QDragManger crashes in various applications

Version: 1.2.1 (using 4.2.2 (KDE 4.2.2), Kubuntu packages)
Compiler: cc
OS: Linux (i686) release 2.6.28-11-generic

Steps:
1. Start dragging a file.
2. Cycle windows using Alt+Tab.
3. Release Alt.
4. Crash.

Possibly duplicate of #191172?

Trace:
Rakendus: Dolphin (dolphin), signaal SIGSEGV

Thread 1 (Thread 0xb5d01700 (LWP 9274)):
[KCrash Handler]
#6 0xb6ac9cde in QDragManager::move () from /usr/lib/libQtGui.so.4
#7 0xb6acc471 in QDragManager::eventFilter () from /usr/lib/libQtGui.so.4
#8 0xb6808d1c in QCoreApplicationPrivate::sendThroughApplicationEventFilters () from /usr/lib/libQtCore.so.4
#9 0xb6a41ea3 in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
#10 0xb6a4aba1 in QApplication::notify () from /usr/lib/libQtGui.so.4
#11 0xb779e94d in KApplication::notify () from /usr/lib/libkdeui.so.5
#12 0xb6809a3b in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
#13 0xb6a49c0e in QApplicationPrivate::sendMouseEvent () from /usr/lib/libQtGui.so.4
#14 0xb6ab9a0e in ?? () from /usr/lib/libQtGui.so.4
#15 0xb6ab8d37 in QApplication::x11ProcessEvent () from /usr/lib/libQtGui.so.4
#16 0xb6ae3cfa in ?? () from /usr/lib/libQtGui.so.4
#17 0xb5f87b88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#18 0xb5f8b0eb in ?? () from /usr/lib/libglib-2.0.so.0
#19 0xb5f8b268 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#20 0xb6835438 in QEventDispatcherGlib::processEvents () from /usr/lib/libQtCore.so.4
#21 0xb6ae33f5 in ?? () from /usr/lib/libQtGui.so.4
#22 0xb680806a in QEventLoop::processEvents () from /usr/lib/libQtCore.so.4
#23 0xb68084aa in QEventLoop::exec () from /usr/lib/libQtCore.so.4
#24 0xb6aca3a0 in QDragManager::drag () from /usr/lib/libQtGui.so.4
#25 0xb6a555ca in QDrag::exec () from /usr/lib/libQtGui.so.4
#26 0xb7caa8d5 in DragAndDropHelper::startDrag () from /usr/lib/libdolphinprivate.so.4
#27 0xb7c900f4 in DolphinDetailsView::startDrag () from /usr/lib/libdolphinprivate.so.4
#28 0xb6fbff4d in QAbstractItemView::mouseMoveEvent () from /usr/lib/libQtGui.so.4
#29 0xb7c9029c in DolphinDetailsView::mouseMoveEvent () from /usr/lib/libdolphinprivate.so.4
#30 0xb6a98a3d in QWidget::event () from /usr/lib/libQtGui.so.4
#31 0xb6e72d83 in QFrame::event () from /usr/lib/libQtGui.so.4
#32 0xb6f12d3f in QAbstractScrollArea::viewportEvent () from /usr/lib/libQtGui.so.4
#33 0xb6fc4a37 in QAbstractItemView::viewportEvent () from /usr/lib/libQtGui.so.4
#34 0xb6fff4b4 in QTreeView::viewportEvent () from /usr/lib/libQtGui.so.4
#35 0xb6f15345 in ?? () from /usr/lib/libQtGui.so.4
#36 0xb6808c5a in QCoreApplicationPrivate::sendThroughObjectEventFilters () from /usr/lib/libQtCore.so.4
#37 0xb6a41f0a in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
#38 0xb6a4aba1 in QApplication::notify () from /usr/lib/libQtGui.so.4
#39 0xb779e94d in KApplication::notify () from /usr/lib/libkdeui.so.5
#40 0xb6809a3b in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
#41 0xb6a49c0e in QApplicationPrivate::sendMouseEvent () from /usr/lib/libQtGui.so.4
#42 0xb6ab9a0e in ?? () from /usr/lib/libQtGui.so.4
#43 0xb6ab8d37 in QApplication::x11ProcessEvent ()...

What is your Qt version ? Thanks

4.5.0
Also noticed that without desktop effects active, it works as expected.

seems to stumble on coverswitch + flipswitch, boxswitch, no-switch (tm) don't cause it here.

the problem occurs in $Qt/src/gui/kernel/qdnd_x11.cpp:1626
-> move.data.l[0] = dragPrivate()->source->effectiveWinId();
dragPrivate() relies on the pmd "object" (which should be catched on top of the func) and it's dfunc, but i guess "source" (QWidget*) could be 0L

currently recompiling qtgui 4.5 for some debug output...

nope, no NULL, BUT (running from konsole helps from time to time)
libxcb: WARNING! Program tries to lock an already locked connection,
        which indicates a programming error.
        There will be no further warnings about this issue.
xdndHandleBadwindow returned true
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
libxcb: WARNING! Program tries to unlock a connection without having acquired
        a lock first, which indicates a programming error.
        There will be no further warnings about this issue.

^^^ means: good chances
manager->object->deleteLater(); has been called... (manager being QDragManager::self())

IN ADDITION:
it happens with other (all?!) fullscreen FX, too (tried with present windows)

the problem seems to be that Qt gets confused on the window below the drag, defers a manager deletion but still manages to enter the eventfilter and then runs into the dying object?! (i'm a little confused, but at least the crash can not be reproduced in a deterministic way. e.g. testing with Qt's dnd example "draggableicons", it segfaults in about 1 of maaany cases :-(

@Thomas: could bug 192780 be related to this too ? Thanks

*** Bug 193827 has been marked as a duplicate of this bug. ***

Bug 191172 seems also related to compositing.

This bug is still present on KDE 4.3 RC. Tried to drag and drop a link from
Dolphin to VLC. I switched to VLC with the Cover Switch effect.

`dolphin -v`:
Qt: 4.5.2
KDE: 4.2.93 (KDE 4.2.93 (KDE 4.3 >= 20090623)) "release 1"
Dolphin: 1.2.80

Here is a full backtrace:
Application: Dolphin (dolphin), signal: Segmentation fault
[Current thread is 1 (Thread 0x7f8c17dae760 (LWP 21875))]

Thread 2 (Thread 0x7f8c0217a950 (LWP 17499)):
#0 0x00007f8c13cc1fdd in pthread_cond_timedwait@@GLIBC_2.3.2 () from
/lib64/libpthread.so.0
#1 0x00007f8c06bbc631 in metronom_sync_loop () from /usr/lib64/libxine.so.1
#2 0x00007f8c13cbe070 in start_thread () from /lib64/libpthread.so.0
#3 0x00007f8c132b610d in clone () from /lib64/libc.so.6
#4 0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7f8c17dae760 (LWP 21875)):
[KCrash Handler]
#5 QDragManager::move (this=0x1eff600, globalPos=@0x7fff1fde8730) at
kernel/qdnd_x11.cpp:1642
#6 0x00007f8c145326d9 in QDragManager::eventFilter (this=0x7f8c13537a00,
o=<value optimized out>, e=0x0) at kernel/qdnd_x11.cpp:1296
#7 0x00007f8c1401ad0c in
QCoreApplicationPrivate::sendThroughApplicationEventFilters (this=0x6b47c0,
receiver=0x1f1dae0, event=0x7fff1fde8710) at kernel/qcoreapplication.cpp:707
#8 0x00007f8c144afa76 in QApplicationPrivate::notify_helper
(this=0x7f8c13537a00, receiver=0x7f8c133060a8, e=0x0) at
kernel/qapplication.cpp:4031
#9 0x00007f8c144b84fa in QApplication::notify (this=<value optimized out>,
receiver=0x1f1dae0, e=0x7fff1fde8710) at kernel/qapplication.cpp:3758
#10 0x00007f8c15a0e5cb in KApplication::notify (this=0x7fff1fded6b0,
receiver=0x1f1dae0, event=0x7fff1fde8710) at
/usr/src/debug/kdelibs-4.2.93svn985654/kdeui/kernel/kapplication.cpp:302
#11 0x00007f8c1401b94c in QCoreApplication::notifyInternal
(this=0x7fff1fded6b0, receiver=0x1f1dae0, event=0x7fff1fde8710) at
kernel/qcoreapplication.cpp:610
#12 0x00007f8c144b7748 in QApplicationPrivate::sendMouseEvent
(receiver=0x1f1dae0, event=0x7fff1fde8710, alienWidget=0x0,
nativeWidget=0x1f1dae0, buttonDown=<value optimized out>,
    lastMouseReceiver=@0x7f8c14ec3f30) at
../../src/corelib/kernel/qcoreapplication.h:216
#13 0x00007f8c14521509 in QETWidget::translateMouseEvent (this=0x1f1dae0,
event=<value optimized out>) at kernel/qapplication_x11.cpp:4407
#14 0x00007f8c14520543 in QApplication::x11ProcessEvent (this=0x7fff1fded6b0,
event=0x7fff1fdea290) at kernel/qapplication_x11.cpp:3548
#15 0x00007f8c14547864 in x11EventSourceDispatch (s=0x6b7920, callback=0,
user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#16 0x00007f8c103b90fb in g_main_context_dispatch () from
/usr/lib64/libglib-2.0.so.0
#17 0x00007f8c103bc8cd in ?? () from /usr/lib64/libglib-2.0.so.0
#18 0x00007f8c103bca8b in g_main_context_iteration () from
/usr/lib64/libglib-2.0.so.0
#19 0x00007f8c14044d3f in QEventDispatcherGlib::processEvents (this=0x688c30,
flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:327
#20 0x00007f8c14546fef in QGuiEventDispatcherGlib::processEvents
(this=0x7f8c13537a00, flags=<value optimized out>) at
kernel/qguieventdispatcher_glib.cpp:202
#21 0x00007f8c1401a1d2 in QEventLoop::processEvents (this=<value optimized
out>, flags={i = 534685056}) at k...

*** Bug 200583 has been marked as a duplicate of this bug. ***

Steps to reliably reproduce the bug:

1. Activate composting + Cover Switch effect
2. Start dragging something and keep the button pressed
2a. Drag a file from a Dolphin window
2b. Drag a file from an Ark window
3. Press Alt and keep it pressed
4. Tap the Alt key until the window from which you dragged the file is just to the left of the central window in the Cover Switch effect (you should have at least 3-4 open windows on current desktop)
5. Move mouse in the center of the window to the left of the central window, while still keeping the mouse button and Alt key pressed
6. Release the Alt key and *immediately* drag the mouse upwards; the window from which you dragged the item should crash

Steps 4 and 5 don't seem very important, some crashes happen irrelevant of where the file is dropped. Step 6 is crucial (moving the mouse immediately after releasing the item).

Something similar can be used to cause a crash for the Flip Switch effect.
Other effects seem unaffected (probably because they don't really move windows).

The stack trace of the crash is either similar with the one in this report or with the one in #200583 (https://bugs.kde.org/show_bug.cgi?id=200583) -- seems a bit random which one.

Sometimes, not only the app from which you dragged the item crashes, but kwin too. Here is a sample stack trace from such a crash, but I've seen kwin crashes in other places too (this is from the Flip Switch effect; doing this with the Cover switch crashes kwin more frequently):

Application: KWin (kwin), signal: Aborted
[KCrash Handler]
#5 0x00007f1786426fb5 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#6 0x00007f1786428bc3 in *__GI_abort () at abort.c:88
#7 0x00007f178b991ce5 in KWin::EffectsHandlerImpl::destroyInputWindow (this=0x114d040, w=61073505) at /build/buildd/kdebase-workspace-4.2.98/kwin/effects.cpp:727
#8 0x00007f177c4b7abb in KWin::CoverSwitchEffect::abort (this=0x19c6230) at /build/buildd/kdebase-workspace-4.2.98/kwin/effects/coverswitch/coverswitch.cpp:1421
#9 0x00007f177c4bac80 in KWin::CoverSwitchEffect::prePaintScreen (this=0x19c6230, data=@0x7fff93ddc490, time=98)
    at /build/buildd/kdebase-workspace-4.2.98/kwin/effects/coverswitch/coverswitch.cpp:113
#10 0x00007f178b99145b in KWin::EffectsHandlerImpl::prePaintScreen (this=0x114d040, data=@0x7fff93ddc490, time=98) at /build/buildd/kdebase-workspace-4.2.98/kwin/effects.cpp:112
#11 0x00007f178b99145b in KWin::EffectsHandlerImpl::prePaintScreen (this=0x114d040, data=@0x7fff93ddc490, time=98) at /build/buildd/kdebase-workspace-4.2.98/kwin/effects.cpp:112
#12 0x00007f177c48ac5c in KWin::LoginEffect::prePaintScreen (this=0x12f9a50, data=@0x7fff93ddc490, time=98) at /build/buildd/kdebase-workspace-4.2.98/kwin/effects/login/login.cpp:52
#13 0x00007f178b99145b in KWin::EffectsHandlerImpl::prePaintScreen (this=0x114d040, data=@0x7fff93ddc490, time=98) at /build/buildd/kdebase-workspace-4.2.98/kwin/effects.cpp:112
#14 0x00007f178b99145b in KWin::EffectsHandlerImpl::prePaintScreen (this=0x114d040, data=@0x7fff93ddc490, time=98) at /build/buildd/kdebase-workspace-4.2.98/kwin/effects.cpp:112
#15 0x00007f178b99145b in KWin::EffectsHandlerImpl:...

to prevent forthcoming confusion:
the backtrace in comment #10 refers to the "kwin crashes when a window gets lost while tabbox+compositing" while thi bug is actually about apps crashing somewhere in QDragManager which get's irritated by (likely) fullscreen composite FX

the relation is that
a) the app segfaults for dnd during the fullscreen FX
b) it in consequence gets lost from the tabbox list and causes a segfault in KWin

still independent bugs, though

(In reply to comment #11)
> to prevent forthcoming confusion:
> the backtrace in comment #10 refers to the "kwin crashes when a window gets
> lost while tabbox+compositing"
Should the backtrace in comment #10 be reported in a new kwin bug report then?

not required, bug's already reported (several times...) i think martin plans an entire revamp of the tabbox

*** Bug 192780 has been marked as a duplicate of this bug. ***

*** Bug 211095 has been marked as a duplicate of this bug. ***

*** Bug 213909 has been marked as a duplicate of this bug. ***

*** Bug 196861 has been marked as a duplicate of this bug. ***

*** Bug 220533 has been marked as a duplicate of this bug. ***

*** Bug 220484 has been marked as a duplicate of this bug. ***

*** Bug 227468 has been marked as a duplicate of this bug. ***

*** Bug 234900 has been marked as a duplicate of this bug. ***

*** Bug 234901 has been marked as a duplicate of this bug. ***

Created attachment 48603
New crash information added by DrKonqi

The error occurs every time when im trying to drop a file from dolphin to a self-written Qt-application.
My application crashes also.

This bug existed ever since the very first release of KDE4, shouldn't this bug be confirmed by now? Given so many duplicates of this bug, there's no reason why this bug is still unconfirmed.

It is probably a Qt bug. Just search for QDrag in crashes, and you find a lot of them, in all applications.

*** Bug 209729 has been marked as a duplicate of this bug. ***

*** This bug has been confirmed by popular vote. ***

Created attachment 66913
New crash information added by DrKonqi

digikam (2.5.0) on KDE Platform 4.7.4 (4.7.4) using Qt 4.7.2

- What I was doing when the application crashed:

dragged image from digikam to gwenview and it crashed

-- Backtrace (Reduced):
#6 0x00007fed446f61cf in QWidget::testAttribute_helper(Qt::WidgetAttribute) const () from /usr/lib64/qt4/libQtGui.so.4
#7 0x00007fed446b334d in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/qt4/libQtGui.so.4
#8 0x00007fed453efe61 in KApplication::notify (this=0x7ffff6d87790, receiver=0x4ffc0f0, event=0x7ffff6d84a60) at /var/tmp/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kdeui/kernel/kapplication.cpp:311
#9 0x00007fed43a5fdeb in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib64/qt4/libQtCore.so.4
#10 0x00007fed446b1ad5 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) () from /usr/lib64/qt4/libQtGui.so.4

*** Bug 287303 has been marked as a duplicate of this bug. ***

https://bugreports.qt-project.org/browse/QTBUG-19363

also bug 203887 seems to be duplicate of this one.

it seems i have fixed the crash, it is a one-line fix in Qt, see my comment in QTBUG-19363

@Nick: Thanks in the name of all application-developers that suffer from this issue :-)

Am 27.02.2012 14:35, schrieb Peter Penz:
> @Nick: Thanks in the name of all application-developers that suffer
> from this
> issue :-)
also thanks in the name of all window manager developers who stopped to
implement quite handy features due to this bug (e.g. drag'n'drop through
PresentWindows - now I just need to find the working code again...)

i have created a review request fir the change:
http://codereview.qt-project.org/#change,17943

not so fast...

i played with drag-n-dropping further, and found several more crashes that are less easy to reproduce (they happen because dragPrivate() is 0 after the hovered window disappears). and although i fixed them by adding preliminary checks in qdnd_x11.cpp, often it is not possible to finish the drag-n-drop operation if any window disappears during it, even when we end up dropping on a correct window. (nothing happens).

so I conclude that the case of window disappearance during the drag is not handled at all either by Qt code, or X11 protocol itself.
we need to find a way to recover after Badwindow error message (in xdndHandleBadwindow)

Created attachment 71592
New crash information added by DrKonqi

konversation (1.4) on KDE Platform 4.8.3 (4.8.3) using Qt 4.8.1

- What I was doing when the application crashed:

drag a link from konversation to firefox, composite effects were enabled, i used alt-tab to switch
i could reproduce this crash once more, but the occurance is not very frequent.

-- Backtrace (Reduced):
#6 QDragManager::move (this=0xeb6b90, globalPos=...) at kernel/qdnd_x11.cpp:1630
#7 0x0000003ac0052af1 in QDragManager::eventFilter (this=0xeb6b90, o=<optimized out>, e=<optimized out>) at kernel/qdnd_x11.cpp:1304
#8 0x0000003abe375a0a in QCoreApplicationPrivate::sendThroughApplicationEventFilters (this=0xed80c0, receiver=0x177e150, event=0x7fffd4cdd410) at kernel/qcoreapplication.cpp:967
#9 0x0000003abffca3f6 in QApplicationPrivate::notify_helper (this=this@entry=0xed80c0, receiver=receiver@entry=0x177e150, e=e@entry=0x7fffd4cdd410) at kernel/qapplication.cpp:4529
#10 0x0000003abffcf20b in QApplication::notify (this=<optimized out>, receiver=0x177e150, e=0x7fffd4cdd410) at kernel/qapplication.cpp:4097

Different from Qt gtk+ does NOT seem to grab the pointer for DnD operations (i was still able to QCursor::setPos()) and therefore neither causes the issues on screen borders nor this nasty crash.

workaround for the particular window effects related crash
https://git.reviewboard.kde.org/r/105339/

Created attachment 73953
New crash information added by DrKonqi

digikam (2.8.0) on KDE Platform 4.9.00 "release 559" using Qt 4.8.2

- What I was doing when the application crashed:

Alt+Tab works when dragging files and switching directly to Dolphin, but crashes Digikam when I first switch to another program (that is, "pick up" file, Alt+Tab to Firefox, then Alt+Tab again to Dolphin, and drop file). Expected behaviour: start dialog to Move/Copy/Link.

-- Backtrace (Reduced):
#6 0x00007f91a3828b6f in QWidget::testAttribute_helper (this=0x50e4840, attribute=Qt::WA_Hover) at kernel/qwidget.cpp:11043
#7 0x00007f91a37ed72c in testAttribute (attribute=Qt::WA_Hover, this=0x50e4840) at ../../src/gui/kernel/qwidget.h:1042
#8 QApplication::notify (this=<optimized out>, receiver=<optimized out>, e=0x7fffe7629ae0) at kernel/qapplication.cpp:4116
#9 0x00007f91a5168d46 in KApplication::notify(QObject*, QEvent*) () from /usr/lib64/libkdeui.so.5
#10 0x00007f91a46e3d0c in QCoreApplication::notifyInternal (this=0x7fffe762c860, receiver=0x50e4840, event=0x7fffe7629ae0) at kernel/qcoreapplication.cpp:915

*** Bug 236705 has been marked as a duplicate of this bug. ***

Fixed upstream since Qt 4.8.4.

FYI: I just had Choqok crash on me with a backtrace nearly identical to the one in this bug report, using Qt 4.8.5, therefore with the fix for this bug. My situation doesn't involve alt+tab so it may indeed be something different. I opened this Qt bug report:

https://bugreports.qt-project.org/browse/QTBUG-38780