Subject: Bug#1000755: stellarium: Dialog boxes cause segfault crash under Wayland

From: Gard Spreemann <[email-masked]>
Date: Sun, 28 Nov 2021 15:43:33 +0100

Package: stellarium
Version: 0.20.4-3
Severity: important
X-Debbugs-Cc: [email-masked]

Dear Maintainer,

When using Stellarium under Wayland, certain file picker dialogs cause
Stellarium to segfault. The bug is perhaps in Qt, but since I am unable
to reproduce it with any other Qt program (I tried several), I am filing
a bug for Stellarium since that is where I can observe it.

Steps to reproduce:

1: Launch Stellarium under Wayland (QT_QPA_PLATFORM=wayland).

2: Observe that much of the program works just fine.

3: Open a file picker dialog, such as under View -> Landscape ->
   Add/Remove -> Install a new landscape from a zip archive.

4: Observe segfault.

The same steps work fine under X11.

A backtrace follows.

-- Backtrace --

#0  QDialogButtonBoxPrivate::layoutButtons (this=0x555564867cb0) at widgets/qdialogbuttonbox.cpp:270
#1  0x00007ffff7b1bfd4 in QDialogButtonBoxPrivate::resetLayout (this=<optimized out>) at widgets/qdialogbuttonbox.cpp:218
#2  0x00007ffff7ba0bb2 in Ui_QFileDialog::setupUi (this=0x555563fb4290, QFileDialog=0x7fffffffcd10) at .uic/ui_qfiledialog.h:238
#3  0x00007ffff7b9afaf in QFileDialogPrivate::createWidgets (this=0x555564047b40) at dialogs/qfiledialog.cpp:3110
#4  0x00007ffff7b9c770 in QFileDialogPrivate::init (this=0x555564047b40, args=...) at dialogs/qfiledialog.cpp:3040
#5  0x00007ffff7b9d41d in QFileDialog::QFileDialog (this=0x7fffffffcd10, args=...) at dialogs/qfiledialog.cpp:390
#6  0x00007ffff7b9d4e2 in QFileDialog::getOpenFileUrl (parent=parent@entry=0x0, caption=..., dir=..., filter=..., selectedFilter=selectedFilter@entry=0x0, options=..., supportedSchemes=...) at dialogs/qfiledialog.cpp:2259
#7  0x00007ffff7b9d7b2 in QFileDialog::getOpenFileName (parent=parent@entry=0x0, caption=..., dir=..., filter=..., selectedFilter=selectedFilter@entry=0x0, options=...) at dialogs/qfiledialog.cpp:2210
#8  0x0000555555893c4e in AddRemoveLandscapesDialog::browseForArchiveClicked (this=0x55556406c810) at ./src/gui/AddRemoveLandscapesDialog.cpp:118
#9  0x00007ffff6907df8 in ?? () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#10 0x00007ffff7a72222 in QAbstractButton::clicked (this=this@entry=0x55556385e270, _t1=<optimized out>) at .moc/moc_qabstractbutton.cpp:308
#11 0x00007ffff7a7249a in QAbstractButtonPrivate::emitClicked (this=0x555562bd6260) at widgets/qabstractbutton.cpp:415
#12 0x00007ffff7a74060 in QAbstractButtonPrivate::click (this=0x555562bd6260) at widgets/qabstractbutton.cpp:408
#13 0x00007ffff7a74283 in QAbstractButton::mouseReleaseEvent (this=0x55556385e270, e=0x7fffffffd520) at widgets/qabstractbutton.cpp:1044
#14 0x00007ffff79c131e in QWidget::event (this=0x55556385e270, event=0x7fffffffd520) at kernel/qwidget.cpp:9019
#15 0x00007ffff797f6af in QApplicationPrivate::notify_helper (this=this@entry=0x5555566df060, receiver=receiver@entry=0x55556385e270, e=e@entry=0x7fffffffd520) at kernel/qapplication.cpp:3632
#16 0x00007ffff79871b4 in QApplication::notify (this=<optimized out>, receiver=0x55556385e270, e=0x7fffffffd520) at kernel/qapplication.cpp:3076
#17 0x00007ffff68d175a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#18 0x00007ffff7985cc3 in QApplicationPrivate::sendMouseEvent (receiver=0x55556385e270, event=event@entry=0x7fffffffd520, alienWidget=alienWidget@entry=0x55556385e270, nativeWidget=0x555563456d60, buttonDown=buttonDown@entry=0x7fffffffd4b8, lastMouseReceiver=..., spontaneous=true, 
    onlyDispatchEnterLeave=false) at kernel/qapplication.cpp:2614
#19 0x00007ffff7ca6256 in QGraphicsProxyWidgetPrivate::sendWidgetMouseEvent (this=0x555563faaa10, event=0x7fffffffd8a0) at graphicsview/qgraphicsproxywidget.cpp:309
#20 0x00007ffff7c90188 in QGraphicsItem::sceneEvent (this=0x5555647fc3e0, event=0x7fffffffd8a0) at graphicsview/qgraphicsitem.cpp:6928
#21 0x00007ffff7cb2d71 in QGraphicsScenePrivate::sendMouseEvent (this=this@entry=0x555556ac5290, mouseEvent=mouseEvent@entry=0x7fffffffd8a0) at graphicsview/qgraphicsscene.cpp:1335
#22 0x00007ffff7cb88fc in QGraphicsScene::mouseReleaseEvent (this=<optimized out>, mouseEvent=0x7fffffffd8a0) at graphicsview/qgraphicsscene.cpp:4123
#23 0x00007ffff7cc54f1 in QGraphicsScene::event (this=0x555556892c60, event=0x7fffffffd8a0) at graphicsview/qgraphicsscene.cpp:3436
#24 0x00007ffff797f6af in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x555556892c60, e=0x7fffffffd8a0) at kernel/qapplication.cpp:3632
#25 0x00007ffff68d175a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#26 0x00007ffff7ce2cc0 in QGraphicsView::mouseReleaseEvent (this=0x7fffffffe5d0, event=0x7fffffffde50) at graphicsview/qgraphicsview.cpp:3430
#27 0x00007ffff79c131e in QWidget::event (this=0x7fffffffe5d0, event=0x7fffffffde50) at kernel/qwidget.cpp:9019
#28 0x00007ffff7a6d74e in QFrame::event (this=0x7fffffffe5d0, e=0x7fffffffde50) at widgets/qframe.cpp:550
#29 0x00007ffff68d14c2 in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#30 0x00007ffff797f69e in QApplicationPrivate::notify_helper (this=this@entry=0x5555566df060, receiver=receiver@entry=0x555556a3aa50, e=e@entry=0x7fffffffde50) at kernel/qapplication.cpp:3626
#31 0x00007ffff79871b4 in QApplication::notify (this=<optimized out>, receiver=0x555556a3aa50, e=0x7fffffffde50) at kernel/qapplication.cpp:3076
#32 0x00007ffff68d175a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#33 0x00007ffff7985cc3 in QApplicationPrivate::sendMouseEvent (receiver=receiver@entry=0x555556a3aa50, event=event@entry=0x7fffffffde50, alienWidget=alienWidget@entry=0x555556a3aa50, nativeWidget=0x7fffffffe5d0, buttonDown=<optimized out>, lastMouseReceiver=..., spontaneous=true, 
    onlyDispatchEnterLeave=false) at kernel/qapplication.cpp:2614
#34 0x00007ffff79da3ec in QWidgetWindow::handleMouseEvent (this=0x555556b25a40, event=0x7fffffffe120) at kernel/qwidgetwindow.cpp:683
#35 0x00007ffff79dd655 in QWidgetWindow::event (this=0x555556b25a40, event=0x7fffffffe120) at kernel/qwidgetwindow.cpp:300
#36 0x00007ffff797f6af in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x555556b25a40, e=0x7fffffffe120) at kernel/qapplication.cpp:3632
#37 0x00007ffff68d175a in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#38 0x00007ffff7178fc7 in QGuiApplicationPrivate::processMouseEvent (e=0x55556485bc50) at kernel/qguiapplication.cpp:2282
#39 0x00007ffff714f1cc in QWindowSystemInterface::sendWindowSystemEvents (flags=...) at kernel/qwindowsysteminterface.cpp:1169
#40 0x00007ffff2a8f950 in ?? () from /lib/x86_64-linux-gnu/libQt5WaylandClient.so.5
#41 0x00007ffff5700c7b in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#42 0x00007ffff5700f28 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#43 0x00007ffff5700fdf in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#44 0x00007ffff6928db4 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#45 0x00007ffff68d016b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#46 0x00007ffff68d8440 in QCoreApplication::exec() () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#47 0x00007ffff716cbcc in QGuiApplication::exec () at kernel/qguiapplication.cpp:1867
#48 0x00007ffff797f625 in QApplication::exec () at kernel/qapplication.cpp:2824
#49 0x00005555557d64cf in main (argc=<optimized out>, argv=<optimized out>) at ./src/main.cpp:390

-- End of backtrace --

-- System Information:
Debian Release: bookworm/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.15.0-1-amd64 (SMP w/6 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages stellarium depends on:
ii  libc6                     2.32-4
ii  libgcc-s1                 11.2.0-10
ii  libqt5core5a              5.15.2+dfsg-13
ii  libqt5gui5                5.15.2+dfsg-13
ii  libqt5multimedia5         5.15.2-3
ii  libqt5multimediawidgets5  5.15.2-3
ii  libqt5network5            5.15.2+dfsg-13
ii  libqt5positioning5        5.15.2+dfsg-3
ii  libqt5printsupport5       5.15.2+dfsg-13
ii  libqt5script5             5.15.2+dfsg-2
ii  libqt5serialport5         5.15.2-2
ii  libqt5widgets5            5.15.2+dfsg-13
ii  libstdc++6                11.2.0-10
ii  stellarium-data           0.20.4-3
ii  zlib1g                    1:1.2.11.dfsg-2

stellarium recommends no packages.

stellarium suggests no packages.

-- no debconf information

---

From: Bernhard Übelacker <[email-masked]>
Date: Sat, 9 Jul 2022 17:24:32 +0200

Control: tags -1 + moreinfo unreproducible

Hello Gard,
I tried to reproduce the issue with current bookworm/testing.
But inside a minimal VM running a plasma wayland session following
the given steps I was not able to trigger the crash any more.
This was with stellarium 0.22.1-1.

Can you still observe this crash at your side?

Kind regards,
Bernhard

---

From: Gard Spreemann <[email-masked]>
Date: Sun, 17 Jul 2022 17:51:43 +0200

> Can you still observe this crash at your side?

Hi,

Still reproducible here on 0.22.1-1, , sorry to say. Could it be that
this is some kind of video hardware issue? I'm seeing this on Intel
graphics.

 Best,
 Gard

---

From: Bernhard Übelacker <[email-masked]>
Date: Sun, 17 Jul 2022 19:09:43 +0200

Control: tags -1 - moreinfo unreproducible

Hello Gard,
tried to reproduce on real hardware with an older Intel integrated
graphics, but It still did not crash for me, sorry.

One thing to test might be to add another user and check if the crash
happens there too.

Otherwise the maintainer might be able to reproduce.

Kind regards
Bernhard

---

From: Gard Spreemann <[email-masked]>
Date: Mon, 18 Jul 2022 16:37:39 +0200

> Otherwise the maintainer might be able to reproduce.

Very strange! Thanks for checking. I'll see if I can find any more
clues.

 Best,
 Gard