Crash in qtblend filter

[rlalik]

I reported this bug on the mailing list but for a record I will put it also here.

I have a weird problem with transform filter. After applying it to an image, the playback causes abortion of kdenlive. I am able track the problem back to mlt.

MWE is a project with still image (jpg).

1. Add an image to the track
2. Add transform effect
3. Try to play the clip in the timeline.

For me the kdenlive crashes every time.

I tried that with 20.04.2 and the git master. My mlt is 6.20.0 but also git was tested.

From what I was able to find is that the QPainter in filter_qblend.cpp receives at some point width,height = 0,0, and QPainter fails with error:

QPainter::begin: Paint device returned engine == 0, type: 3
QPainter::setCompositionMode: Painter not active
QPainter::setRenderHint: Painter must be active to set rendering hints
QPainter::setWorldTransform: Painter not active
QPainter::setOpacity: Painter not active
QPainter::end: Painter not active, aborted

in this code (I added my comments to highlight problematic places):

uint8_t *dest_image = NULL;
dest_image = (uint8_t *) mlt_pool_alloc( image_size );

QImage destImage;
// width, height here is (sometimes) 0,0
convert_mlt_to_qimage_rgba( dest_image, &destImage, *width, *height );
// destImage has size of 0x0
destImage.fill( mlt_properties_get_int( properties, "background_color" ) );

QPainter painter( &destImage );
painter.setCompositionMode( ( QPainter::CompositionMode ) mlt_properties_get_int( properties, "compositing" ) );
painter.setRenderHints( QPainter::Antialiasing | QPainter::SmoothPixmapTransform );
painter.setTransform(transform);
painter.setOpacity(opacity);
// painter breaks after trying painting on image 0x0
painter.drawImage(0, 0, sourceImage);

what is followed with bad image in destImage and an assertion fail from following code inside:

convert_qimage_to_mlt_rgba( &destImage, dest_image, *width, *height );

and the message is:

ASSERT: "mImg == qImg->constBits()" in file common.cpp, line 63

I was not able to find why width,height are equal to 0,0

Do you have any idea how to trace back the problem to its source?

Here is the backtrack

Thread 22 "FrameRenderer" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fff927fc700 (LWP 18271)]
0x00007ffff4bfc561 in raise () from /lib64/libc.so.6

Thread 22 (Thread 0x7fff927fc700 (LWP 18271)):
#0  0x00007ffff4bfc561 in raise () at /lib64/libc.so.6
#1  0x00007ffff4be655b in abort () at /lib64/libc.so.6
#2  0x00007ffff51bddab in  () at /usr/lib64/libQt5Core.so.5
#3  0x00007ffff51bd084 in qt_assert_x(char const*, char const*, char const*, int) () at /usr/lib64/libQt5Core.so.5
#4  0x00007fffca638cef in convert_qimage_to_mlt_rgba(QImage*, unsigned char*, int, int) (qImg=qImg@entry=0x7fff927fb250, mImg=mImg@entry=0x7fff78009f80 "\200\240", width=<optimized out>, height=<optimized out>) at /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/include/g++-v9/bits/atomic_base.h:326
#5  0x00007fffca64cf7b in filter_get_image(mlt_frame, uint8_t**, mlt_image_format*, int*, int*, int) (frame=frame@entry=0x7fff2249c730, image=image@entry=0x7fff927fb528, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=1) at filter_qtblend.cpp:198
#6  0x00007ffff6c9abbf in mlt_frame_get_image (self=self@entry=0x7fff2249c730, buffer=buffer@entry=0x7fff927fb528, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=1) at mlt_frame.c:620
#7  0x00007ffff6cb122c in producer_get_image (self=self@entry=0x7fff2249bb50, buffer=buffer@entry=0x7fff927fb528, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=1) at mlt_tractor.c:371
#8  0x00007ffff6c9abbf in mlt_frame_get_image (self=0x7fff2249bb50, buffer=0x7fff927fb528, format=0x7fff927fb7ac, width=0x7fff927fb7a4, height=0x7fff927fb7a8, writable=1) at mlt_frame.c:620
#9  0x00007ffff6c9abbf in mlt_frame_get_image (self=self@entry=0x7fff2249bb50, buffer=buffer@entry=0x7fff927fb528, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=1) at mlt_frame.c:620
#10 0x00007fffca64c8da in get_image(mlt_frame, uint8_t**, mlt_image_format*, int*, int*, int) (a_frame=a_frame@entry=0x7fff21449ef0, image=image@entry=0x7fff927fb760, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=0) at transition_qtblend.cpp:189
#11 0x00007ffff6c9abbf in mlt_frame_get_image (self=self@entry=0x7fff21449ef0, buffer=buffer@entry=0x7fff927fb760, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=0) at mlt_frame.c:620
#12 0x00007ffff6cb122c in producer_get_image (self=self@entry=0x7fff21448440, buffer=buffer@entry=0x7fff927fb760, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=0) at mlt_tractor.c:371
#13 0x00007ffff6c9abbf in mlt_frame_get_image (self=0x7fff21448440, buffer=buffer@entry=0x7fff927fb760, format=format@entry=0x7fff927fb7ac, width=width@entry=0x7fff927fb7a4, height=height@entry=0x7fff927fb7a8, writable=writable@entry=0) at mlt_frame.c:620
#14 0x00007ffff6c79269 in Mlt::Frame::get_image(mlt_image_format&, int&, int&, int) (this=0x7fff927fb7f0, format=@0x7fff927fb7ac: mlt_image_rgb24a, w=@0x7fff927fb7a4: 0, h=@0x7fff927fb7a8: 0, writable=0) at MltFrame.cpp:70
#15 0x00005555558ecd75 in  ()
#16 0x000055555566e77c in  ()
#17 0x00007ffff53d28fc in QObject::event(QEvent*) () at /usr/lib64/libQt5Core.so.5
#18 0x00007ffff64adcaf in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib64/libQt5Widgets.so.5
#19 0x00007ffff64b6ab0 in QApplication::notify(QObject*, QEvent*) () at /usr/lib64/libQt5Widgets.so.5
#20 0x00007ffff53a71e7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib64/libQt5Core.so.5
#21 0x00007ffff53a9d10 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () at /usr/lib64/libQt5Core.so.5
#22 0x00007ffff53fc773 in  () at /usr/lib64/libQt5Core.so.5
#23 0x00007ffff33bbb0c in g_main_context_dispatch () at /usr/lib64/libglib-2.0.so.0
#24 0x00007ffff33bbd88 in  () at /usr/lib64/libglib-2.0.so.0
#25 0x00007ffff33bbe1f in g_main_context_iteration () at /usr/lib64/libglib-2.0.so.0
#26 0x00007ffff53fc520 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQt5Core.so.5
#27 0x00007ffff53a6033 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQt5Core.so.5
#28 0x00007ffff51f74ee in QThread::exec() () at /usr/lib64/libQt5Core.so.5
#29 0x00007ffff51f853b in  () at /usr/lib64/libQt5Core.so.5
#30 0x00007ffff3f54e97 in start_thread () at /lib64/libpthread.so.0
#31 0x00007ffff4cbc63f in clone () at /lib64/libc.so.6

[sandsmark]

I don't think the problem here is qtblend, but there seems to be problems in many filters with RGB sources without alpha (especially the movit filters), mostly visible when using jpgs.