Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-40516

Crash in property binding when constructing objects

    XMLWordPrintable

Details

    Description

      I've observed a crash when trying our software against 5.3.1, which seems to be triggered by a specific combination of property bindings between objects. I've attached a simplified version of the case that's occurring in our software, which exhibits the problem.

      When constructing an element of type Outer, I see a crash with the following backtrace:

      0	QV4::QObjectWrapper::getProperty	qv4qobjectwrapper.cpp	340	0x65bf5338	
      1	QV4::QObjectWrapper::getProperty	qv4qobjectwrapper.cpp	632	0x65bf6a96	
      2	QV4::Runtime::getQmlQObjectProperty	qv4runtime.cpp	1309	0x65c076e4	
      3	QV4::Moth::VME::run	qv4vme_moth.cpp	326	0x65bff106	
      4	QV4::Moth::VME::exec	qv4vme_moth.cpp	738	0x65c01d20	
      5	QV4::SimpleScriptFunction::call	qv4functionobject.cpp	529	0x65bc0b45	
      6	QV4::Object::call	qv4object_p.h	270	0x65ac180c	
      7	QQmlJavaScriptExpression::evaluate	qqmljavascriptexpression.cpp	166	0x65c7f74f	
      8	QQmlJavaScriptExpression::evaluate	qqmljavascriptexpression.cpp	123	0x65c7f592	
      9	QQmlBinding::update	qqmlbinding.cpp	259	0x65c8714b	
      10	QQmlBinding::update	qqmlbinding_p.h	105	0x65b2e92b	
      11	QQmlBinding::expressionChanged	qqmlbinding.cpp	328	0x65c875ec	
      12	QQmlJavaScriptExpressionGuard_callback	qqmljavascriptexpression.cpp	371	0x65c802ee	
      13	QQmlNotifier::emitNotify	qqmlnotifier.cpp	81	0x65c69281	
      14	QQmlNotifier::emitNotify	qqmlnotifier.cpp	76	0x65c69254	
      15	QQmlNotifier::notify	qqmlnotifier_p.h	145	0x65abde87	
      16	QQmlContextData::ContextGuard::operator=	qqmlcontext_p.h	318	0x65c37cd9	
      17	QQmlContextData::setIdProperty	qqmlcontext.cpp	770	0x65c3789c	
      18	QQmlObjectCreator::createInstance	qqmlobjectcreator.cpp	1121	0x65c923ab	
      19	QQmlObjectCreator::setPropertyBinding	qqmlobjectcreator.cpp	765	0x65c90960	
      20	QQmlObjectCreator::setupBindings	qqmlobjectcreator.cpp	724	0x65c90634	
      21	QQmlObjectCreator::populateInstance	qqmlobjectcreator.cpp	1316	0x65c92eeb	
      22	QQmlObjectCreator::createInstance	qqmlobjectcreator.cpp	1158	0x65c92684	
      23	QQmlObjectCreator::create	qqmlobjectcreator.cpp	219	0x65c8e562	
      24	QQmlObjectCreator::createInstance	qqmlobjectcreator.cpp	1075	0x65c9214e	
      25	QQmlObjectCreator::create	qqmlobjectcreator.cpp	219	0x65c8e562	
      26	QQmlComponentPrivate::beginCreate	qqmlcomponent.cpp	884	0x65c31c02	
      27	QQmlComponent::beginCreate	qqmlcomponent.cpp	834	0x65c31954	
      28	QQmlComponent::create	qqmlcomponent.cpp	793	0x65c318e7	
      29	QQuickView::continueExecute	qquickview.cpp	489	0xf86beb9	
      30	QQuickViewPrivate::execute	qquickview.cpp	134	0xf86b008	
      31	QQuickView::setSource	qquickview.cpp	263	0xf86b2df	
      32	Hmi::Core::ApplicationViewer::setMainQmlFile	ApplicationViewer.cpp	174	0x1000e8f4	
      33	main	main.cpp	112	0x434a26	
      34	WinMain	qtmain_win.cpp	135	0x5e34c2	
      35	__tmainCRTStartup	crtexe.c	578	0x5e1fe0	
      36	BaseThreadInitThunk	kernel32		0x7519338a	
      37	__RtlUserThreadStart	ntdll		0x775c9f72	
      38	_RtlUserThreadStart	ntdll		0x775c9f45	
      

      The act of setting the 'background' property of Inner causes the onBackgroundChanged handler to run, which installs a binding on background's 'state' field. This binding itself references the property 'enabled', which in Outer's instantiation of Inner is set to a binding that references iPrivate.disabled. I think the problem arises because all of this happens while the Outer object is still being constructed, and iPrivate hasn't been created yet. Is that correct, or is something else going on?

      In either case, this would seem to be a bug in the QML engine itself, so I would appreciate any assistance coming up with a fix for it.

      Attachments

        1. Inner.qml
          0.3 kB
        2. Outer.qml
          0.2 kB

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              Unassigned Unassigned
              fischerm Matt Fischer
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes