qtbase crash on Windows

[tsieger]

R crashes running some qtbase demos.

E.g. running the characterWidget demo results in:

> library(qtbase)
>  source('/src/qtbase-qt4-build-cleaned-test/qtbase/demo/characterWidget.R')
Program received signal SIGSEGV, Segmentation fault.
0x677536ca in ZN14QWidgetPrivate12showChildrenEb () from C:\Qt\4.8.6\bin\QtGui4.dll
(gdb) bt
#0  0x677536ca in ZN14QWidgetPrivate12showChildrenEb () from C:\Qt\4.8.6\bin\QtGui4.dll
#1  0x677537e3 in ZN14QWidgetPrivate11show_helperEv () from C:\Qt\4.8.6\bin\QtGui4.dll
#2  0x67755868 in ZN7QWidget10setVisibleEb () from C:\Qt\4.8.6\bin\QtGui4.dll
#3  0x06d67b37 in __smokeqt::x_QWidget::setVisible(bool) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#4  0x677536fc in ZN14QWidgetPrivate12showChildrenEb () from C:\Qt\4.8.6\bin\QtGui4.dll
#5  0x677537e3 in ZN14QWidgetPrivate11show_helperEv () from C:\Qt\4.8.6\bin\QtGui4.dll
#6  0x67755868 in ZN7QWidget10setVisibleEb () from C:\Qt\4.8.6\bin\QtGui4.dll
#7  0x06b42d87 in __smokeqt::x_QMainWindow::setVisible(bool) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#8  0x06a770c1 in QWidget::show() () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#9  0x06d6b063 in __smokeqt::x_QWidget::x_165(Smoke::StackItem*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#10 0x069e6676 in __smokeqt::xcall_QWidget(short, void*, Smoke::StackItem*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#11 0x0690e6bc in SmokeMethod::invoke (this=0xb175460, obj=0x49caa28, stack=0xb1716f0) at C:/src/qtbase-qt4/qtbase/src/SmokeMethod.cpp:20
#12 0x0691043b in MethodCall::invokeMethod (this=0x140c2e4) at C:/src/qtbase-qt4/qtbase/src/MethodCall.cpp:104
#13 0x06910356 in MethodCall::marshal (this=0x140c2e4) at C:/src/qtbase-qt4/qtbase/src/MethodCall.cpp:84
#14 0x069104dc in MethodCall::eval (this=0x140c2e4) at C:/src/qtbase-qt4/qtbase/src/MethodCall.cpp:117
#15 0x0690e559 in ForeignMethod::invoke (this=0xb175460, obj=0x6898298, args=0x67842a0) at C:/src/qtbase-qt4/qtbase/src/ForeignMethod.cpp:6
#16 0x06a1ed40 in SmokeMethod::invoke (this=0xb175460, obj=0x6898298, args=0x67842a0) at C:/src/qtbase-qt4/qtbase/src/SmokeMethod.hpp:78
#17 0x0690f79b in DynamicBinding::invoke (this=0x140c3c0, obj=0x6898298, args=0x67842a0) at C:/src/qtbase-qt4/qtbase/src/DynamicBinding.cpp:10
#18 0x0690a021 in qt_qinvoke (self=0x6898298, method=0x95fc9d0, super=0x95d3200, args=0x67842a0) at C:/src/qtbase-qt4/qtbase/src/invoke.cpp:17
#19 0x6c81c612 in Runzip () from C:\Program Files\R\R-3.1.0\bin\i386\R.dll
#20 0x0678b9c8 in ?? ()
#21 0x021a24a0 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

The sliders demo results in:

>  source('/src/qtbase-qt4-build-cleaned-test/qtbase/demo/sliders.R')
Program received signal SIGSEGV, Segmentation fault.
0x67895282 in ZrsR11QDataStreamR12QPaintBuffer () from C:\Qt\4.8.6\bin\QtGui4.dll

(Can't get stack trace in this case.)

Some other demos (groupBox, addressBook, widget) seem to work correctly.

Testing on:
Windows 7 SP1 32bit
R 3.1.0
Qt 4.8.6
qtbase branch qt4

[tsieger]

Similar behaviour experienced when using the master branch and building against Qt5.2.0 (still R 3.1.0, Win7 SP1 32bit). The characterWidget.R demo crashes while painting the grid:

> library(qtpaint)
Loading required package: qtbase
Learn more about Qt at http://qt.nokia.com
warning: Invalid parameter passed to C runtime function.

[New Thread 2712.0xb8c]
> source('/src/qtbase-141013-win32-fixes/qtbase/demo/characterWidget.R')
qt_qnewMetaObject() superdata: 62170064 QWidget
 // content:
       7,       // revision
       0,       // classname
       0,   14, // classinfo
       1,   14, // methods
       0,   19, // properties
       0,   0, // enums/sets
       0,   0, // constructors
       0,       // flags
       1,       // signal count

 // signals: name, param-count, typeinfo-offset, tag, flags
      1,   1,   19,   3, 0x46

 // properties: name, type, flags

 // notifies: signal

 // typeinfo: name, [param_type]*, [param_name]*
    43, 10, 2,

qt_meta_stringdata:
     "R::.GlobalEnv::CharacterWidget"
     "characterSelected"
     "character"
     ""

[New Thread 2712.0xf2c]
[New Thread 2712.0xb0c]
[New Thread 2712.0xc28]
[New Thread 2712.0xca4]

Program received signal SIGSEGV, Segmentation fault.
0x61c02cfb in ZN18QRasterPaintEngine17ensureRasterStateEv () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
(gdb) bt
#0  0x61c02cfb in ZN18QRasterPaintEngine17ensureRasterStateEv () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
#1  0x00000000 in ?? ()

Another attempt gives a stack trace:

Program received signal SIGSEGV, Segmentation fault.
0x61c02cfb in ZN18QRasterPaintEngine17ensureRasterStateEv () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
(gdb) bt
#0  0x61c02cfb in ZN18QRasterPaintEngine17ensureRasterStateEv () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
#1  0x0000001b in ?? ()
#2  0x049b3898 in ?? ()
#3  0x07660604 in __smokeqt::x_QPainter::x_99(Smoke::StackItem*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#4  0x07507ca0 in __smokeqt::xcall_QPainter(long, void*, Smoke::StackItem*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#5  0x0746e457 in SmokeMethod::invoke(SmokeObject*, Smoke::StackItem*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#6  0x074700e1 in MethodCall::invokeMethod() () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#7  0x0746fffc in MethodCall::marshal() () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#8  0x07470182 in MethodCall::eval() () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#9  0x0746e2c1 in ForeignMethod::invoke(SEXPREC*, SEXPREC*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#10 0x075dbf74 in SmokeMethod::invoke(SEXPREC*, SEXPREC*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#11 0x0746f453 in DynamicBinding::invoke(SEXPREC*, SEXPREC*) () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#12 0x07469bc1 in qt_qinvoke () from C:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#13 0x6c81c612 in Runzip () from C:\Program Files\R\R-3.1.0\bin\i386\R.dll
#14 0x04b2b7f4 in ?? ()
#15 0x048d24a0 in ?? ()
Cannot access memory at address 0x40000017

The sliders.R demo crashes after a while:

Program received signal SIGSEGV, Segmentation fault.
0x619438ad in ?? () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll

[lawremi]

Probably related to the event loop issues. Too many threads.

[tsieger]

Do you think it can be solved (in near future)? Or would some workaround help temporarily?

[lawremi]

It's weird how the trace (in both the 4.8 and 5.2 cases) start with the seemingly unrelated Runzip(). First would be to confirm the multi-thread hypothesis. One way would be to modify the paintEvent callback in that characterWidget demo to just print a debug message and then enter an infinite loop. If there is one thread, it should print the message only once. It could be that there is actually something wrong with QPainter, or how we are using it.

[tsieger]

Trying the test you propose I can see the debug print from within the modified qpaintEvent just once. Then, after a while (I can see some characters drawn by the mouseMoveEvent in the meantime), R crashes.
The same happens if I disable the call to qsetMethod("paintEvent", ... completely, e.g.:

> library(qtbase);source('C:/src/qtbase-141013-win32-fixes/qtbase/demo/charact$

[New Thread 2040.0xd14]

[...MOC debugs omitted...]

[New Thread 2040.0x774]
[New Thread 2040.0xcec]
[New Thread 2040.0x84c]
> [New Thread 2040.0xa04]
[New Thread 2040.0x8fc]

Program received signal SIGSEGV, Segmentation fault.
0x61df0cca in ZNK7QWidget14backgroundRoleEv () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Widgets.dll
(gdb) Exception condition detected on fd 0
error detected on stdin

[lawremi]

Yea, I'm pretty sure this is just due to accidental multi-threading and race conditions. The intern at Amazon tried to fix this by basically being more aggressive about updating in sync with R, but I think even Qt does not fare well when there are multiple threads. One test would be to run something via Rscript, i.e., something without the R Windows GUI. I'm pretty sure it's the Windows GUI that somehow drives the Qt event loop in a different thread.

[tsieger]

Previously, I did not use R win GUI, but Rterm.exe. However, the problem persists even when running via Rscript. It seems that the Qt event loop gets driven in thread 5, while the painter is active in thread 1.

Thread 1:

Program received signal SIGSEGV, Segmentation fault.
0x61c02cfb in ZN18QRasterPaintEngine17ensureRasterStateEv () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
(gdb) bt
#0  0x61c02cfb in ZN18QRasterPaintEngine17ensureRasterStateEv () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
#1  0x00000005 in ?? ()
#2  0x0c64f850 in ?? ()
#3  0x06c40604 in __smokeqt::x_QPainter::x_99(Smoke::StackItem*) () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#4  0x06ae7ca0 in __smokeqt::xcall_QPainter(long, void*, Smoke::StackItem*) () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#5  0x06a4e457 in SmokeMethod::invoke(SmokeObject*, Smoke::StackItem*) () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#6  0x06a500e1 in MethodCall::invokeMethod() () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#7  0x06a4fffc in MethodCall::marshal() () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#8  0x06a50182 in MethodCall::eval() () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#9  0x06a4e2c1 in ForeignMethod::invoke(SEXPREC*, SEXPREC*) () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#10 0x06bbbf74 in SmokeMethod::invoke(SEXPREC*, SEXPREC*) () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#11 0x06a4f453 in DynamicBinding::invoke(SEXPREC*, SEXPREC*) () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#12 0x06a49bc1 in qt_qinvoke () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#13 0x6c81c612 in Runzip () from c:\Program Files\R\R-3.1.0\bin\i386\R.dll
#14 0x04d56c00 in ?? ()
#15 0x024a24a0 in ?? ()
Cannot access memory at address 0x40000017

Thread 5:

#0  0x774c70b4 in ntdll!LdrFindResourceEx_U () from C:\Windows\system32\ntdll.dll
#1  0x75d24f51 in USER32!GetSystemMenu () from C:\Windows\system32\user32.dll
#2  0x75d21953 in USER32!GetNextDlgTabItem () from C:\Windows\system32\user32.dll
#3  0x75d1ada9 in USER32!SetClassLongW () from C:\Windows\system32\user32.dll
#4  0x06a41802 in run_callback() () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#5  0x06a41a57 in callback_input_handler() () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#6  0x06a416a7 in EventLoop::run() () from c:\Program Files\R\R-3.1.0\library\qtbase\libs\i386\qtbase.dll
#7  0x68895319 in ZN7QThread21setTerminationEnabledEb () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Core.dll
#8  0x75e898da in msvcrt!free () from C:\Windows\system32\msvcrt.dll
#9  0x5b1ba4fe in ?? ()
#10 0x04a05058 in ?? ()
#11 0x75e91287 in msvcrt!_itow_s () from C:\Windows\system32\msvcrt.dll
#12 0x75e91328 in msvcrt!_endthreadex () from C:\Windows\system32\msvcrt.dll
#13 0x75c73c45 in KERNEL32!AcquireSRWLockExclusive () from C:\Windows\system32\kernel32.dll
#14 0x774e37f5 in ntdll!RtlInsertElementGenericTableAvl () from C:\Windows\system32\ntdll.dll
#15 0x774e37c8 in ntdll!RtlInsertElementGenericTableAvl () from C:\Windows\system32\ntdll.dll
#16 0x00000000 in ?? ()

[lawremi]

That's actually on purpose. We run our own thread that is synchronized with the R event loop in thread 1. It should not cause any trouble. So many this bug is pointing at something deeper; it's just so hard to disentangle things when errors happen within Qt, and only on Windows.

[tsieger]

I'm ready to help with testing, limited debugging etc.

[lawremi]

Do you have the process for building it documented somewhere? I will just follow that and start debugging things. Thanks!

[tsieger]

Thanks!
Basically, I followed https://github.com/ggobi/cranvas/wiki/Installation-under-windows-32-bit.
Exceptions to these instructions included:

i) do not use g++ from RTools, but from MinGW, preferrably the one coming with/binary compatible with Qt. It seems that Qt 4.x (at least 4.8.2) asks for a specific version of MinGW. Qt 5.x (at least 5.2.1) comes with its own copy of MinGW (not sure if it gets installed by default).

ii) if you run into linking problems of multiple definition of _head_Qt5PrintSupport_dll, _head_Qt5XmlPatterns_dll, and _head_Qt5Test_dll, you may want to disable support for the Test, PrintSupport, and XmlPatterns Qt modules in CMakeFiles.txt in src and
kde-bindings/smoke/qt, see #30.

Note that the sed expression problem in qtbase/src/mkdef.sh and qtbase/src/CMakeLists.txt gets worked-around in the installation instructions by explicitly putting the sed expression into qtbase/src/mkdef.sh.

I can't guarantee this will work in general, but I think that's what worked for me on my Win7 VM. I can't get my hands on the VM just now to double check that, but I believe that the other issues have been fixed already.

[tsieger]

I've just rechecked the installation on Win7 32bit with:
R 3.1.0
RTools 3.1.0.1942
cmake 2.8.11
Qt 5.2.0 with minGW 4.8.0, qmake 3.0 and windres 2.32.2

To be more specific, I have the following environment variables set:

CMAKE=C:\Program Files\CMake 2.8\bin\cmake.exe
QMAKE=C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin
RC_COMPILER=C:\Qt\Qt5.2.0\Tools\mingw48_32\bin\windres.exe
PATH=C:\Qt\Qt5.2.0\Tools\mingw48_32\bin;
    C:\Rtools\bin;
    C:\Rtools\gcc-4.6.3\bin;
    C:\Program Files\R\R-3.1.0\bin;
    C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin;
    C:\Strawberry\perl\bin;
    C:\Strawberry\perl\site\bin;
    C:\Strawberry\c\bin;
    C:\Program Files\CMake 2.8\bin;
    [...other directories...]

[tsieger]

Just curious about the status - any news, please? Thanks.

[tsieger]

Taking a look at the weird stacktrace below (obtained under the same conditions as above) I'm curious whether the problem could not be related to some g++ problems on the windows platform. Or do you think that the stacktrace could simply be a problem of gdb having hard times to restore the stack frames? Not a demonstration of real problems with the qtbase built there?

Program received signal SIGSEGV, Segmentation fault.
0x61c02c9b in ZN18QRasterPaintEngine11ensureBrushERK6QBrush () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
(gdb) bt
#0  0x61c02c9b in ZN18QRasterPaintEngine11ensureBrushERK6QBrush () from C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\Qt5Gui.dll
#1  0x0d0522e8 in ?? ()
#2  0x06096000 in ?? ()
#3  0x0000000d in ?? ()
#4  0x409d0800 in ?? ()
#5  0xafd99701 in ?? ()
#6  0x409cb061 in ?? ()
#7  0x03682001 in ?? ()
#8  0x409cb80d in ?? ()
#9  0x00013601 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

BTW I've tried adding "-ggdb" to "set_target_properties" and/or "set(CMAKE_CXX_FLAGS "-m32 -ggdb")" in src/CMakeLists.txt, but with no effect.