[mythtv-commits] Ticket #11318: Segfault in mythbackend (mainserver/autoexpire?)

[MythTV]

#11318: Segfault in mythbackend (mainserver/autoexpire?)
-------------------------------+------------------------------------
 Reporter:  verycoldpenguin@…  |           Type:  Bug Report - Crash
   Status:  new                |       Priority:  minor
Milestone:  unknown            |      Component:  MythTV - General
  Version:  Master Head        |       Severity:  medium
 Keywords:                     |  Ticket locked:  0
-------------------------------+------------------------------------
 I am experiencing a segfault in mythbackend, compiled on Centos 6.3 from
 master, using QT 4.8.4 (also present on QT 4.8.3). The setup is non-
 standard, but I believe that this is a generic issue (possibly being hit
 by the fact the system is an edge case).
 Symptoms are a segfault, when the system is relatively idle. I originally
 thought that it was triggered shortly after a recording finished, but,
 after furthther testing this has not been the case. I have not yet been
 able to trigger the fault at will. It is generally repeatable, usually
 between 1-6 hours, I don't think that it has been over 48 hours to trigger
 since I started looking for it.
 Here is a snippet of code from mainserver.cpp which I believe is the
 fault. To me, it would seem that the incrementation of 'it' in the section
 is not needed, and could be the cause. But, I don't see why this isn't
 hitting more people if it is. This is starting at line 4667:
 -----

 {{{
 void MainServer::GetFilesystemInfos(QList<FileSystemInfo> &fsInfos)
 {
     QStringList strlist;
     FileSystemInfo fsInfo;

     fsInfos.clear();

     BackendQueryDiskSpace(strlist, false, true);

     QStringList::const_iterator it = strlist.begin();
     while (it != strlist.end())
     {
         fsInfo.setHostname(*(it++));
         fsInfo.setPath(*(it++));
         fsInfo.setLocal((*(it++)).toInt() > 0);
         fsInfo.setFSysID(-1);
         ++it;
         fsInfo.setGroupID((*(it++)).toInt());
         fsInfo.setBlockSize((*(it++)).toInt());
         fsInfo.setTotalSpace((*(it++)).toLongLong());
         fsInfo.setUsedSpace((*(it++)).toLongLong());
         fsInfo.setWeight(0);
         fsInfos.push_back(fsInfo);
     }
 }}}

 -----
 Snippet from backtrace (full crash attached). Sorry but the line number
 changed (it is the one immediately after the '++it;') in the current head.
 -----

 {{{
 Thread 19 (Thread 0x7fffcebfd700 (LWP 15361)):
 #0  0x00007fffef24ae74 in QLocalePrivate::stringToLongLong(QString const&,
 int, bool*, QLocalePrivate::GroupSeparatorMode) const () from
 /usr/local/Trolltech/Qt-4.8.4/lib/libQtCore.so.4
 No symbol table info available.
 #1  0x00007fffef27219c in QString::toLongLong(bool*, int) const () from
 /usr/local/Trolltech/Qt-4.8.4/lib/libQtCore.so.4
 No symbol table info available.
 #2  0x00007fffef272239 in QString::toInt(bool*, int) const () from
 /usr/local/Trolltech/Qt-4.8.4/lib/libQtCore.so.4
 No symbol table info available.
 #3  0x00000000004948f5 in MainServer::GetFilesystemInfos (this=0x89f140,
 fsInfos=...) at mainserver.cpp:4662
         strlist = {<QList<QString>> = {{p = {static shared_null = {ref =
 {_q_value = 604}, alloc = 0, begin = 0, end = 0, sharable = 1, array =
 {0x0}}, d = 0x7fffa4050520}, d = 0x7fffa4050520}}, <No data fields>}
         __FUNCTION__ = "GetFilesystemInfos"
         fsInfo = {<QObject> = {<No data fields>},
 }}}

 -----

 Both my begin and end are 0, I think that the while line should possibly
 be changed from:
 while (it != strlist.end())
 to:
 while (it < strlist.end())
 And possibly the 'it++;' removed. I don't think that the code should have
 been run anyway though (given that begin and end should both return 0, or
 the same pointer).

-- 
Ticket URL: <http://code.mythtv.org/trac/ticket/11318>
MythTV <http://code.mythtv.org/trac>
MythTV Media Center