Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-121588

[REG 6.6 → 6.7] Crash in VDMListDelegateDataType::createMissingProperties

    XMLWordPrintable

Details

    • 6a278ea43 (dev), c4ce86c79 (6.7)

    Description

      Originally reported as https://bugs.kde.org/show_bug.cgi?id=480431

      The following snippet running in qmlscene crashes:

      import QtQuick
      
      Item {
          id: menu
      
          Component.onCompleted: dt = new Date();
          property date dt
          Instantiator {
              model: {
                  var model = [];
                  var d = menu.dt;
                  model.push({text: "A"});
                  return model;
              }
              delegate: Text {
                  text: modelData.text
              }
          }
      }
      
      #0  0x00007ffff50cd474 in std::_Rb_tree_increment(std::_Rb_tree_node_base const*) () at ../../../../../libstdc++-v3/src/c++98/tree.cc:89
      
      #1  0x00007ffff6fc1f09 in std::_Rb_tree_const_iterator<std::pair<QString const, QVariant> >::operator++ (this=<synthetic pointer>)
      
          at /usr/include/c++/13/bits/stl_tree.h:366
      
      #2  QMap<QString, QVariant>::const_iterator::operator++ (this=<synthetic pointer>) at /home/nico/workspace/qt6/qtbase/src/corelib/tools/qmap.h:521
      
      #3  QMap<QString, QVariant>::key_iterator::operator++ (this=<synthetic pointer>) at /home/nico/workspace/qt6/qtbase/src/corelib/tools/qmap.h:586
      
      #4  VDMListDelegateDataType::createMissingProperties (this=this@entry=0x555555a393b0, row=row@entry=0x555555a12498)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata_p.h:209
      
      #5  0x00007ffff6fc098c in VDMListDelegateDataType::toDynamicMetaObject (this=0x555555a393b0, object=0x555555a12420)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata.cpp:144
      
      #6  0x00007ffff6b080a4 in QQmlNotifierEndpoint::disconnect (this=0x555555a94af0)
      
          at /home/nico/workspace/qt6/qtbase/include/QtQml/6.7.0/QtQml/private/../../../../../../qtdeclarative/src/qml/qml/qqmlnotifier_p.h:182
      
      #7  QQmlData::disconnectNotifiers (this=0x555555aa3080, doDelete=QQmlData::DeleteNotifyList::Yes)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlengine.cpp:1320
      
      #8  0x00007ffff6b0de8e in QQmlData::destroyed (this=0x555555aa3080, object=0x555555a12420) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlengine.cpp:1427
      
      #9  0x00007ffff55b97c1 in QObject::~QObject (this=0x555555a12420, __in_chrg=<optimized out>) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:1074
      
      #10 0x00007ffff6f5aa30 in QQmlDMListAccessorData::~QQmlDMListAccessorData (this=0x555555a12420, __in_chrg=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/QmlModels_autogen/EWIEGA46WW/../../qqmldmlistaccessordata_p.h:26
      
      #11 QQmlDMListAccessorData::~QQmlDMListAccessorData (this=0x555555a12420, __in_chrg=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/QmlModels_autogen/EWIEGA46WW/../../qqmldmlistaccessordata_p.h:26
      
      #12 0x00007ffff6fac74e in QQmlDelegateModelPrivate::release (this=0x5555556c1700, object=<optimized out>, reusableFlag=QQmlInstanceModel::NotReusable)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:604
      
      #13 0x00007ffff6fac7e2 in QQmlDelegateModelPrivate::release (reusableFlag=<optimized out>, object=<optimized out>, this=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:623
      
      #14 QQmlDelegateModel::release (this=<optimized out>, item=<optimized out>, reusableFlag=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:625
      
      #15 0x00007ffff6f68e37 in QQmlInstantiatorPrivate::clear (this=this@entry=0x5555555924d0)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmlinstantiator.cpp:44
      
      #16 0x00007ffff6f69536 in QQmlInstantiatorPrivate::regenerate (this=this@entry=0x5555555924d0)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmlinstantiator.cpp:70
      
      #17 0x00007ffff6f69818 in QQmlInstantiator::setModel (this=0x5555558f1c40, v=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmlinstantiator.cpp:412
      
      #18 0x00007ffff6ad93c4 in QQmlPropertyData::writeProperty (this=this@entry=0x7fff880c6140, target=target@entry=0x5555558f1c40, value=value@entry=0x7fffffff8ee0, Python 
      Exception <class 'gdb.MemoryError'>: Cannot access memory at address 0x2
      
      
      
         #19 0x00007ffff6b885b5 in QQmlPropertyPrivate::write
      
          (object=0x5555558f1c40, property=..., value=..., context=..., flags=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1535
      
      #20 0x00007ffff6b8c356 in QQmlPropertyPrivate::writeValueProperty
      
          (object=<optimized out>, core=<optimized out>, valueTypeData=<optimized out>, value=..., context=..., flags=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1300
      
      #21 0x00007ffff6ad4f6a in QQmlBinding::slowWrite
      
          (this=this@entry=0x5555555925a0, core=..., valueTypeData=..., result=..., isUndefined=isUndefined@entry=false, flags=..., flags@entry=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:540
      
      #22 0x00007ffff6ad6e45 in GenericBinding<0>::write (this=0x5555555925a0, result=..., isUndefined=false, flags=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:268
      
      #23 0x00007ffff6ad2b6e in QQmlBinding::doUpdate (this=0x5555555925a0, watcher=..., flags=..., scope=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:701
      
      #24 0x00007ffff6ad6203 in QQmlBinding::update (this=0x5555555925a0, flags=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:164
      
      #25 0x00007ffff6b61457 in QQmlNotifier::emitNotify (endpoint=<optimized out>, a=0x0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlnotifier.cpp:70
      
      #26 0x00007ffff55bc870 in doActivate<false> (sender=0x5555558d7620, signal_index=33, argv=argv@entry=0x0)
      
          at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:3952
      
      #27 0x00007ffff55b48cb in QMetaObject::activate (sender=<optimized out>, signalOffset=<optimized out>, local_signal_index=<optimized out>, argv=argv@entry=0x0)
      
          at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:4133
      
      #28 0x00007ffff6c149eb in QQmlVMEMetaObject::activate (this=this@entry=0x555555a3eca0, object=<optimized out>, index=<optimized out>, args=args@entry=0x0)
      
      --Type <RET> for more, q to quit, c to continue without paging--c
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlvmemetaobject.cpp:1467
      
      #29 0x00007ffff6c16d8f in QQmlVMEMetaObject::metaCall (this=0x555555a3eca0, o=<optimized out>, c=<optimized out>, _id=<optimized out>, a=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlvmemetaobject.cpp:1021
      
      #30 0x00007ffff6ad9452 in QQmlPropertyData::doMetacall<(QMetaObject::Call)2> (this=0x7fff88078a10, argv=0x7fffffffac00, idx=<optimized out>, object=0x1)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlpropertydata_p.h:358
      
      #31 QQmlPropertyData::writeProperty (this=this@entry=0x7fff88078a10, target=target@entry=0x5555558d7620, value=<optimized out>, Python Exception <class 'gdb.MemoryError
      '>: Cannot access memory at address 0x2
      
      
      
         #32 0x00007ffff6b882f1 in tryConvertAndAssign
      
          (isUrl=<optimized out>, variantMetaType=..., propertyMetaType=..., flags=..., value=<optimized out>, property=<optimized out>, object=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1392
      
      #33 QQmlPropertyPrivate::write (object=object@entry=0x5555558d7620, property=..., value=..., context=..., flags=flags@entry=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1531
      
      #34 0x00007ffff6a2e8a0 in QV4::QObjectWrapper::setProperty (engine=engine@entry=0x55555561c5e0, object=object@entry=0x5555558d7620, property=0x7fff88078a10, value=...)
      
          at /home/nico/workspace/qt6/qtbase/src/corelib/global/qflags.h:73
      
      #35 0x00007ffff6a2f03e in QV4::QObjectWrapper::setQmlProperty
      
          (engine=engine@entry=0x55555561c5e0, qmlContext=..., object=0x5555558d7620, name=<optimized out>, flags=flags@entry=..., value=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:572
      
      #36 0x00007ffff6a20ebe in QV4::QQmlContextWrapper::virtualPut (m=<optimized out>, id=..., value=..., receiver=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4qmlcontext.cpp:478
      
      #37 0x00007ffff6990f0f in QV4::Object::put (receiver=0x7fffc83bc570, v=..., name=0x7fffc83bc568, this=0x7fffc83bc570)
      
          at /home/nico/workspace/qt6/qtbase/include/QtQml/6.7.0/QtQml/private/../../../../../../qtdeclarative/src/qml/jsruntime/qv4string_p.h:140
      
      #38 QV4::ExecutionContext::setProperty (this=<optimized out>, name=0x7fffc83bc568, value=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4context.cpp:278
      
      #39 0x00007ffff6a4f021 in QV4::Runtime::StoreNameSloppy::call (engine=0x55555561c5e0, nameIndex=<optimized out>, value=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4runtime.cpp:986
      
      #40 0x00007ffff6a8a5ce in QV4::Moth::VME::interpret (frame=0x5555555930b0,  
          frame@entry=0x7fffffffb350, engine=0x55555561c5e0, code=0x7fffe2af218d "\032\a\006\324\026\006\002")
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:623
      
      #41 0x00007ffff6a8f907 in QV4::Moth::VME::exec (frame=frame@entry=0x7fffffffb350, engine=engine@entry=0x55555561c5e0)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:487
      
      #42 0x00007ffff69e10fe in QV4::doCall
      
          (self=<optimized out>, thisObject=thisObject@entry=0x555555a3ea00, argv=<optimized out>, argc=<optimized out>, context=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:54
      
      #43 0x00007ffff69e1558 in QV4::Function::call
      
          (this=this@entry=0x555555a3ea00, thisObject=0x555555a3ea00, argv=argv@entry=0x7fffc83bc4f0, argc=argc@entry=0, context=context@entry=0x7fffe246c040)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:79
      
      #44 0x00007ffff69e183b in operator() (argc=0, argv=0x7fffc83bc4f0, thisObject=<optimized out>, __closure=<synthetic pointer>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:30
      
      #45 QV4::convertAndCall<QV4::Function::call(QObject*, void**, const QMetaType*, int, QV4::ExecutionContext*)::<lambda(const QV4::Value*, const QV4::Value*, int)> >
      
          (call=..., argc=0, types=0x7fffffffb5f0, a=0x7fffffffb5e0, thisObject=0x5555558d7620, engine=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4jscall_p.h:194
      
      #46 QV4::Function::call (this=0x555555a3ea00, thisObject=0x5555558d7620, a=a@entry=0x7fffffffb5e0, types=types@entry=0x7fffffffb5f0, argc=0, context=0x7fffe246c040)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:27
      
      #47 0x00007ffff6b37597 in QQmlJavaScriptExpression::evaluate (this=<optimized out>, a=a@entry=0x7fffffffb5e0, types=types@entry=0x7fffffffb5f0, argc=argc@entry=0)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmljavascriptexpression_p.h:248
      
      #48 0x00007ffff6adee33 in QQmlBoundSignalExpression::evaluate (this=0x555555a91e30, a=a@entry=0x0)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlboundsignal.cpp:199
      
      #49 0x00007ffff6adf6b8 in QQmlBoundSignal_callback (e=0x555555592330, a=0x0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/ftw/qqmlrefcount_p.h:73
      
      #50 0x00007ffff6b61457 in QQmlNotifier::emitNotify (endpoint=<optimized out>, a=0x0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlnotifier.cpp:70
      
      #51 0x00007ffff55bc870 in doActivate<false> (sender=0x5555555928e0, signal_index=3, argv=0x0) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:3952
      
      #52 0x00007ffff55b44cf in QMetaObject::activate
      
          (sender=sender@entry=0x5555555928e0, m=m@entry=0x7ffff6dae260 <QQmlComponentAttached::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@en
      try=0x0) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:4120
      
      #53 0x00007ffff6aecb10 in QQmlComponentAttached::completed (this=this@entry=0x5555555928e0)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/moc_qqmlcomponentattached_p.cpp:152
      
      #54 0x00007ffff6b63de4 in QQmlObjectCreator::finalize (this=0x555555a91920, interrupt=...)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlobjectcreator.cpp:1544
      
      #55 0x00007ffff6aee33b in QQmlComponentPrivate::complete (enginePriv=0x555555a16370, state=state@entry=0x555555a90f78)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/ftw/qbipointer_p.h:133
      
      #56 0x00007ffff6af3d4c in QQmlComponentPrivate::completeCreate (this=0x555555a90ec0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1261
      
      #57 0x00007ffff6af4601 in QQmlComponent::completeCreate (this=0x555555a90ea0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1239
      
      #58 QQmlComponentPrivate::createWithProperties
      
          (this=0x555555a90ec0, parent=parent@entry=0x0, properties=..., context=<optimized out>, behavior=behavior@entry=QQmlComponentPrivate::CreateDefault)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:957
      
      #59 0x00007ffff6af4899 in QQmlComponent::create (this=<optimized out>, context=<optimized out>)
      
          at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:908
      
      #60 0x0000555555559c96 in main (argc=<optimized out>, argv=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/tools/qmlscene/main.cpp:592
      

      Tested with Qt 6.7 branch (qtbase cad0204e818a8790ee57fa35327a94493f33c4cb, qtdeclarative 7b814e1e3842a3069af4009e15d87e3b5a1c5b53)

      It does not crash with 6.6.1

       

       

       

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            ulherman Ulf Hermann
            nicolasfella Nicolas Fella
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes