Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-114430

heap-use-after-free when assigning undefined to width and height of Control background item

    XMLWordPrintable

Details

    • 662c3c354 (dev), 5424e324e (6.5), d4b18869d (6.6), bdf7e59e7 (tqtc/lts-6.2)

    Description

      import QtQuick
import QtQuick.Controls

ApplicationWindow {
    id: window
    width: 640
    height: 480
    visible: true

    // This doesn't have to be an inline component but it does need to be a separate/standalone component.
    component DelegateBackground: Rectangle {
        // Needs both of these to crash
        x: padding
        y: padding

        property int padding
    }

    CheckDelegate {
        background: DelegateBackground {
            // Needs both of these to crash.
            width: undefined
            height: undefined
        }
    }
}

      10:30:46: Starting /home/mitch/dev/temp/quick-qt_dev_debug-Debug/quickapp...
QML debugging is enabled. Only use this in a safe environment.
qt.qpa.plugin: Could not find the Qt platform plugin "wayland" in ""
=================================================================
==48101==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000069238 at pc 0x7fc872305523 bp 0x7fffa5b60220 sp 0x7fffa5b60210
READ of size 8 at 0x60d000069238 thread T0
    #0 0x7fc872305522 in QtPrivate::QPropertyBindingData::isNotificationDelayed() const /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qpropertyprivate.h:257
    #1 0x7fc872305597 in QtPrivate::QPropertyBindingData::d_ref() const /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qpropertyprivate.h:305
    #2 0x7fc8723055cb in QtPrivate::QPropertyBindingData::d() const /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qpropertyprivate.h:309
    #3 0x7fc8726c3ca0 in QQmlPropertyBinding::handleUndefinedAssignment(QQmlEnginePrivate*, void*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding.cpp:238
    #4 0x7fc8726cbf90 in QQmlPropertyBinding::evaluate<(QMetaType::Type)6>(QMetaType, void*)::{lambda(bool)#1}::operator()(bool) const /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding_p.h:275
    #5 0x7fc8726cc5c2 in bool QQmlPropertyBinding::evaluate<(QMetaType::Type)6>(QMetaType, void*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding_p.h:304
    #6 0x7fc8726c955d in bool QQmlPropertyBinding::doEvaluate<(QMetaType::Type)6>(QMetaType, QUntypedPropertyData*, void*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding_p.h:124
    #7 0x7fc873c5147e in QObjectCompatProperty<QQuickItemPrivate, double, &QQuickItemPrivate::_qt_property_width_offset, &QQuickItemPrivate::setWidth, &QQuickItemPrivate::widthChanged, decltype(nullptr)>::bindingWrapper(QMetaType, QUntypedPropertyData*, QtPrivate::QPropertyBindingFunction) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:492
    #8 0x7fc86d5ac223 in QPropertyBindingPrivate::evaluateRecursive_inline(QVarLengthArray<QBindingObserverPtr, 256ll>&, QBindingStatus*) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:819
    #9 0x7fc86d5ac223 in QPropertyBindingPrivate::evaluateRecursive(QVarLengthArray<QBindingObserverPtr, 256ll>&, QBindingStatus*) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:321
    #10 0x7fc86d5ad8af in QtPrivate::QPropertyBindingData::setBinding(QUntypedPropertyBinding const&, QUntypedPropertyData*, void (*)(QUntypedPropertyData*), bool (*)(QMetaType, QUntypedPropertyData*, QtPrivate::QPropertyBindingFunction)) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:519
    #11 0x7fc873c43a7c in QObjectCompatProperty<QQuickItemPrivate, double, &QQuickItemPrivate::_qt_property_width_offset, &QQuickItemPrivate::setWidth, &QQuickItemPrivate::widthChanged, decltype(nullptr)>::setBinding(QPropertyBinding<double> const&) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:576
    #12 0x7fc873c11ce7 in operator() /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:707
    #13 0x7fc873c11dc5 in _FUN /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:706
    #14 0x7fc87203ca7b in QUntypedBindable::setBinding(QUntypedPropertyBinding const&) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.h:776
    #15 0x7fc87263d962 in QQmlObjectCreator::finalize(QQmlInstantiationInterrupt&) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlobjectcreator.cpp:1466
    #16 0x7fc87231964b in QQmlComponentPrivate::complete(QQmlEnginePrivate*, QQmlComponentPrivate::ConstructionState*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1147
    #17 0x7fc8723194c6 in QQmlComponentPrivate::completeDeferred(QQmlEnginePrivate*, std::vector<QQmlComponentPrivate::ConstructionState, std::allocator<QQmlComponentPrivate::ConstructionState> >*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1140
    #18 0x7fc86512f7c5 in QtQuickPrivate::completeDeferred(QObject*, QString const&, QQuickUntypedDeferredPointer*) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickdeferredexecute.cpp:130
    #19 0x7fc86508f66c in void quickCompleteDeferred<QQuickItem>(QObject*, QString const&, QQuickDeferredPointer<QQuickItem>&) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickdeferredexecute_p_p.h:54
    #20 0x7fc86511b875 in QQuickControlPrivate::executeBackground(bool) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickcontrol.cpp:769
    #21 0x7fc865120750 in QQuickControl::componentComplete() /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickcontrol.cpp:1975
    #22 0x7fc865081512 in QQuickAbstractButton::componentComplete() /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickabstractbutton.cpp:1067
    #23 0x7fc87263dd1b in QQmlObjectCreator::finalize(QQmlInstantiationInterrupt&) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlobjectcreator.cpp:1495
    #24 0x7fc87231964b in QQmlComponentPrivate::complete(QQmlEnginePrivate*, QQmlComponentPrivate::ConstructionState*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1147
    #25 0x7fc87231a3a3 in QQmlComponentPrivate::completeCreate() /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1252
    #26 0x7fc872319f21 in QQmlComponent::completeCreate() /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1230
    #27 0x7fc872317459 in QQmlComponentPrivate::createWithProperties(QObject*, QMap<QString, QVariant> const&, QQmlContext*, QQmlComponentPrivate::CreateBehavior) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:957
    #28 0x7fc872317105 in QQmlComponent::create(QQmlContext*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:908
    #29 0x7fc872290b66 in QQmlApplicationEnginePrivate::finishLoad(QQmlComponent*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:135
    #30 0x7fc8722912a1 in QQmlApplicationEnginePrivate::ensureLoadingFinishes(QQmlComponent*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:162
    #31 0x7fc872290244 in QQmlApplicationEnginePrivate::startLoad(QUrl const&, QByteArray const&, bool) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:109
    #32 0x7fc872291aa6 in QQmlApplicationEngine::load(QUrl const&) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:324
    #33 0x557055d7f01e in main /home/mitch/dev/temp/quick/main.cpp:14
    #34 0x7fc86c829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #35 0x7fc86c829e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #36 0x557055d7ea04 in _start (/home/mitch/dev/temp/quick-qt_dev_debug-Debug/quickapp+0x5a04)

0x60d000069238 is located 24 bytes inside of 144-byte region [0x60d000069220,0x60d0000692b0)
freed by thread T0 here:
    #0 0x7fc8754b4517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x7fc86d5b7d71 in QBindingStoragePrivate::reallocate(unsigned long) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:2209
    #2 0x7fc86d5b83d9 in QBindingStoragePrivate::get(QUntypedPropertyData*, bool) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:2238
    #3 0x7fc86d5b1c44 in QBindingStorage::bindingData_helper(QUntypedPropertyData*, bool) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:2343
    #4 0x7fc873c14e86 in QBindingStorage::bindingData(QUntypedPropertyData*, bool) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qbindingstorage.h:78
    #5 0x7fc873c43a26 in QObjectCompatProperty<QQuickItemPrivate, double, &QQuickItemPrivate::_qt_property_width_offset, &QQuickItemPrivate::setWidth, &QQuickItemPrivate::widthChanged, decltype(nullptr)>::setBinding(QPropertyBinding<double> const&) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:575
    #6 0x7fc873c31eb9 in QObjectCompatProperty<QQuickItemPrivate, double, &QQuickItemPrivate::_qt_property_width_offset, &QQuickItemPrivate::setWidth, &QQuickItemPrivate::widthChanged, decltype(nullptr)>::takeBinding() (/home/mitch/dev/qt-dev-debug/qtbase/lib/libQt6Quick.so.6+0x631eb9)
    #7 0x7fc873bdc33a in QQuickItem::resetWidth() /home/mitch/dev/qt-dev/qtdeclarative/src/quick/items/qquickitem.cpp:7188
    #8 0x7fc873bf9099 in QQuickItem::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/mitch/dev/qt-dev-debug/qtdeclarative/src/quick/Quick_autogen/include/moc_qquickitem.cpp:1247
    #9 0x7fc873bf97e4 in QQuickItem::qt_metacall(QMetaObject::Call, int, void**) /home/mitch/dev/qt-dev-debug/qtdeclarative/src/quick/Quick_autogen/include/moc_qquickitem.cpp:1300
    #10 0x7fc873d249f3 in QQuickRectangle::qt_metacall(QMetaObject::Call, int, void**) /home/mitch/dev/qt-dev-debug/qtdeclarative/src/quick/Quick_autogen/include/moc_qquickrectangle_p.cpp:722
    #11 0x7fc8728cce20 in QQmlVMEMetaObject::metaCall(QObject*, QMetaObject::Call, int, void**) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlvmemetaobject.cpp:1135
    #12 0x7fc86d46a0cd in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qmetaobject.cpp:332
    #13 0x7fc8726b6edd in QQmlProperty::reset() const /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1818
    #14 0x7fc8726c3bf1 in QQmlPropertyBinding::handleUndefinedAssignment(QQmlEnginePrivate*, void*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding.cpp:233
    #15 0x7fc8726cbf90 in QQmlPropertyBinding::evaluate<(QMetaType::Type)6>(QMetaType, void*)::{lambda(bool)#1}::operator()(bool) const /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding_p.h:275
    #16 0x7fc8726cc5c2 in bool QQmlPropertyBinding::evaluate<(QMetaType::Type)6>(QMetaType, void*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding_p.h:304
    #17 0x7fc8726c955d in bool QQmlPropertyBinding::doEvaluate<(QMetaType::Type)6>(QMetaType, QUntypedPropertyData*, void*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlpropertybinding_p.h:124
    #18 0x7fc873c5147e in QObjectCompatProperty<QQuickItemPrivate, double, &QQuickItemPrivate::_qt_property_width_offset, &QQuickItemPrivate::setWidth, &QQuickItemPrivate::widthChanged, decltype(nullptr)>::bindingWrapper(QMetaType, QUntypedPropertyData*, QtPrivate::QPropertyBindingFunction) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:492
    #19 0x7fc86d5ac223 in QPropertyBindingPrivate::evaluateRecursive_inline(QVarLengthArray<QBindingObserverPtr, 256ll>&, QBindingStatus*) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:819
    #20 0x7fc86d5ac223 in QPropertyBindingPrivate::evaluateRecursive(QVarLengthArray<QBindingObserverPtr, 256ll>&, QBindingStatus*) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:321
    #21 0x7fc86d5ad8af in QtPrivate::QPropertyBindingData::setBinding(QUntypedPropertyBinding const&, QUntypedPropertyData*, void (*)(QUntypedPropertyData*), bool (*)(QMetaType, QUntypedPropertyData*, QtPrivate::QPropertyBindingFunction)) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:519
    #22 0x7fc873c43a7c in QObjectCompatProperty<QQuickItemPrivate, double, &QQuickItemPrivate::_qt_property_width_offset, &QQuickItemPrivate::setWidth, &QQuickItemPrivate::widthChanged, decltype(nullptr)>::setBinding(QPropertyBinding<double> const&) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:576
    #23 0x7fc873c11ce7 in operator() /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:707
    #24 0x7fc873c11dc5 in _FUN /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:706
    #25 0x7fc87203ca7b in QUntypedBindable::setBinding(QUntypedPropertyBinding const&) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.h:776
    #26 0x7fc87263d962 in QQmlObjectCreator::finalize(QQmlInstantiationInterrupt&) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlobjectcreator.cpp:1466
    #27 0x7fc87231964b in QQmlComponentPrivate::complete(QQmlEnginePrivate*, QQmlComponentPrivate::ConstructionState*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1147
    #28 0x7fc8723194c6 in QQmlComponentPrivate::completeDeferred(QQmlEnginePrivate*, std::vector<QQmlComponentPrivate::ConstructionState, std::allocator<QQmlComponentPrivate::ConstructionState> >*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1140
    #29 0x7fc86512f7c5 in QtQuickPrivate::completeDeferred(QObject*, QString const&, QQuickUntypedDeferredPointer*) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickdeferredexecute.cpp:130
    #30 0x7fc86508f66c in void quickCompleteDeferred<QQuickItem>(QObject*, QString const&, QQuickDeferredPointer<QQuickItem>&) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickdeferredexecute_p_p.h:54

previously allocated by thread T0 here:
    #0 0x7fc8754b4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7fc86d5b78d8 in QBindingStoragePrivate::reallocate(unsigned long) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:2185
    #2 0x7fc86d5b82ae in QBindingStoragePrivate::get(QUntypedPropertyData*, bool) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:2235
    #3 0x7fc86d5b1c44 in QBindingStorage::bindingData_helper(QUntypedPropertyData*, bool) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.cpp:2343
    #4 0x7fc873c14e86 in QBindingStorage::bindingData(QUntypedPropertyData*, bool) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qbindingstorage.h:78
    #5 0x7fc873c43778 in QObjectCompatProperty<QQuickItemPrivate, double, &QQuickItemPrivate::_qt_property_y_offset, &QQuickItemPrivate::setY, &QQuickItemPrivate::yChanged, decltype(nullptr)>::setBinding(QPropertyBinding<double> const&) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:575
    #6 0x7fc873c11501 in operator() /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:707
    #7 0x7fc873c115df in _FUN /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty_p.h:706
    #8 0x7fc87203ca7b in QUntypedBindable::setBinding(QUntypedPropertyBinding const&) /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qproperty.h:776
    #9 0x7fc87263d962 in QQmlObjectCreator::finalize(QQmlInstantiationInterrupt&) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlobjectcreator.cpp:1466
    #10 0x7fc87231964b in QQmlComponentPrivate::complete(QQmlEnginePrivate*, QQmlComponentPrivate::ConstructionState*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1147
    #11 0x7fc8723194c6 in QQmlComponentPrivate::completeDeferred(QQmlEnginePrivate*, std::vector<QQmlComponentPrivate::ConstructionState, std::allocator<QQmlComponentPrivate::ConstructionState> >*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1140
    #12 0x7fc86512f7c5 in QtQuickPrivate::completeDeferred(QObject*, QString const&, QQuickUntypedDeferredPointer*) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickdeferredexecute.cpp:130
    #13 0x7fc86508f66c in void quickCompleteDeferred<QQuickItem>(QObject*, QString const&, QQuickDeferredPointer<QQuickItem>&) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickdeferredexecute_p_p.h:54
    #14 0x7fc86511b875 in QQuickControlPrivate::executeBackground(bool) /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickcontrol.cpp:769
    #15 0x7fc865120750 in QQuickControl::componentComplete() /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickcontrol.cpp:1975
    #16 0x7fc865081512 in QQuickAbstractButton::componentComplete() /home/mitch/dev/qt-dev/qtdeclarative/src/quicktemplates/qquickabstractbutton.cpp:1067
    #17 0x7fc87263dd1b in QQmlObjectCreator::finalize(QQmlInstantiationInterrupt&) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlobjectcreator.cpp:1495
    #18 0x7fc87231964b in QQmlComponentPrivate::complete(QQmlEnginePrivate*, QQmlComponentPrivate::ConstructionState*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1147
    #19 0x7fc87231a3a3 in QQmlComponentPrivate::completeCreate() /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1252
    #20 0x7fc872319f21 in QQmlComponent::completeCreate() /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1230
    #21 0x7fc872317459 in QQmlComponentPrivate::createWithProperties(QObject*, QMap<QString, QVariant> const&, QQmlContext*, QQmlComponentPrivate::CreateBehavior) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:957
    #22 0x7fc872317105 in QQmlComponent::create(QQmlContext*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:908
    #23 0x7fc872290b66 in QQmlApplicationEnginePrivate::finishLoad(QQmlComponent*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:135
    #24 0x7fc8722912a1 in QQmlApplicationEnginePrivate::ensureLoadingFinishes(QQmlComponent*) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:162
    #25 0x7fc872290244 in QQmlApplicationEnginePrivate::startLoad(QUrl const&, QByteArray const&, bool) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:109
    #26 0x7fc872291aa6 in QQmlApplicationEngine::load(QUrl const&) /home/mitch/dev/qt-dev/qtdeclarative/src/qml/qml/qqmlapplicationengine.cpp:324
    #27 0x557055d7f01e in main /home/mitch/dev/temp/quick/main.cpp:14
    #28 0x7fc86c829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /home/mitch/dev/qt-dev/qtbase/src/corelib/kernel/qpropertyprivate.h:257 in QtPrivate::QPropertyBindingData::isNotificationDelayed() const
Shadow bytes around the buggy address:
  0x0c1a800051f0: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x0c1a80005200: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1a80005210: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1a80005220: fd fd fa fa fa fa fa fa fa fa 00 00 00 00 00 00
  0x0c1a80005230: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
=>0x0c1a80005240: fa fa fa fa fd fd fd[fd]fd fd fd fd fd fd fd fd
  0x0c1a80005250: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fd fd
  0x0c1a80005260: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1a80005270: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c1a80005280: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
  0x0c1a80005290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==48101==ABORTING
10:30:46: /home/mitch/dev/temp/quick-qt_dev_debug-Debug/quickapp exited with code 1

      Attachments

        For Gerrit Dashboard: QTBUG-114430
        # Subject Branch Project Status CR V
        485090,3 QQmlPropertyBinding: Re-fetch binding data after reset() dev qt/qtdeclarative Status: MERGED +2 0
        485561,2 QQmlPropertyBinding: Re-fetch binding data after reset() 6.5 qt/qtdeclarative Status: MERGED +2 0
        485562,2 QQmlPropertyBinding: Re-fetch binding data after reset() 6.6 qt/qtdeclarative Status: MERGED +2 0
        485571,2 QQmlPropertyBinding: Re-fetch binding data after reset() tqtc/lts-6.2 qt/tqtc-qtdeclarative Status: MERGED +2 0

        Activity

          People

            ulherman Ulf Hermann
            mitch_curtis Mitch Curtis
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes