gui modified object after free crashed under QStrokerOps::QStrokerOps

[timeless]

• Host: OS X 10.6.4 x64
• Guest: Haiku r1a2 -- ​http://ftp.lip6.fr/pub/haiku/releases/r1alpha2/haiku-r1alpha2-vmdk.zip

Exception Type:  EXC_CRASH (SIGABRT)

Application Specific Information:
*** error for object 0x10284a208: incorrect checksum for freed object - object was probably modified after being freed.


Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   __kill + 10
1   abort + 83
2   szone_error + 519
3   small_malloc_from_free_list + 473
4   szone_malloc_should_clear + 1951
5   malloc_zone_malloc + 82
6   malloc + 44
7   QStrokerOps::QStrokerOps() + 39
8   QStroker::QStroker() + 17
9   QRasterPaintEngine::QRasterPaintEngine(QPaintDevice*) + 138
10  QImage::paintEngine() const + 81
11  QPainter::begin(QPaintDevice*) + 279
12  QPainter::QPainter(QPaintDevice*) + 296
13  QPainterPrivate::draw_helper(QPainterPath const&, QPainterPrivate::DrawOperation) + 799
14  QPainter::drawRects(QRect const*, int) + 689
15  QPainter::fillRect(QRect const&, QBrush const&) + 197
16  QMacStyle::drawPrimitive(QStyle::PrimitiveElement, QStyleOption const*, QPainter*, QWidget const*) const + 579
17  QStyleSheetStyle::drawPrimitive(QStyle::PrimitiveElement, QStyleOption const*, QPainter*, QWidget const*) const + 242
18  QStatusBar::paintEvent(QPaintEvent*) + 158
19  QWidget::event(QEvent*) + 2094

Steps

1. Start Haiku
2. Open haiku 3d demo
3. frantically resize the 3d demo app window

Results

GUI crashes

[timeless]

VBox.log

[timeless]

os x crash report

[Niel Lambrechts]

I have virtually the same crash, except the function is QRasterPaintEngine::init() and I don't resize anything - it happens when I start Linux (different flavours) in VirtualBox.

[Niel Lambrechts]

OSX 10.6.5 (64-bit) VirtualBox 3.2.8 crash file

[Niel Lambrechts]

I should perhaps also mention that VirtualBox will crash about 3-5 times, after which another retry Linux is able to successfully start up.