Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122925

QQmlComponentPrivate::doBeginCreate can crash in some scenarios

XMLWordPrintable

    • 710d650d0 (dev), 73b2e33d7 (6.7), 08596ea03 (tqtc/lts-6.5)

      QQmlEnginePrivate::rootContext

      can be null in some cases when calling:

      QObject *QQmlComponentPrivate::doBeginCreate(QQmlComponent *q, QQmlContext *context)

      https://github.com/qt/qtdeclarative/blob/4ddbef67357275ba6f100ce028a81c92405720b7/src/qml/qml/qqmlcomponent.cpp#L335

      Causing this line to crash:

      https://github.com/qt/qtdeclarative/blob/4ddbef67357275ba6f100ce028a81c92405720b7/src/qml/qml/qqmlcomponent.cpp#L1014

       

      One example of this flow is as follows:

      QQmlEngine deletes the rootContext in its destructor and invalidates the typeLoader:

      https://github.com/qt/qtdeclarative/blob/4ddbef67357275ba6f100ce028a81c92405720b7/src/qml/qml/qqmlengine.cpp#L565
       
      Which calls:

      void QQmlTypeLoader::shutdownThread()
      {    
          if (m_thread && !m_thread->isShutdown())
              m_thread->shutdown(); //QQmlThread::shutdown()
      } 

       
      The QmlThread processes any events left in the list, some of which can be related to asynchronous component creation e.g.

      QQmlComponentPrivate::typeDataReady(QQmlTypeData *) override;

      Which triggers a "QQmlComponent::statusChanged" signal to "QQmlComponent::Ready"

      If the end user is still connected, they may attempt to finish creating the component with "QQmlComponent::create(nullptr)" (use rootContext as context) leading us to the crash described at the start.

       

      Example project of the crash is attached

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            ulherman Ulf Hermann
            ctummon Cathal Tummon
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved:

                There are no open Gerrit changes