Details
-
Bug
-
Resolution: Fixed
-
P1: Critical
-
6.4.1
-
Linux 6.0.8-arch1-1 #1 SMP PREEMPT_DYNAMIC Thu, 10 Nov 2022 21:14:24 +0000 x86_64 GNU/Linux
Qt 6.4.1 from the arch linux repositories
-
-
4dfcaa7ee (dev), eebb73c2c (6.4), 18e9d3df8 (tqtc/lts-6.2), d6c0207a1 (6.5)
Description
Using the following C++ class:
class X : public QObject { Q_OBJECT QML_ELEMENT Q_PROPERTY(int x READ x WRITE setX BINDABLE bindableX) Q_OBJECT_BINDABLE_PROPERTY(X, int, _xProp) public: int x() const { return _xProp.value(); } void setX(int x) { _xProp.setValue(x); } QBindable<int> bindableX() const { return &_xProp; } };
And the following QML code:
import BT import QtQuick Item { property int v: 0 property X xthing: X { x: v } }
An invalid read occurs in QQmlObjectCreator::finalize, because the qmlBinding variable is deleted by the pop: https://code.qt.io/cgit/qt/qtdeclarative.git/tree/src/qml/qml/qqmlobjectcreator.cpp?h=6.4.1#n1412
This causes a seg fault when running under GDB (and when running normally for more complex code). The valgrind log and GDB backtrace is attached.