Details
-
Bug
-
Resolution: Fixed
-
P1: Critical
-
6.7
-
None
-
Fedora 39, KDE Plasma
-
6a278ea43 (dev), c4ce86c79 (6.7)
Description
Originally reported as https://bugs.kde.org/show_bug.cgi?id=480431
The following snippet running in qmlscene crashes:
import QtQuick Item { id: menu Component.onCompleted: dt = new Date(); property date dt Instantiator { model: { var model = []; var d = menu.dt; model.push({text: "A"}); return model; } delegate: Text { text: modelData.text } } }
#0 0x00007ffff50cd474 in std::_Rb_tree_increment(std::_Rb_tree_node_base const*) () at ../../../../../libstdc++-v3/src/c++98/tree.cc:89 #1 0x00007ffff6fc1f09 in std::_Rb_tree_const_iterator<std::pair<QString const, QVariant> >::operator++ (this=<synthetic pointer>) at /usr/include/c++/13/bits/stl_tree.h:366 #2 QMap<QString, QVariant>::const_iterator::operator++ (this=<synthetic pointer>) at /home/nico/workspace/qt6/qtbase/src/corelib/tools/qmap.h:521 #3 QMap<QString, QVariant>::key_iterator::operator++ (this=<synthetic pointer>) at /home/nico/workspace/qt6/qtbase/src/corelib/tools/qmap.h:586 #4 VDMListDelegateDataType::createMissingProperties (this=this@entry=0x555555a393b0, row=row@entry=0x555555a12498) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata_p.h:209 #5 0x00007ffff6fc098c in VDMListDelegateDataType::toDynamicMetaObject (this=0x555555a393b0, object=0x555555a12420) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata.cpp:144 #6 0x00007ffff6b080a4 in QQmlNotifierEndpoint::disconnect (this=0x555555a94af0) at /home/nico/workspace/qt6/qtbase/include/QtQml/6.7.0/QtQml/private/../../../../../../qtdeclarative/src/qml/qml/qqmlnotifier_p.h:182 #7 QQmlData::disconnectNotifiers (this=0x555555aa3080, doDelete=QQmlData::DeleteNotifyList::Yes) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlengine.cpp:1320 #8 0x00007ffff6b0de8e in QQmlData::destroyed (this=0x555555aa3080, object=0x555555a12420) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlengine.cpp:1427 #9 0x00007ffff55b97c1 in QObject::~QObject (this=0x555555a12420, __in_chrg=<optimized out>) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:1074 #10 0x00007ffff6f5aa30 in QQmlDMListAccessorData::~QQmlDMListAccessorData (this=0x555555a12420, __in_chrg=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/QmlModels_autogen/EWIEGA46WW/../../qqmldmlistaccessordata_p.h:26 #11 QQmlDMListAccessorData::~QQmlDMListAccessorData (this=0x555555a12420, __in_chrg=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/QmlModels_autogen/EWIEGA46WW/../../qqmldmlistaccessordata_p.h:26 #12 0x00007ffff6fac74e in QQmlDelegateModelPrivate::release (this=0x5555556c1700, object=<optimized out>, reusableFlag=QQmlInstanceModel::NotReusable) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:604 #13 0x00007ffff6fac7e2 in QQmlDelegateModelPrivate::release (reusableFlag=<optimized out>, object=<optimized out>, this=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:623 #14 QQmlDelegateModel::release (this=<optimized out>, item=<optimized out>, reusableFlag=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:625 #15 0x00007ffff6f68e37 in QQmlInstantiatorPrivate::clear (this=this@entry=0x5555555924d0) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmlinstantiator.cpp:44 #16 0x00007ffff6f69536 in QQmlInstantiatorPrivate::regenerate (this=this@entry=0x5555555924d0) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmlinstantiator.cpp:70 #17 0x00007ffff6f69818 in QQmlInstantiator::setModel (this=0x5555558f1c40, v=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qmlmodels/qqmlinstantiator.cpp:412 #18 0x00007ffff6ad93c4 in QQmlPropertyData::writeProperty (this=this@entry=0x7fff880c6140, target=target@entry=0x5555558f1c40, value=value@entry=0x7fffffff8ee0, Python Exception <class 'gdb.MemoryError'>: Cannot access memory at address 0x2 #19 0x00007ffff6b885b5 in QQmlPropertyPrivate::write (object=0x5555558f1c40, property=..., value=..., context=..., flags=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1535 #20 0x00007ffff6b8c356 in QQmlPropertyPrivate::writeValueProperty (object=<optimized out>, core=<optimized out>, valueTypeData=<optimized out>, value=..., context=..., flags=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1300 #21 0x00007ffff6ad4f6a in QQmlBinding::slowWrite (this=this@entry=0x5555555925a0, core=..., valueTypeData=..., result=..., isUndefined=isUndefined@entry=false, flags=..., flags@entry=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:540 #22 0x00007ffff6ad6e45 in GenericBinding<0>::write (this=0x5555555925a0, result=..., isUndefined=false, flags=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:268 #23 0x00007ffff6ad2b6e in QQmlBinding::doUpdate (this=0x5555555925a0, watcher=..., flags=..., scope=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:701 #24 0x00007ffff6ad6203 in QQmlBinding::update (this=0x5555555925a0, flags=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlbinding.cpp:164 #25 0x00007ffff6b61457 in QQmlNotifier::emitNotify (endpoint=<optimized out>, a=0x0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlnotifier.cpp:70 #26 0x00007ffff55bc870 in doActivate<false> (sender=0x5555558d7620, signal_index=33, argv=argv@entry=0x0) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:3952 #27 0x00007ffff55b48cb in QMetaObject::activate (sender=<optimized out>, signalOffset=<optimized out>, local_signal_index=<optimized out>, argv=argv@entry=0x0) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:4133 #28 0x00007ffff6c149eb in QQmlVMEMetaObject::activate (this=this@entry=0x555555a3eca0, object=<optimized out>, index=<optimized out>, args=args@entry=0x0) --Type <RET> for more, q to quit, c to continue without paging--c at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlvmemetaobject.cpp:1467 #29 0x00007ffff6c16d8f in QQmlVMEMetaObject::metaCall (this=0x555555a3eca0, o=<optimized out>, c=<optimized out>, _id=<optimized out>, a=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlvmemetaobject.cpp:1021 #30 0x00007ffff6ad9452 in QQmlPropertyData::doMetacall<(QMetaObject::Call)2> (this=0x7fff88078a10, argv=0x7fffffffac00, idx=<optimized out>, object=0x1) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlpropertydata_p.h:358 #31 QQmlPropertyData::writeProperty (this=this@entry=0x7fff88078a10, target=target@entry=0x5555558d7620, value=<optimized out>, Python Exception <class 'gdb.MemoryError '>: Cannot access memory at address 0x2 #32 0x00007ffff6b882f1 in tryConvertAndAssign (isUrl=<optimized out>, variantMetaType=..., propertyMetaType=..., flags=..., value=<optimized out>, property=<optimized out>, object=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1392 #33 QQmlPropertyPrivate::write (object=object@entry=0x5555558d7620, property=..., value=..., context=..., flags=flags@entry=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1531 #34 0x00007ffff6a2e8a0 in QV4::QObjectWrapper::setProperty (engine=engine@entry=0x55555561c5e0, object=object@entry=0x5555558d7620, property=0x7fff88078a10, value=...) at /home/nico/workspace/qt6/qtbase/src/corelib/global/qflags.h:73 #35 0x00007ffff6a2f03e in QV4::QObjectWrapper::setQmlProperty (engine=engine@entry=0x55555561c5e0, qmlContext=..., object=0x5555558d7620, name=<optimized out>, flags=flags@entry=..., value=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:572 #36 0x00007ffff6a20ebe in QV4::QQmlContextWrapper::virtualPut (m=<optimized out>, id=..., value=..., receiver=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4qmlcontext.cpp:478 #37 0x00007ffff6990f0f in QV4::Object::put (receiver=0x7fffc83bc570, v=..., name=0x7fffc83bc568, this=0x7fffc83bc570) at /home/nico/workspace/qt6/qtbase/include/QtQml/6.7.0/QtQml/private/../../../../../../qtdeclarative/src/qml/jsruntime/qv4string_p.h:140 #38 QV4::ExecutionContext::setProperty (this=<optimized out>, name=0x7fffc83bc568, value=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4context.cpp:278 #39 0x00007ffff6a4f021 in QV4::Runtime::StoreNameSloppy::call (engine=0x55555561c5e0, nameIndex=<optimized out>, value=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4runtime.cpp:986 #40 0x00007ffff6a8a5ce in QV4::Moth::VME::interpret (frame=0x5555555930b0, frame@entry=0x7fffffffb350, engine=0x55555561c5e0, code=0x7fffe2af218d "\032\a\006\324\026\006\002") at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:623 #41 0x00007ffff6a8f907 in QV4::Moth::VME::exec (frame=frame@entry=0x7fffffffb350, engine=engine@entry=0x55555561c5e0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:487 #42 0x00007ffff69e10fe in QV4::doCall (self=<optimized out>, thisObject=thisObject@entry=0x555555a3ea00, argv=<optimized out>, argc=<optimized out>, context=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:54 #43 0x00007ffff69e1558 in QV4::Function::call (this=this@entry=0x555555a3ea00, thisObject=0x555555a3ea00, argv=argv@entry=0x7fffc83bc4f0, argc=argc@entry=0, context=context@entry=0x7fffe246c040) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:79 #44 0x00007ffff69e183b in operator() (argc=0, argv=0x7fffc83bc4f0, thisObject=<optimized out>, __closure=<synthetic pointer>) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:30 #45 QV4::convertAndCall<QV4::Function::call(QObject*, void**, const QMetaType*, int, QV4::ExecutionContext*)::<lambda(const QV4::Value*, const QV4::Value*, int)> > (call=..., argc=0, types=0x7fffffffb5f0, a=0x7fffffffb5e0, thisObject=0x5555558d7620, engine=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4jscall_p.h:194 #46 QV4::Function::call (this=0x555555a3ea00, thisObject=0x5555558d7620, a=a@entry=0x7fffffffb5e0, types=types@entry=0x7fffffffb5f0, argc=0, context=0x7fffe246c040) at /home/nico/workspace/qt6/qtdeclarative/src/qml/jsruntime/qv4function.cpp:27 #47 0x00007ffff6b37597 in QQmlJavaScriptExpression::evaluate (this=<optimized out>, a=a@entry=0x7fffffffb5e0, types=types@entry=0x7fffffffb5f0, argc=argc@entry=0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmljavascriptexpression_p.h:248 #48 0x00007ffff6adee33 in QQmlBoundSignalExpression::evaluate (this=0x555555a91e30, a=a@entry=0x0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlboundsignal.cpp:199 #49 0x00007ffff6adf6b8 in QQmlBoundSignal_callback (e=0x555555592330, a=0x0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/ftw/qqmlrefcount_p.h:73 #50 0x00007ffff6b61457 in QQmlNotifier::emitNotify (endpoint=<optimized out>, a=0x0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlnotifier.cpp:70 #51 0x00007ffff55bc870 in doActivate<false> (sender=0x5555555928e0, signal_index=3, argv=0x0) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:3952 #52 0x00007ffff55b44cf in QMetaObject::activate (sender=sender@entry=0x5555555928e0, m=m@entry=0x7ffff6dae260 <QQmlComponentAttached::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@en try=0x0) at /home/nico/workspace/qt6/qtbase/src/corelib/kernel/qobject.cpp:4120 #53 0x00007ffff6aecb10 in QQmlComponentAttached::completed (this=this@entry=0x5555555928e0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/moc_qqmlcomponentattached_p.cpp:152 #54 0x00007ffff6b63de4 in QQmlObjectCreator::finalize (this=0x555555a91920, interrupt=...) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlobjectcreator.cpp:1544 #55 0x00007ffff6aee33b in QQmlComponentPrivate::complete (enginePriv=0x555555a16370, state=state@entry=0x555555a90f78) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/ftw/qbipointer_p.h:133 #56 0x00007ffff6af3d4c in QQmlComponentPrivate::completeCreate (this=0x555555a90ec0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1261 #57 0x00007ffff6af4601 in QQmlComponent::completeCreate (this=0x555555a90ea0) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:1239 #58 QQmlComponentPrivate::createWithProperties (this=0x555555a90ec0, parent=parent@entry=0x0, properties=..., context=<optimized out>, behavior=behavior@entry=QQmlComponentPrivate::CreateDefault) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:957 #59 0x00007ffff6af4899 in QQmlComponent::create (this=<optimized out>, context=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/src/qml/qml/qqmlcomponent.cpp:908 #60 0x0000555555559c96 in main (argc=<optimized out>, argv=<optimized out>) at /home/nico/workspace/qt6/qtdeclarative/tools/qmlscene/main.cpp:592
Tested with Qt 6.7 branch (qtbase cad0204e818a8790ee57fa35327a94493f33c4cb, qtdeclarative 7b814e1e3842a3069af4009e15d87e3b5a1c5b53)
It does not crash with 6.6.1