Cutlist editor often crashes the frontend

[mythwiki@…]

When editing cutlists, I frequently experience crashes in the frontend. This typically happens when extending the length of a cut, and I can sometimes work around it by deleting the old cut and rebuilding it to the correct length, rather than trying to extend the cut. I compiled a debug build from tag 28.1, and I am attaching a backtrace.

[mythwiki@…]

Looking at the innards of this function, startframe is 15061.

m_deleteMap is:

  [3001] = MARK_CUT_END,
  [15061] = MARK_CUT_START,
  [19628] = MARK_CUT_END,
  [28204] = MARK_CUT_START,
  [32476] = MARK_CUT_END,
  [42525] = MARK_CUT_START,
  [47701] = MARK_CUT_END

'it' is { i = 0x0 }

'endframe' is 19628

'otherframe' is 15668, which means we've passed through this loop at least once. It looks like the ++it walked off the end of something.

[J.Pilk@…]

I feel I should comment: I use the cutlist editor on almost all my recordings, and have done so for years. What format are you editing?

[mythwiki@…]

This happens with both OTA digital broadcasts (HDHomerun3) and H.264 mp4 recordings made from an IPTV box (TBS2603). I use the cutlist editor all the time, it used not to crash, but it has been very unreliable for me as of 0.28 and 0.28.1.

[Roger Siddons]

That code is deleting the mark that the iterator is using, which is erroneous, and causing the iterator to become undefined. Older Qt versions were more tolerant of faulty code; newer versions tend to crash (as they're entitled to).

I'm not in a position to even compile this at the moment but, if you want to try it, a fix is something like, :

@@ -489,7 +489,8 @@ void DeleteMap::NewCut(uint64_t frame)
                 {
                     LOG(VB_PLAYBACK, LOG_INFO, LOC +
                         QString("Deleting bounded marker: %1").arg(otherframe));
-                    Delete(otherframe);
+                    it = m_deleteMap.erase(it);
+                    m_changed = true;
                 }

[mythwiki@…]

Replying to rsiddons:

That code is deleting the mark that the iterator is using, which is erroneous, and causing the iterator to become undefined.

I applied the suggested patch, and the system appears no longer to crash. I had a reproducible test case which now runs without problems. Thank you.

[Roger Siddons]

The code for Reverse Cuts looks suspect as well. This all falls within "undefined behaviour" so works for some (ie. me), but not for others.

Could the OP confirm whether he/she can also crash it by using Reverse Cuts ?

[mythwiki@…]

Replying to rsiddons:

The code for Reverse Cuts looks suspect as well. This all falls within "undefined behaviour" so works for some (ie. me), but not for others.

Could the OP confirm whether he/she can also crash it by using Reverse Cuts ?

I haven't been able to crash the unpatched binary simply by pressing 'I' to invert the cutlist. Of course, that is not evidence of correctness.

[Roger Siddons <rsiddons@…>]

In 9d2f7b67ef004c20c24048922a1f9367c6127399/mythtv:

Prevent cutlist editor crash when extending marks

Code was modifying the container without adjusting the iterator.
Fixes #13039

[Roger Siddons <rsiddons@…>]

In af9826265820668395c64f04179a90dcdf331adb/mythtv:

Prevent cutlist editor crash when extending marks

Code was modifying the container without adjusting the iterator.
Fixes #13039

(cherry picked from commit 9d2f7b67ef004c20c24048922a1f9367c6127399)