Details
-
Bug
-
Resolution: Fixed
-
P1: Critical
-
6.8
-
None
-
7e1505439 (dev), 0c8941aaf (6.8), fa7a25418 (tqtc/lts-6.5)
Description
The following accesses a destroyed object in the second iteration, but I haven't managed to make it crash yet:
import QtQml QtObject { id: root property int sum: 0 Component.onCompleted: { try { const handler = {}; let target = {prop1: 1, prop2: 2, prop3: 3 }; let proxy = Proxy.revocable(target, handler); target = null; for (var prop in proxy.proxy) { root.sum += 5 - prop[4] console.log(root.sum, prop); proxy.revoke() gc() } } catch (e) { console.log(e); } Qt.quit(); } }
Attachments
For Gerrit Dashboard: QTBUG-129310 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
587100,4 | ForInIteratorObject: also mark target | dev | qt/qtdeclarative | Status: MERGED | +2 | 0 |
587164,4 | ForInIteratorObject: also mark target | tqtc/lts-6.5 | qt/tqtc-qtdeclarative | Status: MERGED | +2 | 0 |
595015,2 | ForInIteratorObject: also mark target | 6.8 | qt/qtdeclarative | Status: MERGED | +2 | 0 |