Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122925

QQmlComponentPrivate::doBeginCreate can crash in some scenarios

    XMLWordPrintable

Details

    • 710d650d0 (dev), 73b2e33d7 (6.7), 08596ea03 (tqtc/lts-6.5)

    Description

      QQmlEnginePrivate::rootContext

      can be null in some cases when calling:

      QObject *QQmlComponentPrivate::doBeginCreate(QQmlComponent *q, QQmlContext *context)

      https://github.com/qt/qtdeclarative/blob/4ddbef67357275ba6f100ce028a81c92405720b7/src/qml/qml/qqmlcomponent.cpp#L335

      Causing this line to crash:

      https://github.com/qt/qtdeclarative/blob/4ddbef67357275ba6f100ce028a81c92405720b7/src/qml/qml/qqmlcomponent.cpp#L1014

       

      One example of this flow is as follows:

      QQmlEngine deletes the rootContext in its destructor and invalidates the typeLoader:

      https://github.com/qt/qtdeclarative/blob/4ddbef67357275ba6f100ce028a81c92405720b7/src/qml/qml/qqmlengine.cpp#L565
       
      Which calls:

      void QQmlTypeLoader::shutdownThread()
      {    
          if (m_thread && !m_thread->isShutdown())
              m_thread->shutdown(); //QQmlThread::shutdown()
      } 

       
      The QmlThread processes any events left in the list, some of which can be related to asynchronous component creation e.g.

      QQmlComponentPrivate::typeDataReady(QQmlTypeData *) override;

      Which triggers a "QQmlComponent::statusChanged" signal to "QQmlComponent::Ready"

      If the end user is still connected, they may attempt to finish creating the component with "QQmlComponent::create(nullptr)" (use rootContext as context) leading us to the crash described at the start.

       

      Example project of the crash is attached

      Attachments

        For Gerrit Dashboard: QTBUG-122925
        # Subject Branch Project Status CR V

        Activity

          People

            ulherman Ulf Hermann
            ctummon Cathal Tummon
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes