Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-18904

Heap corruption while using QVariant or QList<QVariant> retreiving QSettings values in MSVC 2010

    XMLWordPrintable

Details

    • Bug
    • Resolution: Cannot Reproduce
    • Not Evaluated
    • None
    • 4.7.2
    • None
    • MSVC 2010
      Windows Vista 64bit

    Description

      In the following function, we are getting this:

      crash stack dump
          msvcr100d.dll!operator delete(void * pUserData) Line 52 + 0x51 bytes C++
          > testini.exe!QVariant::`scalar deleting destructor'() + 0x46 bytes C++
          testini.exe!QList<QVariant>::node_destruct(QList<QVariant>::Node * from, QList<QVariant>::Node * to) Line 418 + 0x3e bytes C++
          testini.exe!QList<QVariant>::free(QListData::Data * data) Line 744 C++
          testini.exe!QList<QVariant>::~QList<QVariant>() Line 718 C++
          testini.exe!WzConfig::vector2i(const QString & name) Line 65 + 0x1d bytes C++
          testini.exe!main(int argc, char * * argv) Line 82 + 0x31 bytes C++
      

      Or in other words, it crashes on the destructor at the end of the function.

      crashes on exit of fuction
          Vector2i WzConfig::vector2i(const QString &name)
          {
          Vector2i r;
          ASSERT_OR_RETURN(r, contains(name), "Missing %s", name.toUtf8().constData());
          QVariantList v = value(name).toList();
          ASSERT(v.size() == 2, "Bad list of %s", name.toUtf8().constData());
          r.x = v[0].toInt();
          r.y = v[1].toInt();
          return r;
          }
      

      If the above function is rewritten to:

      no crashes
      Vector2i WzConfig::vector2i(const QString &name)
      {
      	Vector2i r;
      	ASSERT_OR_RETURN(r, contains(name), "Missing %s", name.toUtf8().constData());
      	QStringList v = value(name).toStringList();
      	ASSERT(v.size() == 2, "Bad list of %s", name.toUtf8().constData());
      	r.x = v[0].toInt();
      	r.y = v[1].toInt();
      	return r;
      }
      

      Then there is no crash.

      Also have tried QList<QVariant> v = value(name).toStringList();
      and that crashes like the above example.

      class WzConfig : public QSettings
      {
      	Q_OBJECT
      
      public:
      	WzConfig(const QString &name, QObject *parent = 0) : QSettings(QString("test.ini"), QSettings::IniFormat, parent) { Q_UNUSED(name); }
      	Vector3f vector3f(const QString &name);
      	void setVector3f(const QString &name, const Vector3f &v);
      	Vector3i vector3i(const QString &name);
      	void setVector3i(const QString &name, const Vector3i &v);
      	Vector2i vector2i(const QString &name);
      	void setVector2i(const QString &name, const Vector2i &v);
      };
      
      struct Vector2i
      {
      	Vector2i() {}
      	Vector2i(int x, int y) : x(x), y(y) {}
      
      	int x, y;
      };
      
      
          int main(int argc, char *argv[])
          {
          QCoreApplication a(argc, argv);
           
          {
          WzConfig ini("test.ini");
          ini.setVector2i("test", Vector2i(1, 2));
          ini.setVector3i("test2", Vector3i(1, 2, 3));
          ini.setVector3f("test3", Vector3f(1, 2, 3));
          ini.setVector3f("test3", Vector3i(1, 2, 3));
          ini.setVector3i("test3", Rotation(1, 2, 3));
          }
          {
          WzConfig ini("test.ini");
          Vector2i v = ini.vector2i("test");
          qWarning("x = %d, y = %d", v.x, v.y);
          }
           
          return 0;
          }
      
      

      Since the VS2010 libs are not available, Qt was build from scratch.

      If there is anything else you need, let me know.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            earthdomain Earth Domain (Inactive)
            buginator ..
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes