Qt client Crashes when Removing more than 1 Torrent

[stdisease]

This crash was triggered when attempting to remove 2 torrents at once from the list.

Steps to reproduce:
Add 2 torrents, if necessary.
Select them both.
Right Click -> Remove.
*Crash*

SVN: r10277
Qt: 4.6.1
Arch: x86_64

-- Backtrace

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5eb630c in QVariant::toString() const () from /usr/lib/libQtCore.so.4
      
#0  0x00007ffff5eb630c in QVariant::toString() const () from /usr/lib/libQtCore.so.4
#1  0x000000000047eaab in Torrent::getString (this=0x0, i=5) at torrent.cc:314
#2  0x0000000000484c13 in Torrent::name (this=0x0) at torrent.h:205
#3  0x00000000004835f0 in TorrentDelegate::sizeHint (this=0xaaf400, option=..., tor=...)
    at torrent-delegate.cc:256
#4  0x0000000000483a44 in TorrentDelegate::sizeHint (this=0xaaf400, option=..., index=...)
    at torrent-delegate.cc:278
#5  0x00007ffff6bd7d43 in ?? () from /usr/lib/libQtGui.so.4
#6  0x00007ffff6bdc18d in ?? () from /usr/lib/libQtGui.so.4
#7  0x00007ffff6bdc408 in ?? () from /usr/lib/libQtGui.so.4
#8  0x00007ffff6bd1c20 in ?? () from /usr/lib/libQtGui.so.4
#9  0x00007ffff6bd1fdf in QListView::doItemsLayout() () from /usr/lib/libQtGui.so.4
#10 0x00007ffff6bb1234 in QAbstractItemView::timerEvent(QTimerEvent*) ()
   from /usr/lib/libQtGui.so.4
#11 0x00007ffff5ea56b3 in QObject::event(QEvent*) () from /usr/lib/libQtCore.so.4
#12 0x00007ffff66e9a6f in QWidget::event(QEvent*) () from /usr/lib/libQtGui.so.4
#13 0x00007ffff6a900a6 in QFrame::event(QEvent*) () from /usr/lib/libQtGui.so.4
#14 0x00007ffff6b1b4bb in QAbstractScrollArea::event(QEvent*) () from /usr/lib/libQtGui.so.4
#15 0x00007ffff6bb7efb in QAbstractItemView::event(QEvent*) () from /usr/lib/libQtGui.so.4
#16 0x00007ffff669407c in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /usr/lib/libQtGui.so.4
#17 0x00007ffff669a66b in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4
#18 0x00007ffff5e95c5c in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
   from /usr/lib/libQtCore.so.4
#19 0x00007ffff5ec2982 in ?? () from /usr/lib/libQtCore.so.4
#20 0x00007ffff5ebf478 in ?? () from /usr/lib/libQtCore.so.4
#21 0x00007ffff349fdf2 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#22 0x00007ffff34a3c38 in ?? () from /lib/libglib-2.0.so.0
#23 0x00007ffff34a3e1c in g_main_context_iteration () from /lib/libglib-2.0.so.0
#24 0x00007ffff5ebf196 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
---Type <return> to continue, or q <return> to quit---
#25 0x00007ffff674388e in ?? () from /usr/lib/libQtGui.so.4
#26 0x00007ffff5e94582 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /usr/lib/libQtCore.so.4
#27 0x00007ffff5e9495c in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /usr/lib/libQtCore.so.4
#28 0x00007ffff5e9869b in QCoreApplication::exec() () from /usr/lib/libQtCore.so.4
#29 0x00000000004244fd in main (argc=1, argv=0x7fffffffe2b8) at app.cc:323

[Longinus00]

This is such an annoying bug. The problem lies in TorrentModel? :: removeTorrent, the row numbers of the list model are changing as we delete rows but myIdToRow is never updated to reflect this. Every call after the first to beginRemoveRows was potentially with invalid rows and was messing up the logic in the list view.

[Longinus00]

This may be dangerous depending on how a restarted daemon is handled.

[Longinus00]

Safer, if slower, version

[Longinus00]

This bug appears to have existed since the qt client was first checked into svn so it must have been randomly crashing clients for a long time. I think this might be the root cause of ​http://trac.transmissionbt.com/ticket/2298.

[charles]

Fixed in trunk for 2.00 by r10486

[charles]

Backported to 1.9x by r10579