A frequent occurance for me on recent versions of Debian/Unstable is for
gwenview to crash on exit.  For most uses it was intermittant but I have found
a case where it's 100% repeatable.  I run "gwenview ." in a directory with 3
pics of my car engine (which I am happy to supply as test data if needed) and
then press ALT-F4 without viewing any of the images (it just displays the
thumbnails) and it crashes.

Here's the backtrace:

malloc_consolidate(): unaligned fastbin chunk detected

Thread 1 "gwenview" received signal SIGABRT, Aborted.
__pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
warning: 44	./nptl/pthread_kill.c: No such file or directory
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007ffff4e9de2f in __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  0x00007ffff4e49d02 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007ffff4e324f0 in __GI_abort () at ./stdlib/abort.c:79
#4  0x00007ffff4e3332d in __libc_message_impl (fmt=fmt@entry=0x7ffff4fb5303 "%s\n") at ../sysdeps/posix/libc_fatal.c:134
#5  0x00007ffff4ea7965 in malloc_printerr (str=str@entry=0x7ffff4fb8358 "malloc_consolidate(): unaligned fastbin chunk detected") at ./malloc/malloc.c:5772
#6  0x00007ffff4ea849c in malloc_consolidate (av=av@entry=0x7ffff4ff1ac0 <main_arena>) at ./malloc/malloc.c:4846
#7  0x00007ffff4ea9680 in _int_free_maybe_consolidate (av=av@entry=0x7ffff4ff1ac0 <main_arena>, size=<optimized out>) at ./malloc/malloc.c:4779
#8  0x00007ffff4ea9960 in _int_free_maybe_consolidate (av=0x7ffff4ff1ac0 <main_arena>, size=<optimized out>) at ./malloc/malloc.c:4702
#9  0x00007ffff4ea9cb9 in _int_free (av=0x7ffff4ff1ac0 <main_arena>, p=<optimized out>, have_lock=<optimized out>, have_lock@entry=0) at ./malloc/malloc.c:4646
#10 0x00007ffff4eac43f in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3398
#11 0x00007ffff7cf4c5b in Gwenview::ImageMetaInfoModel::~ImageMetaInfoModel() () at /lib/x86_64-linux-gnu/libgwenviewlib.so.5
#12 0x00007ffff7caf57e in Gwenview::Document::~Document() () at /lib/x86_64-linux-gnu/libgwenviewlib.so.5
#13 0x00007ffff7caf69d in Gwenview::Document::~Document() () at /lib/x86_64-linux-gnu/libgwenviewlib.so.5
#14 0x00007ffff7cb3b11 in Gwenview::DocumentFactory::~DocumentFactory() () at /lib/x86_64-linux-gnu/libgwenviewlib.so.5
#15 0x00007ffff4e4c261 in __run_exit_handlers (status=0, listp=0x7ffff4ff1680 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at ./stdlib/exit.c:108
#16 0x00007ffff4e4c31a in __GI_exit (status=<optimized out>) at ./stdlib/exit.c:138
#17 0x00007ffff4e33d6f in __libc_start_call_main (main=main@entry=0x555555596690, argc=argc@entry=2, argv=argv@entry=0x7fffffffe3b8) at ../sysdeps/nptl/libc_start_call_main.h:74
#18 0x00007ffff4e33e25 in __libc_start_main_impl (main=0x555555596690, argc=2, argv=0x7fffffffe3b8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe3a8) at ../csu/libc-start.c:360
#19 0x00005555555971b1 in ??? ()
(gdb)

I tried running it under valgrind and got many errors like the following:

==1107437== Conditional jump or move depends on uninitialised value(s)
==1107437==    at 0x2847EEA4: ???
==1107437==    by 0x23977831: ???

Fixing those might shed some light on the issue.

Any change you can do a local modified gwenview build (without libcfitsio-dev
available)

At least the code from the failing point looks a bit fishy if cfitsio is found
during build.

It should be a autodetectable feature if found.

/Sune

Any change you can do a local modified gwenview build (without libcfitsio-dev
available)

At least the code from the failing point looks a bit fishy if cfitsio is found
during build.

It should be a autodetectable feature if found.

/Sune

I did that and it still crashes.  Not 100% of the time though.  Here's 3
different backtraces.  So it looks like memory is being messed up somewhere.

(gdb) bt
#0  0x00007ffff3d6d349 in mnt_monitor_close_fd () at /lib/x86_64-linux-gnu/
libmount.so.1
#1  0x00007ffff3d6d455 in mnt_unref_monitor () at /lib/x86_64-linux-gnu/
libmount.so.1
#2  0x00007ffff410195e in ??? () at /lib/x86_64-linux-gnu/libKF6Solid.so.6
#3  0x00007ffff4e4c261 in __run_exit_handlers (status=0, listp=0x7ffff4ff1680
<__exit_funcs>, run_list_atexit=run_list_atexit@entry=true,
run_dtors=run_dtors@entry=true) at ./stdlib/exit.c:108
#4  0x00007ffff4e4c31a in __GI_exit (status=<optimized out>) at ./stdlib/
exit.c:138
#5  0x00007ffff4e33d6f in __libc_start_call_main
(main=main@entry=0x5555555955c0 <main(int, char**)>, argc=argc@entry=2,
argv=argv@entry=0x7fffffffe3b8) at ../sysdeps/nptl/libc_start_call_main.h:74
#6  0x00007ffff4e33e25 in __libc_start_main_impl (main=0x5555555955c0
<main(int, char**)>, argc=2, argv=0x7fffffffe3b8, init=<optimized out>,
fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe3a8)
    at ../csu/libc-start.c:360
#7  0x00005555555960e1 in _start ()
(gdb)

(gdb) bt
#0  0x00007ffff3d6d319 in mnt_monitor_close_fd () at /lib/x86_64-linux-gnu/
libmount.so.1
#1  0x00007ffff3d6d455 in mnt_unref_monitor () at /lib/x86_64-linux-gnu/
libmount.so.1
#2  0x00007ffff410195e in ??? () at /lib/x86_64-linux-gnu/libKF6Solid.so.6
#3  0x00007ffff4e4c261 in __run_exit_handlers (status=0, listp=0x7ffff4ff1680
<__exit_funcs>, run_list_atexit=run_list_atexit@entry=true,
run_dtors=run_dtors@entry=true) at ./stdlib/exit.c:108
#4  0x00007ffff4e4c31a in __GI_exit (status=<optimized out>) at ./stdlib/
exit.c:138
#5  0x00007ffff4e33d6f in __libc_start_call_main
(main=main@entry=0x5555555955c0 <main(int, char**)>, argc=argc@entry=2,
argv=argv@entry=0x7fffffffe3b8) at ../sysdeps/nptl/libc_start_call_main.h:74
#6  0x00007ffff4e33e25 in __libc_start_main_impl (main=0x5555555955c0
<main(int, char**)>, argc=2, argv=0x7fffffffe3b8, init=<optimized out>,
fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe3a8)
    at ../csu/libc-start.c:360
#7  0x00005555555960e1 in _start ()
(gdb)

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007ffff4e9de2f in __pthread_kill_internal (threadid=<optimized out>,
signo=6) at ./nptl/pthread_kill.c:78
#2  0x00007ffff4e49d02 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/
raise.c:26
#3  0x00007ffff4e324f0 in __GI_abort () at ./stdlib/abort.c:79
#4  0x00007ffff4e3332d in __libc_message_impl (fmt=fmt@entry=0x7ffff4fb5303
"%s\n") at ../sysdeps/posix/libc_fatal.c:134
#5  0x00007ffff4ea7965 in malloc_printerr (str=str@entry=0x7ffff4fb3082
"free(): invalid pointer") at ./malloc/malloc.c:5772
#6  0x00007ffff4ea9bf4 in _int_free (av=0x7ffff4ff1ac0 <main_arena>,
p=<optimized out>, have_lock=have_lock@entry=0) at ./malloc/malloc.c:4507
#7  0x00007ffff4eac43f in __GI___libc_free (mem=<optimized out>) at ./malloc/
malloc.c:3398
#8  0x00007ffff410195e in ??? () at /lib/x86_64-linux-gnu/libKF6Solid.so.6
#9  0x00007ffff4e4c261 in __run_exit_handlers (status=0, listp=0x7ffff4ff1680
<__exit_funcs>, run_list_atexit=run_list_atexit@entry=true,
run_dtors=run_dtors@entry=true) at ./stdlib/exit.c:108
#10 0x00007ffff4e4c31a in __GI_exit (status=<optimized out>) at ./stdlib/
exit.c:138
#11 0x00007ffff4e33d6f in __libc_start_call_main
(main=main@entry=0x5555555955c0 <main(int, char**)>, argc=argc@entry=2,
argv=argv@entry=0x7fffffffe3b8) at ../sysdeps/nptl/libc_start_call_main.h:74
#12 0x00007ffff4e33e25 in __libc_start_main_impl (main=0x5555555955c0
<main(int, char**)>, argc=2, argv=0x7fffffffe3b8, init=<optimized out>,
fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe3a8)
    at ../csu/libc-start.c:360
#13 0x00005555555960e1 in _start ()
(gdb)


The following exerpts from valgrind output seem relevant and relate to one of
the first two backtraces above.

==1139484== Invalid read of size 4
==1139484==    at 0x8AA4060: ??? (in /usr/lib/x86_64-linux-gnu/libmount.so.
1.1.0)
==1139484==    by 0x8AA533E: mnt_monitor_close_fd (in /usr/lib/x86_64-linux-
gnu/libmount.so.1.1.0)
==1139484==    by 0x8AA5454: mnt_unref_monitor (in /usr/lib/x86_64-linux-gnu/
libmount.so.1.1.0)
==1139484==    by 0x876995D: ??? (in /usr/lib/x86_64-linux-gnu/libKF6Solid.so.
6.10.0)
==1139484==    by 0x753E260: __run_exit_handlers (exit.c:108)
==1139484==    by 0x753E319: exit (exit.c:138)
==1139484==    by 0x7525D6E: (below main) (libc_start_call_main.h:74)
==1139484==  Address 0x10566f58 is 8 bytes inside a block of size 1,152 free'd
==1139484==    at 0x484687F: free (in /usr/libexec/valgrind/
vgpreload_memcheck-amd64-linux.so)
==1139484==    by 0x9FF6085: xkb_keymap_unref (in /usr/lib/x86_64-linux-gnu/
libxkbcommon.so.0.0.0)
==1139484==    by 0x7D1679D:
QtWaylandClient::QWaylandInputDevice::Keyboard::~Keyboard() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D176A8:
QtWaylandClient::QWaylandInputDevice::~QWaylandInputDevice() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D059B4:
QtWaylandClient::QWaylandDisplay::~QWaylandDisplay() (in /usr/lib/x86_64-
linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D1DB9D:
QtWaylandClient::QWaylandIntegration::~QWaylandIntegration() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D1DC1C:
QtWaylandClient::QWaylandIntegration::~QWaylandIntegration() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x6412628: QGuiApplicationPrivate::~QGuiApplicationPrivate()
(in /usr/lib/x86_64-linux-gnu/libQt6Gui.so.6.7.2)
==1139484==    by 0x5C2B23C: QApplicationPrivate::~QApplicationPrivate() (in /
usr/lib/x86_64-linux-gnu/libQt6Widgets.so.6.7.2)
==1139484==    by 0x149EA8: main (main.cpp:222)

==1139484== Invalid read of size 8
==1139484==    at 0x8AA533F: mnt_monitor_close_fd (in /usr/lib/x86_64-linux-
gnu/libmount.so.1.1.0)
==1139484==    by 0x8AA5454: mnt_unref_monitor (in /usr/lib/x86_64-linux-gnu/
libmount.so.1.1.0)
==1139484==    by 0x876995D: ??? (in /usr/lib/x86_64-linux-gnu/libKF6Solid.so.
6.10.0)
==1139484==    by 0x753E260: __run_exit_handlers (exit.c:108)
==1139484==    by 0x753E319: exit (exit.c:138)
==1139484==    by 0x7525D6E: (below main) (libc_start_call_main.h:74)
==1139484==  Address 0x10566f70 is 32 bytes inside a block of size 1,152
free'd
==1139484==    at 0x484687F: free (in /usr/libexec/valgrind/
vgpreload_memcheck-amd64-linux.so)
==1139484==    by 0x9FF6085: xkb_keymap_unref (in /usr/lib/x86_64-linux-gnu/
libxkbcommon.so.0.0.0)
==1139484==    by 0x7D1679D:
QtWaylandClient::QWaylandInputDevice::Keyboard::~Keyboard() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D176A8:
QtWaylandClient::QWaylandInputDevice::~QWaylandInputDevice() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D059B4:
QtWaylandClient::QWaylandDisplay::~QWaylandDisplay() (in /usr/lib/x86_64-
linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D1DB9D:
QtWaylandClient::QWaylandIntegration::~QWaylandIntegration() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x7D1DC1C:
QtWaylandClient::QWaylandIntegration::~QWaylandIntegration() (in /usr/lib/
x86_64-linux-gnu/libQt6WaylandClient.so.6.7.2)
==1139484==    by 0x6412628: QGuiApplicationPrivate::~QGuiApplicationPrivate()
(in /usr/lib/x86_64-linux-gnu/libQt6Gui.so.6.7.2)
==1139484==    by 0x5C2B23C: QApplicationPrivate::~QApplicationPrivate() (in /
usr/lib/x86_64-linux-gnu/libQt6Widgets.so.6.7.2)
==1139484==    by 0x149EA8: main (main.cpp:222)


Even if you can't reproduce a crash you can probably get valgrind to flag some
errors.

As an aside this workstation I'm testing on has 256G of RAM which possibly
could change algorithms used for malloc libraries.  I'm just guessing at why
the error appears on my system but apparently other people have it work OK.

Here's a full trace from Valgrind when waitpid() is called with a bad
parameter.

==251974== Syscall param waitid(infop) points to unaddressable byte(s)
==251974==    at 0x760C6F9: syscall (syscall.S:38)
==251974==    by 0x70700F2: UnknownInlinedFun (forkfd_linux.c:67)
==251974==    by 0x70700F2: UnknownInlinedFun (forkfd_linux.c:128)
==251974==    by 0x70700F2: UnknownInlinedFun (forkfd_linux.c:141)
==251974==    by 0x70700F2: UnknownInlinedFun (forkfd_linux.c:137)
==251974==    by 0x70700F2: UnknownInlinedFun (forkfd_linux.c:165)
==251974==    by 0x70700F2: vforkfd.constprop.0 (forkfd.c:814)
==251974==    by 0x70940C9: UnknownInlinedFun (qprocess_unix.cpp:325)
==251974==    by 0x70940C9: UnknownInlinedFun (qprocess_unix.cpp:1319)
==251974==    by 0x70940C9: int (anonymous
namespace)::QChildProcess::doFork<QProcessPrivate::startDetached(long long*)::
{lambda()#1}>(QProcessPrivate::startDetached(long long*)::{lambda()#1}&&)
[clone .isra.0] (qprocess_unix.cpp:318)
==251974==    by 0x6FDDF91: QProcessPrivate::startDetached(long long*)
(qprocess_unix.cpp:1312)
==251974==    by 0x50A54FF: UnknownInlinedFun (worker.cpp:457)
==251974==    by 0x50A54FF: UnknownInlinedFun (worker.cpp:368)
==251974==    by 0x50A54FF: UnknownInlinedFun (scheduler.cpp:417)
==251974==    by 0x50A54FF: KIO::ProtoQueue::startAJob() [clone .part.0]
(scheduler.cpp:504)
==251974==    by 0x6E8EAEE: UnknownInlinedFun (qobjectdefs_impl.h:469)
==251974==    by 0x6E8EAEE: void doActivate<false>(QObject*, int, void**)
(qobject.cpp:4086)
==251974==    by 0x6E912CD: QTimer::timeout(QTimer::QPrivateSignal)
(moc_qtimer.cpp:224)
==251974==    by 0x6E80F98: QObject::event(QEvent*) (qobject.cpp:1427)
==251974==    by 0x5C380A1: QApplicationPrivate::notify_helper(QObject*,
QEvent*) (in /usr/lib/x86_64-linux-gnu/libQt6Widgets.so.6.7.2)
==251974==    by 0x6E40927: QCoreApplication::notifyInternal2(QObject*,
QEvent*) (qcoreapplication.cpp:1142)
==251974==    by 0x6F84699: QTimerInfoList::activateTimers()
(qtimerinfo_unix.cpp:434)
==251974==    by 0x704782B: timerSourceDispatch(_GSource*, int (*)(void*),
void*) (qeventdispatcher_glib.cpp:150)
==251974==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==251974==
==251975== Warning: invalid file descriptor -1 in syscall close()