Project

General

Profile

Actions

Bug #7000

closed

Invaid WModelIndex passed to Selected Wt::WTableView::renderSelected

Added by Aaron Art about 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
04/11/2019
Due date:
% Done:

0%

Estimated time:

Description

When using clicking inside of a WTableView with a active editable item open.

There chance for the WTableView to core dump. Valgrind point to renderSelected in WTableView. I think the issue is with WModelIndex object being passed.

I have attached a snapshot from valgrind.

Thanks


Files

Segmentation fault.PNG (818 KB) Segmentation fault.PNG Aaron Art, 04/11/2019 11:06 PM
Actions #1

Updated by Roel Standaert about 5 years ago

  • Tracker changed from Support to Bug
  • Status changed from New to Feedback
  • Priority changed from Urgent to Normal
  • Target version deleted (3.4.0)

I can't seem to reproduce your issue, even when testing with Wt 3.3.9. Do you have a little (standalone) example that demonstrates this?

Actions #2

Updated by Aaron Art almost 5 years ago

I currently working making a standalone example. I have upgrade to wt 4.0.5. Its looks the issue is not with the WModelIndex object, but the issue lie with line 1970 in Wt/WTableView.C. "w->toggleStyleClass(cl, selected)". Here the backtrace.

#0  0x00007ffff6e5bb25 in Wt::WTableView::renderSelected (this=0x7fffd80d3c40, selected=true, index=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WTableView.C:1970
#1  0x00007ffff6e5b679 in Wt::WTableView::internalSelect (this=0x7fffd80d3c40, index=..., option=Wt::Select)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WTableView.C:1912
#2  0x00007ffff6b9669b in Wt::WAbstractItemView::select (this=0x7fffd80d3c40, index=..., option=Wt::Select)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WAbstractItemView.C:930
#3  0x00007ffff6b968aa in Wt::WAbstractItemView::selectionHandleClick (this=0x7fffd80d3c40, index=..., modifiers=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WAbstractItemView.C:964
#4  0x00007ffff6b99c03 in Wt::WAbstractItemView::handleMouseDown (this=0x7fffd80d3c40, index=..., event=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WAbstractItemView.C:1382
#5  0x00007ffff6e5a904 in Wt::WTableView::handleMouseWentDown (this=0x7fffd80d3c40, headerColumns=true, event=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WTableView.C:1751
#6  0x00007ffff6e65100 in std::__invoke_impl<void, void (Wt::WTableView::*&)(bool, Wt::WMouseEvent const&), Wt::WTableView*&, bool&, Wt::WMouseEvent>(std::__invoke_memfun_deref, void (Wt::WTableView::*&)(bool, Wt::WMouseEvent const&), Wt::WTableView*&, bool&, Wt::WMouseEvent&&) (__f=
    @0x7fffd8096b00: (void (Wt::WTableView::*)(Wt::WTableView * const, bool, const Wt::WMouseEvent &)) 0x7ffff6e5a8b6 <Wt::WTableView::handleMouseWentDown(bool, Wt::WMouseEvent const&)>, __t=@0x7fffd8096b18: 0x7fffd80d3c40, __args#0=@0x7fffd8096b10: true,
    __args#1=<unknown type in ../../lib/libwtd.so.51, CU 0x18815dc, DIE 0x18cb374>) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:73
#7  0x00007ffff6e64bbb in std::__invoke<void (Wt::WTableView::*&)(bool, Wt::WMouseEvent const&), Wt::WTableView*&, bool&, Wt::WMouseEvent>(void (Wt::WTableView::*&)(bool, Wt::WMouseEvent const&), Wt::WTableView*&, bool&, Wt::WMouseEvent&&) (__fn=
    @0x7fffd8096b00: (void (Wt::WTableView::*)(Wt::WTableView * const, bool, const Wt::WMouseEvent &)) 0x7ffff6e5a8b6 <Wt::WTableView::handleMouseWentDown(bool, Wt::WMouseEvent const&)>, __args#0=@0x7fffd8096b18: 0x7fffd80d3c40, __args#1=@0x7fffd8096b10: true,
    __args#2=<unknown type in ../../lib/libwtd.so.51, CU 0x18815dc, DIE 0x18ccf01>) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:95
#8  0x00007ffff6e64436 in std::_Bind<void (Wt::WTableView::*(Wt::WTableView*, bool, std::_Placeholder<1>))(bool, Wt::WMouseEvent const&)>::__call<void, Wt::WMouseEvent&&, 0ul, 1ul, 2ul>(std::tuple<Wt::WMouseEvent&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (this=0x7fffd8096b00,
    __args=<unknown type in ../../lib/libwtd.so.51, CU 0x18815dc, DIE 0x18cf18f>) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/functional:400
#9  0x00007ffff6e62ecb in std::_Bind<void (Wt::WTableView::*(Wt::WTableView*, bool, std::_Placeholder<1>))(bool, Wt::WMouseEvent const&)>::operator()<Wt::WMouseEvent, void>(Wt::WMouseEvent&&) (this=0x7fffd8096b00, __args#0=<unknown type in ../../lib/libwtd.so.51, CU 0x18815dc, DIE 0x18d2507>)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/functional:484
#10 0x00007ffff6e615e8 in std::_Function_handler<void (Wt::WMouseEvent), std::_Bind<void (Wt::WTableView::*(Wt::WTableView*, bool, std::_Placeholder<1>))(bool, Wt::WMouseEvent const&)> >::_M_invoke(std::_Any_data const&, Wt::WMouseEvent&&) (__functor=...,
    __args#0=<unknown type in ../../lib/libwtd.so.51, CU 0x18815dc, DIE 0x18d62bb>)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/std_function.h:297
#11 0x00007ffff6c79cdf in std::function<void (Wt::WMouseEvent)>::operator()(Wt::WMouseEvent) const (this=0x7fffd8096348, __args#0=...)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/std_function.h:687
#12 0x00007ffff6c78386 in Wt::Signals::Impl::ProtoSignal<Wt::WMouseEvent>::emit (this=0x7fffd8086d40, args#0=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/Signals/signals.hpp:242
#13 0x00007ffff6ee33f2 in Wt::EventSignal<Wt::WMouseEvent>::processDynamic (this=0x7fffd8086cf0, jse=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WSignal.h:924
#14 0x00007ffff71aa1a0 in Wt::WebSession::processSignal (this=0x7fffe8004470, s=0x7fffd8086cf0, se=..., request=..., kind=Wt::WebSession::Dynamic,
    checkWasStubbed=false) at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/web/WebSession.C:3013
#15 0x00007ffff71a9f07 in Wt::WebSession::notifySignal (this=0x7fffe8004470, e=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/web/WebSession.C:2979
#16 0x00007ffff71a53d9 in Wt::WebSession::notify (this=0x7fffe8004470, event=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/web/WebSession.C:2557
#17 0x00007ffff6bebff8 in Wt::WApplication::notify (this=0x7fffdc0014d0, e=...) at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WApplication.C:1519
#18 0x00007ffff719e83d in Wt::WebSession::handleRequest (this=0x7fffe8004470, handler=...)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/web/WebSession.C:1697
#19 0x00007ffff717fb52 in Wt::WebController::handleRequest (this=0x82c460, request=0x7fffe8003fa0)
    at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/web/WebController.C:758
#20 0x00007ffff5ab7219 in std::__invoke_impl<void, void (Wt::WebController::*&)(Wt::WebRequest*), Wt::WebController*&, http::server::HTTPRequest*&> (
    __f=
    @0x7fffe7ffe900: (void (Wt::WebController::*)(Wt::WebController * const, Wt::WebRequest *)) 0x7ffff717e7d0 <Wt::WebController::handleRequest(Wt::WebRequest*)>, __t=@0x7fffe7ffe918: 0x82c460, __args#0=@0x7fffe7ffe910: 0x7fffe8003fa0) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:73
#21 0x00007ffff5ab70c3 in std::__invoke<void (Wt::WebController::*&)(Wt::WebRequest*), Wt::WebController*&, http::server::HTTPRequest*&> (__fn=
    @0x7fffe7ffe900: (void (Wt::WebController::*)(Wt::WebController * const, Wt::WebRequest *)) 0x7ffff717e7d0 <Wt::WebController::handleRequest(Wt::WebRequest*)>, __args#0=@0x7fffe7ffe918: 0x82c460, __args#1=@0x7fffe7ffe910: 0x7fffe8003fa0)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:95
#22 0x00007ffff5ab6fa7 in std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) (this=0x7fffe7ffe900,
    __args=<unknown type in ../../lib/libwthttpd.so.51, CU 0x73710d, DIE 0x7a978e>) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/functional:400
#23 0x00007ffff5ab6e0c in std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>::operator()<, void>() (this=0x7fffe7ffe900) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/functional:484
#24 0x00007ffff5ab6ccb in boost::asio::asio_handler_invoke<std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)> >(std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>&, ...) (function=...)
    at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/handler_invoke_hook.hpp:69
#25 0x00007ffff5ab6aff in boost_asio_handler_invoke_helpers::invoke<std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>, std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)> >(std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>&, std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>&) (function=..., context=...)
    at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/detail/handler_invoke_helpers.hpp:37
#26 0x00007ffff5ab668d in boost::asio::detail::handler_work<std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>, boost::asio::system_executor>::complete<std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)> >(std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>&, std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)>&) (this=0x7fffe7ffe92f, function=..., handler=...)
    at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/detail/handler_work.hpp:82
#27 0x00007ffff5ab5d86 in boost::asio::detail::completion_handler<std::_Bind<void (Wt::WebController::*(Wt::WebController*, http::server::HTTPRequest*))(Wt::WebRequest*)> >::do_complete(void*, boost::asio::detail::scheduler_operation*, boost::system::error_code const&, unsigned long) (
    owner=0x82cfb0, base=0x7fffdc014160) at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/detail/completion_handler.hpp:70
#28 0x00007ffff6cf9cae in boost::asio::detail::scheduler_operation::complete (this=0x7fffdc014160, owner=0x82cfb0, ec=..., bytes_transferred=0)
    at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/detail/scheduler_operation.hpp:40
#29 0x00007ffff6cfd231 in boost::asio::detail::scheduler::do_run_one (this=0x82cfb0, lock=..., this_thread=..., ec=...)
    at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/detail/impl/scheduler.ipp:401
#30 0x00007ffff6cfcd12 in boost::asio::detail::scheduler::run (this=0x82cfb0, ec=...)
    at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/detail/impl/scheduler.ipp:154
#31 0x00007ffff6cfd733 in boost::asio::io_context::run (this=0x82d1c8) at /home/aarthur/git/rut/lib/boost_1_67_0/boost/asio/impl/io_context.ipp:62
#32 0x00007ffff6cf94e5 in Wt::WIOService::run (this=0x82d1c0) at /home/aarthur/git/raaft_wt4/lib/wt-4.0.5/src/Wt/WIOService.C:180
#33 0x00007ffff6d0452d in std::__invoke_impl<void, void (Wt::WIOService::*&)(), Wt::WIOService*&> (
    __f=@0x828f78: (void (Wt::WIOService::*)(Wt::WIOService * const)) 0x7ffff6cf94b2 <Wt::WIOService::run()>, __t=@0x828f88: 0x82d1c0)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:73
#34 0x00007ffff6d03ca7 in std::__invoke<void (Wt::WIOService::*&)(), Wt::WIOService*&> (
    __fn=@0x828f78: (void (Wt::WIOService::*)(Wt::WIOService * const)) 0x7ffff6cf94b2 <Wt::WIOService::run()>, __args#0=@0x828f88: 0x82d1c0)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:95
#35 0x00007ffff6d02e84 in std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) (
    this=0x828f78, __args=<unknown type in ../../lib/libwtd.so.51, CU 0xc87f82, DIE 0xcab267>)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/functional:400
#36 0x00007ffff6d01dac in std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()>::operator()<, void>() (this=0x828f78)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/functional:484
#37 0x00007ffff6d00ae5 in std::__invoke_impl<void, std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()>>(std::__invoke_other, std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()>&&) (__f=<unknown type in ../../lib/libwtd.so.51, CU 0xc87f82, DIE 0xcae17d>)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:60
#38 0x00007ffff6cff97e in std::__invoke<std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()>>(std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()>&&) (__fn=<unknown type in ../../lib/libwtd.so.51, CU 0xc87f82, DIE 0xcafd04>) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/bits/invoke.h:95
#39 0x00007ffff6d07504 in std::thread::_Invoker<std::tuple<std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) (this=0x828f78) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/thread:234
#40 0x00007ffff6d06f08 in std::thread::_Invoker<std::tuple<std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()> > >::operator()() (this=0x828f78)
    at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/thread:243
#41 0x00007ffff6d06932 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::_Bind<void (Wt::WIOService::*(Wt::WIOService*))()> > > >::_M_run() (this=0x828f70) at /opt/rh/gcc-8/root/usr/include/c++/8.1.0/thread:186
#42 0x00007ffff7b12cff in execute_native_thread_routine () at ../../../../../gcc-8.1.0/libstdc++-v3/src/c++11/thread.cc:80
#43 0x00007ffff3508e25 in start_thread () from /lib64/libpthread.so.0
#44 0x00007ffff453bbad in clone () from /lib64/libc.so.6

I am using gcc 8.1.0 with cpp14.

Actions #3

Updated by Roel Standaert almost 5 years ago

Hm, on that line, cl is an std::string created on line 1950, selected is a bool set to true, so I'd guess that w is a dangling pointer?

Actions #4

Updated by Roel Standaert almost 5 years ago

Are you setting a custom item delegate? What precisely does valgrind output?

Actions #5

Updated by Roel Standaert almost 5 years ago

Sorry, just noticed you had provided a screenshot of valgrind.

Actions #6

Updated by Roel Standaert almost 5 years ago

In trying to pinpoint your issue I did find a possible out of bounds memory access that I just pushed a fix for. Are you using row headers? If so, maybe that fix will help. If not, then the problem is something else.

What's clear is that you're getting an invalid pointer because it is getting a widget that is outside of the bounds of the widget rendering that particular column.

Actions #7

Updated by Aaron Art almost 5 years ago

I am using row header. What version of wt do I need to pull to get the fix?

Actions #8

Updated by Aaron Art almost 5 years ago

Yes, I am also using a custom item delegate, but I still run in to this issue with the ability to edit disable.

Actions #9

Updated by Roel Standaert almost 5 years ago

You can pull any branch, they all have the fix. 4.1-release is the branch where I'm pushing just bug fixes after 4.1.0, and master is the in-development branch for 4.2.0.

Actions #10

Updated by Roel Standaert almost 5 years ago

Do you still experience this issue, or is it working fine now?

Actions #11

Updated by Aaron Art almost 5 years ago

The issue has been fixed. Thanks!!

Actions #12

Updated by Roel Standaert almost 5 years ago

  • Status changed from Feedback to Resolved
Actions #13

Updated by Roel Standaert almost 5 years ago

  • Status changed from Resolved to Closed

Fix released in 4.1.1

Actions

Also available in: Atom PDF