Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122686

Crash when processing hover events modifies object tree

    XMLWordPrintable

Details

    • d00e890e5 (dev), 60e2292e1 (6.7), 6fb3c761b (6.6), e59a677a3 (tqtc/lts-6.5)

    Description

      Breakdown of the issue, which can be reproduces with the attached project:

      https://github.com/qt/qtdeclarative/blob/5a762ba09cdeb8df5cf54ce562bc60dfcc11c97f/src/quick/util/qquickdeliveryagent.cpp#L1007

      The function above iterates over “hoverItems”:

      https://github.com/qt/qtdeclarative/blob/5a762ba09cdeb8df5cf54ce562bc60dfcc11c97f/src/quick/util/qquickdeliveryagent_p_p.h#L76C5-L76C53

      If the current “hoverId” does not match it can make a call to "deliverHoverEventToItem" here:

      https://github.com/qt/qtdeclarative/blob/5a762ba09cdeb8df5cf54ce562bc60dfcc11c97f/src/quick/util/qquickdeliveryagent.cpp#L1053

      This function can have side effects, example a mouse area closes the current window synchronously on a hover leave event.
      The close event triggers a hide, which in turn calls “clearHover()” here:
      https://github.com/qt/qtdeclarative/blob/5a762ba09cdeb8df5cf54ce562bc60dfcc11c97f/src/quick/util/qquickdeliveryagent.cpp#L1345

      Which clears the flatmap that is currently being iterated over.
      It returns from this point:

      https://github.com/qt/qtdeclarative/blob/5a762ba09cdeb8df5cf54ce562bc60dfcc11c97f/src/quick/util/qquickdeliveryagent.cpp#L1053

      And attempts to erase the iterator, which is now invalid, corrupting the flatmap which may continue iterating.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              vhilshei Volker Hilsheimer
              vhilshei Volker Hilsheimer
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes