Segfault after sending a message while a file is being uploaded

[arawaaa]

File uploading blocks messages

A segfault occurs when a message is sent while an attachment is in the process of being uploaded. The message can be sent without a crash after the POST request (for the attachment) returns 200.

Steps to reproduce

• Send a file, preferably large
• While quotient is uploading the file, send a message
• Crash

Version information

0.6 and master. Tested with neochat.

Relevant log:

#0 0x00007f32d8f5923f in () at /usr/lib64/libQt5Core.so.5
#1 0x00007f32d8f59bd4 in () at /usr/lib64/libQt5Core.so.5
#2 0x00007f32d8f52cef in QAbstractItemModelPrivate::itemsMoved(QModelIndex const&, int, int, QModelIndex const&, int, Qt::Orientation) () at /usr/lib64/libQt5Core.so.5
#3 0x00007f32d8f56c35 in QAbstractItemModel::endMoveRows() () at /usr/lib64/libQt5Core.so.5
#4 0x00000000004a4168 in operator() (__closure=0x43708f0) at `/home/arwat/kde/src/extragear/network/neochat/src/messageeventmodel.cpp:135`
this = 0x4298c40
#5 QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, MessageEventModel::setRoom(NeoChatRoom*)::<lambda()> >::call (arg=<optimized out>, f=...) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:146
#6 QtPrivate::Functor<MessageEventModel::setRoom(NeoChatRoom*)::<lambda()>, 0>::call<QtPrivate::List<>, void> (arg=<optimized out>, f=...) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:256
#7 QtPrivate::QFunctorSlotObject<MessageEventModel::setRoom(NeoChatRoom*)::<lambda()>, 0, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void **, bool *) (which=<optimized out>, this_=0x43708e0, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:443
#8 0x00007f32d8fe98c6 in () at /usr/lib64/libQt5Core.so.5
#9 0x00007f32db080755 in Quotient::Room::Private::addNewMessageEvents(std::vector<std::unique_ptr<Quotient::RoomEvent, std::default_delete<Quotient::RoomEvent> >, std::allocator<std::unique_ptr<Quotient::RoomEvent, std::default_delete<Quotient::RoomEvent> > > >&&) (this=0x142d950, events=...) at /home/arwat/kde/src/libquotient/lib/room.cpp:2369
pendingEvtIdx = 1
nextPendingPair = {first = std::unique_ptr<Quotient::RoomEvent> = {get() = 0x0}, second = }
remoteEcho = <synthetic pointer>
localEcho = <synthetic pointer>
nextPendingEvt = 0x523ad60
transfer = {status = Quotient::FileTransferInfo::None, job = {wp = {d = 0x0, value = 0x0}}, localFileInfo = {d_ptr = {d = 0x4c0a890}}, isUpload = false, progress = 0, total = -1}
it = std::unique_ptr<Quotient::RoomEvent> = {get() = 0x0}
roomChanges = {i = 0}
totalInserted = 1
from = 
#10 0x00007f32db081770 in Quotient::Room::updateData(Quotient::SyncRoomData&&, bool) (this=0x1cd3a00, data=..., fromCache=<optimized out>) at /home/arwat/kde/src/libquotient/lib/room.cpp:1541
roomChanges = {i = 0}
et = {t1 = 67643, t2 = 752122213}
#11 0x00007f32db059f11 in Quotient::Connection::Private::consumeRoomData(std::vector<Quotient::SyncRoomData, std::allocator<Quotient::SyncRoomData> >&&, bool) (this=0x1ada530, roomDataList=<optimized out>, fromCache=false) at /home/arwat/kde/src/libquotient/lib/connection.cpp:645
r = 0x1cd3a00
forgetIdx = <optimized out>
roomData = @0x7f32900ce8f0: {roomId = "!cpmtmNDfXhwZbeGGOz:matrix.org", joinState = Quotient::JoinState::Join, summary = {joinedMemberCount = {<std::optional<int>> = std::optional<int> [no contained value], <No data fields>}, invitedMemberCount = {<std::optional<int>> = std::optional<int> [no contained value], <No data fields>}, heroes = {<std::optional<QStringList>> = <error reading variable: Cannot access memory at address 0xc>{<std::_Optional_base<QStringList, false, false>> = {<std::_Optional_base_impl<QStringList, std::_Optional_base<QStringList, false, false> >> = {<No data fields>}, _M_payload = {<std::_Optional_payload<QStringList, true, false, false>> = {<std::_Optional_payload_base<QStringList>> = {_M_payload = {_M_empty = {<No data fields>}, _M_value = <error reading variable: Cannot access memory at address 0xc>{<QList<QString>> = <error reading variable: Cannot access memory at address 0xc>{<QListSpecialMethods<QString>> = {<No data fields>}, {p = {d = 0x0}, d = 0x0}}, <No data fields>}}, _M_engaged = false}, <No data fields>}, <No data fields>}}, <std::_Enable_copy_move<true, true, true, true, std::optional<QStringList> >> = {<No data fields>}, <No data fields>}, <No data fields>}}, state = std::vector of length 0, capacity 0, timeline = std::vector of length 1, capacity 1 = {std::unique_ptr<Quotient::RoomEvent> = {get() = 0x0}}, ephemeral = std::vector of length 0, capacity 0, accountData = std::vector of length 0, capacity 0, timelineLimited = false, timelinePrevBatch = "s1769769589_757284961_6599594_712082001_572126058_1962671_190804206_652615055_162011", unreadCount = -2, highlightCount = 0, notificationCount = 0}
__for_range = <optimized out>
#12 0x00007f32db05a281 in Quotient::Connection::onSyncSuccess(Quotient::SyncData&&, bool) (this=0x12f2c60, data=..., fromCache=<optimized out>) at /home/arwat/kde/src/libquotient/lib/connection.cpp:606
#13 0x00007f32db05a310 in operator() (__closure=0x1befc80) at /home/arwat/kde/src/libquotient/lib/connection.cpp:541
job = 0x52f23e0
this = 0x12f2c60
#14 QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, Quotient::Connection::sync(int)::<lambda()> >::call (arg=<optimized out>, f=...) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:146
#15 QtPrivate::Functor<Quotient::Connection::sync(int)::<lambda()>, 0>::call<QtPrivate::List<>, void> (arg=<optimized out>, f=...) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:256
#16 QtPrivate::QFunctorSlotObject<Quotient::Connection::sync(int)::<lambda()>, 0, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void **, bool *) (which=<optimized out>, this_=0x1befc70, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:443
#17 0x00007f32d8fe98c6 in () at /usr/lib64/libQt5Core.so.5
#18 0x00007f32db03bcd2 in Quotient::BaseJob::success(Quotient::BaseJob*) (this=this@entry=0x52f23e0, _t1=<optimized out>, _t1@entry=0x52f23e0) at /home/arwat/kde/build/libquotient/Quotient_autogen/3INUWTIJ2C/moc_basejob.cpp:542
_a = {0x0, 0x7ffe20650d58}
#19 0x00007f32db0adb89 in Quotient::BaseJob::finishJob() (this=0x52f23e0) at /home/arwat/kde/src/libquotient/lib/jobs/basejob.cpp:632
#20 0x00007f32d8fe98c6 in () at /usr/lib64/libQt5Core.so.5
#21 0x00007f32d93e25f8 in () at /usr/lib64/libQt5Network.so.5
#22 0x00007f32d8fdf311 in QObject::event(QEvent*) () at /usr/lib64/libQt5Core.so.5
#23 0x00007f32daa1550f in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib64/libQt5Widgets.so.5
#24 0x00007f32d8fb32ea in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib64/libQt5Core.so.5
#25 0x00007f32d8fb5d21 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () at /usr/lib64/libQt5Core.so.5
#26 0x00007f32d900b1b3 in () at /usr/lib64/libQt5Core.so.5
#27 0x00007f32d84d6e57 in g_main_context_dispatch () at /usr/lib64/libglib-2.0.so.0
#28 0x00007f32d84d71d8 in () at /usr/lib64/libglib-2.0.so.0
#29 0x00007f32d84d728f in g_main_context_iteration () at /usr/lib64/libglib-2.0.so.0
#30 0x00007f32d900a83f in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQt5Core.so.5
#31 0x00007f32d8fb1cab in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQt5Core.so.5
#32 0x00007f32d8fb9f20 in QCoreApplication::exec() () at /usr/lib64/libQt5Core.so.5
#33 0x0000000000484357 in main(int, char**) (argc=<optimized out>, argv=0x7ffe20651480) at /home/arwat/kde/src/extragear/network/neochat/src/main.cpp:174
app = <incomplete type>
about = {d = 0xc16ca0}
service = {<QObject> = {<No data fields>}, d = std::unique_ptr<KDBusServicePrivate> = {get() = 0xe1e270}}
clipboard = {<QObject> = {<No data fields>}, m_clipboard = 0xe0a310}
config = <optimized out>
fileTypeSingleton = {<QObject> = {<No data fields>}, d_ptr = {d = 0xe272d0}}
engine = <incomplete type>
parser = {d = 0xe7eb30}
rootObjects = QList<QObject *> (size = 1) = {[0] = 0x10ae810}

[TobiasFella]

I can't reproduce this; does this still happen for you?