<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - ABI breakage: Qt segfaults when run against libxcb 1.9.3"
href="https://bugs.freedesktop.org/show_bug.cgi?id=71507">71507</a>
</td>
</tr>
<tr>
<th>Assignee</th>
<td>xcb@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>ABI breakage: Qt segfaults when run against libxcb 1.9.3
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>xcb@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Severity</th>
<td>blocker
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Reporter</th>
<td>psychon@znc.in
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Component</th>
<td>Library
</td>
</tr>
<tr>
<th>Product</th>
<td>XCB
</td>
</tr></table>
<p>
<div>
<pre>As seen elsewhere[0], Qt5 segfaults when run against the latest xcb release.
Thanks to Tommalla from #qt-labs, I got the following backtrace for this crash:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff0ae2120 in QXcbKeyboard::updateVModMapping() () from
/usr/lib64/qt5/plugins/platforms/libqxcb.so
(gdb) bt
#0 0x00007ffff0ae2120 in QXcbKeyboard::updateVModMapping() () from
/usr/lib64/qt5/plugins/platforms/libqxcb.so
#1 0x00007ffff0ae25e8 in QXcbKeyboard::QXcbKeyboard(QXcbConnection*) () from
/usr/lib64/qt5/plugins/platforms/libqxcb.so
#2 0x00007ffff0adef90 in QXcbConnection::QXcbConnection(QXcbNativeInterface*,
bool, char const*) () from /usr/lib64/qt5/plugins/platforms/libqxcb.so
#3 0x00007ffff0ae11ba in QXcbIntegration::QXcbIntegration(QStringList const&,
int&, char**) () from /usr/lib64/qt5/plugins/platforms/libqxcb.so
#4 0x00007ffff0af1790 in QXcbIntegrationPlugin::create(QString const&,
QStringList const&, int&, char**) () from
/usr/lib64/qt5/plugins/platforms/libqxcb.so
[...]
I asked him to tell gdb to "disassemble" and got the following snippet:
0x00007ffff0ae2118 <+232>: and %eax,%r15d
0x00007ffff0ae211b <+235>: mov 0x78(%rsp),%rax
=> 0x00007ffff0ae2120 <+240>: mov (%rax,%rdx,4),%edx
0x00007ffff0ae2123 <+243>: callq 0x7ffff0ade5c0
<_ZN14QXcbConnection8atomNameEj>
So this segfaults right before calling QXcbConnection::atomName(unsigned
int)[1].
The relevant code is here: [2]
Because it segfaults right before calling atomName(), it must be dying in line
1064 where it just indexes into the result of
xcb_xkb_get_names_value_list_unpack().
If you want me to guess, then the size of this struct changed because of commit
37d0f55392d68d0a05dcf5d793d729e49108f1b7. This introduced a new alignment_pad
field and thus shifted all the following members around by four byte. (Having
just written this sentence, I am pretty sure that this is the reason for the
crash).
[0]:
<a href="https://bugreports.qt-project.org/browse/QTBUG-34748">https://bugreports.qt-project.org/browse/QTBUG-34748</a>
<a href="https://bbs.archlinux.org/viewtopic.php?id=172746">https://bbs.archlinux.org/viewtopic.php?id=172746</a>
<a class="bz_bug_link
bz_status_NEW "
title="NEW --- - xcb_ge_event_t change causes API breakage"
href="show_bug.cgi?id=71502">https://bugs.freedesktop.org/show_bug.cgi?id=71502</a>
[1]:
$ c++filt _ZN14QXcbConnection8atomNameEj
QXcbConnection::atomName(unsigned int)
[2]:
<a href="https://qt.gitorious.org/qt/qtbase/source/fd619946be51784dc709363324897be6af144c52:src/plugins/platforms/xcb/qxcbkeyboard.cpp#L1019">https://qt.gitorious.org/qt/qtbase/source/fd619946be51784dc709363324897be6af144c52:src/plugins/platforms/xcb/qxcbkeyboard.cpp#L1019</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>