Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-137072

[REG: 6.8 → 6.9] QMetaType::metaObject crashes the program

    XMLWordPrintable

Details

    • 45413384c (dev), 177475b98 (6.9), 46bc14100 (tqtc/lts-6.8)

    Description

      In a Qt Quick program that imports a JS module, trying to fetch the metaObject via QMetaType(/id/).metaObject() leads to a crash. Backtrace below:

      #0  0x00007ffff3aa774c in ?? () from /usr/lib/libc.so.6
      #1  0x00007ffff3a4ddc0 in raise () from /usr/lib/libc.so.6
      #2  0x00007ffff3a3557a in abort () from /usr/lib/libc.so.6
      #3  0x00007ffff441b9c8 in qAbort () at qtbase/src/corelib/global/qassert.cpp:46
      #4  0x00007ffff445969b in qt_message_fatal<QString&> (context=..., message=...) at qtbase/src/corelib/global/qlogging.cpp:2149
      #5  0x00007ffff4452615 in qt_message(QtMsgType, const QMessageLogContext &, const char *, typedef __va_list_tag __va_list_tag *) (msgType=QtFatalMsg, 
          context=..., msg=0x7ffff42ba190 "ASSERT failure in %s: \"%s\", file %s, line %d", ap=0x7fffffffc968)
          at qtbase/src/corelib/global/qlogging.cpp:381
      #6  0x00007ffff44546e2 in QMessageLogger::fatal (this=0x7fffffffcbc0, msg=0x7ffff42ba190 "ASSERT failure in %s: \"%s\", file %s, line %d")
          at qtbase/src/corelib/global/qlogging.cpp:883
      #7  0x00007ffff441ba9c in qt_assert_x (where=0x7ffff637f790 "QList::at", what=0x7ffff637f77d "index out of range", 
          file=0x7ffff637f748 "qtbase/src/corelib/tools/qlist.h", line=479) at qtbase/src/corelib/global/qassert.cpp:114
      #8  0x00007ffff64c3772 in QList<QBiPointer<QQmlPropertyCache const, QQmlPropertyCache> >::at (this=0x7fffe4006138, i=0)
      --Type <RET> for more, q to quit, c to continue without paging--
          at qtbase/src/corelib/tools/qlist.h:479
      #9  0x00007ffff6731566 in QQmlPropertyCacheVector::at (this=0x7fffe4006138, index=0)
          at qtdeclarative/src/qml/qml/qqmlpropertycachevector_p.h:75
      #10 0x00007ffff6731622 in QV4::CompiledData::CompilationUnit::rootPropertyCache (this=0x7fffe40060b0)
          at qtdeclarative/src/qml/common/qv4compileddata_p.h:1651
      #11 0x00007ffff691127a in propertyCacheForPotentialInlineComponentType (t=..., iter=...) at qtdeclarative/src/qml/qml/qqmlmetatypedata.cpp:251
      #12 0x00007ffff6911359 in QQmlMetaTypeData::findPropertyCacheInCompositeTypes (
          this=0x7ffff6c48180 <QGlobalStatic<QtGlobalStatic::Holder<(anonymous namespace)::Q_QGS_metaTypeData> >::instance()::holder>, t=...)
          at qtdeclarative/src/qml/qml/qqmlmetatypedata.cpp:259
      #13 0x00007ffff68dc37b in QQmlMetaType::metaObjectForType (metaType=...) at qtdeclarative/src/qml/qml/qqmlmetatype.cpp:1439
      #14 0x00007ffff68e012d in dynamicQmlMetaObject (iface=0x7fffe40cfce0) at qtdeclarative/src/qml/qml/qqmlmetatype_p.h:283
      #15 0x000055555555824d in QMetaType::metaObject() const ()
      #16 0x0000555555557671 in main::{lambda()#1}::operator()() const ()
      --Type <RET> for more, q to quit, c to continue without paging--
      #17 0x0000555555557f5d in QtPrivate::FunctorCall<std::integer_sequence<unsigned long>, QtPrivate::List<>, void, main::{lambda()#1}>::call(main::{lambda()#1}&, void**)::{lambda()#1}::operator()() const ()
      #18 0x0000555555557fdd in void QtPrivate::FunctorCallBase::call_internal<void, QtPrivate::FunctorCall<std::integer_sequence<unsigned long>, QtPrivate::List<>, void, main::{lambda()#1}>::call(main::{lambda()#1}&, void**)::{lambda()#1}>(void**, QtPrivate::FunctorCall<std::integer_sequence<unsigned long>, QtPrivate::List<>, void, main::{lambda()#1}>::call(main::{lambda()#1}&, void**)::{lambda()#1}&&) ()
      #19 0x0000555555557fa2 in QtPrivate::FunctorCall<std::integer_sequence<unsigned long>, QtPrivate::List<>, void, main::{lambda()#1}>::call(main::{lambda()#1}&, void**) ()
      #20 0x0000555555557f17 in void QtPrivate::FunctorCallable<main::{lambda()#1}>::call<QtPrivate::List<>, void>(main::{lambda()#1}&, void*, void**) ()
      #21 0x0000555555557e1d in QtPrivate::QCallableObject<main::{lambda()#1}, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*)
          ()
      #22 0x00007ffff453e2a5 in QtPrivate::QSlotObjectBase::call (this=0x5555558fc8f0, r=0x7fffffffd7c0, a=0x7fffffffd0a8)
          at qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
      #23 0x00007ffff45e79cf in doActivate<false> (sender=0x5555558fc960, signal_index=3, argv=0x7fffffffd0a8)
      --Type <RET> for more, q to quit, c to continue without paging--
          at qtbase/src/corelib/kernel/qobject.cpp:4138
      #24 0x00007ffff45dc14c in QMetaObject::activate (sender=0x5555558fc960, m=0x7ffff4a683e0 <QSingleShotTimer::staticMetaObject>, local_signal_index=0, argv=0x0)
          at qtbase/src/corelib/kernel/qobject.cpp:4198
      #25 0x00007ffff4608b01 in QSingleShotTimer::timeout (this=0x5555558fc960)
          at build/qtbase/src/corelib/Core_autogen/include/moc_qsingleshottimer_p.cpp:117
      #26 0x00007ffff4608882 in QSingleShotTimer::timerEvent (this=0x5555558fc960) at qtbase/src/corelib/kernel/qsingleshottimer.cpp:71
      #27 0x00007ffff45d2f16 in QObject::event (this=0x5555558fc960, e=0x7fffffffd400) at qtbase/src/corelib/kernel/qobject.cpp:1406
      #28 0x00007ffff45371d1 in QCoreApplicationPrivate::notify_helper (receiver=0x5555558fc960, event=0x7fffffffd400)
          at qtbase/src/corelib/kernel/qcoreapplication.cpp:1278
      #29 0x00007ffff4536db0 in doNotify (receiver=0x5555558fc960, event=0x7fffffffd400) at qtbase/src/corelib/kernel/qcoreapplication.cpp:1207
      #30 0x00007ffff4536ce4 in QCoreApplication::notify (this=0x7fffffffd7c0, receiver=0x5555558fc960, event=0x7fffffffd400)
          at qtbase/src/corelib/kernel/qcoreapplication.cpp:1190
      #31 0x00007ffff5608779 in QGuiApplication::notify (this=0x7fffffffd7c0, object=0x5555558fc960, event=0x7fffffffd400)
      --Type <RET> for more, q to quit, c to continue without paging--
          at qtbase/src/gui/kernel/qguiapplication.cpp:2076
      #32 0x00007ffff4536bb1 in QCoreApplication::notifyInternal2 (receiver=0x5555558fc960, event=0x7fffffffd400)
          at qtbase/src/corelib/kernel/qcoreapplication.cpp:1106
      #33 0x00007ffff45377b9 in QCoreApplication::sendEvent (receiver=0x5555558fc960, event=0x7fffffffd400)
          at qtbase/src/corelib/kernel/qcoreapplication.cpp:1546
      #34 0x00007ffff482f962 in QTimerInfoList::activateTimers (this=0x5555555e9f70) at qtbase/src/corelib/kernel/qtimerinfo_unix.cpp:426
      #35 0x00007ffff4a0ee08 in timerSourceDispatch (source=0x5555555e9f10) at qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:152
      #36 0x00007ffff39161e4 in ?? () from /usr/lib/libglib-2.0.so.0
      #37 0x00007ffff3979e97 in ?? () from /usr/lib/libglib-2.0.so.0
      #38 0x00007ffff3915615 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
      #39 0x00007ffff4a0fa90 in QEventDispatcherGlib::processEvents (this=0x5555555ebf20, flags=...)
          at qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:399
      #40 0x00007ffff0a4a972 in QXcbGlibEventDispatcher::processEvents (this=0x5555555ebf20, flags=...)
      --Type <RET> for more, q to quit, c to continue without paging--
          at qtbase/src/plugins/platforms/xcb/qxcbeventdispatcher.cpp:96
      #41 0x00007ffff454e8e8 in QEventLoop::processEvents (this=0x7fffffffd740, flags=...) at qtbase/src/corelib/kernel/qeventloop.cpp:104
      #42 0x00007ffff454ecdf in QEventLoop::exec (this=0x7fffffffd740, flags=...) at qtbase/src/corelib/kernel/qeventloop.cpp:186
      #43 0x00007ffff4537557 in QCoreApplication::exec () at qtbase/src/corelib/kernel/qcoreapplication.cpp:1449
      #44 0x00007ffff560853c in QGuiApplication::exec () at qtbase/src/gui/kernel/qguiapplication.cpp:1993
      #45 0x000055555555786c in main ()
       

      Git bisecting leads to the following commit in qtdeclarative:

      commit c1bd8ee91fd1462235d4bccbcf5286864d0fcbf7
      
      Author: Ulf Hermann <ulf.hermann@qt.io>
      
      Date:   Thu Jan 23 11:45:10 2025 +0100
      
          QtQml: Store script CUs in QQmlMetaTypeData
      

      MRE attached.

      It is important to note that the crash was discovered while trying to attach gammaray to a QtQuick app. Gammaray scans all available metatypes on attach and thus crashes the app.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            ulherman Ulf Hermann
            waqar Waqar Ahmed
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes