line 207 + 0x39
bytes	C++
 	QtCored4.dll!QCoreApplicationPrivate::sendPostedEvents(QObject *
receiver=0x00000000, int event_type=0, QThreadData * data=0x00f0be90)
Line 1124 + 0xd bytes	C++
 	QtCored4.dll!QCoreApplication::sendPostedEvents(QObject *
receiver=0x00000000, int event_type=-1)  Line 1009 + 0x11 bytes	C++
 	QtCored4.dll!QEventDispatcherWin32::processEvents(QFlags<enum
QEventLoop::ProcessEventsFlag> flags={...})  Line 454 + 0x24 bytes	C++
 	QtGuid4.dll!QGuiEventDispatcherWin32::processEvents(QFlags<enum
QEventLoop::ProcessEventsFlag> flags={...})  Line 997 + 0x15 bytes	C++
 	QtCored4.dll!QEventLoop::processEvents(QFlags<enum
QEventLoop::ProcessEventsFlag> flags={...})  Line 148	C++
 	QtCored4.dll!QEventLoop::exec(QFlags<enum
QEventLoop::ProcessEventsFlag> flags={...})  Line 193 + 0x2d bytes	C++
 	QtCored4.dll!QCoreApplication::exec()  Line 766 + 0x15 bytes	C++
 	QtGuid4.dll!QApplication::exec()  Line 3061	C++
 	Psi.exe!main(int argc=1, char * * argv=0x00f073b8)  Line 356 + 0x6 bytes	C++

I can only assume the the internal qt pendingChildInsertedEvents list
was double free'ed.

The two other Qt threads were in WaitForMultipleObjects, so they
should have been thread safe.  The crash was so bad, that the
app-has-crashed window had hung too (deadlocked on loading a icon, or
something weird)

The CrtDbgReport was trying to output "HEAP CORRUPTION DETECTED: after
Normal block (#85955815) at 0x03A06F38.\nCRT detected that the
application wrote to memory after end of heap buffer.\n"

So extra state about the event at the time:

receiver	0x022c7e90	QNativeSocketEngine
   d_ptr	0x037a53b0	{socketDescriptor=17204 readNotifier=0x039176e8
writeNotifier=0x03a6e888 ...}	QNativeSocketEnginePrivate

event		0x035bb698	{d=0x00000000 t=67 posted=0 ...}	QEvent *

and the QList's private data:

data	0x03a06f38 {ref={...} alloc=3 begin=0 ...}	QListData::Data *
ref	{value=0 }	QBasicAtomic
alloc	3	int
begin	0	int
end	1	int
sharable	1	unsigned int
array	0x03a06f4c	void * [1]
[0]	0x039176e8	void *

Anyways, I have the heap dump, so I can always dig deeper if needed.

-- 
- Norman Rasmussen
 - Email: norman at rasmussen.co.za
 - Home page: http://norman.rasmussen.co.za/