Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-22344

createQmlObject crashes under various circumstances

    XMLWordPrintable

Details

    Description

      There are several issues here. It is possible that http://codereview.qt-project.org/#change,6019 will fix some or none of them.

      The first issue is that newline characters within an internal script cause a crash.

      import QtQuick 2.0
      
      Item {
          id: root;
          function createObject() {
              return Qt.createQmlObject("
                          import QtQuick 2.0;
                          Item {
                              id: testOne;
                              x: 50;
                              y: 100;
                          }", root);
          }
      
          Component.onCompleted: {
              console.log(createObject().x); // expect "50", get a crash.
          }
      }
      

      Note that if we do:

      import QtQuick 2.0
      
      Item {
          id: root;
          function createObject() {
              return Qt.createQmlObject("import QtQuick 2.0; Item { id: testOne; x: 50; y: 100; }", root);
          }
      
          Component.onCompleted: {
              console.log(createObject().x); // expect "50", get "50"
          }
      }
      

      then it works as expected.

      The second issue is that ids within internal scripts do not resolve properly.

      import QtQuick 2.0
      
      Item {
          id: root;
      
          function createObject() {
              var qobjectRef;
              try {
                  qobjectRef = Qt.createQmlObject("import QtQuick 2.0; Item { id: testOne; x: 50; y: 100; width: 200; height: 400; Item { id: testTwo; property int t2ip: 2; } property var t1c0ip: testOne.testTwo.t2ip; }", root);
              } catch (e) {
                  console.log("error occurred: " + e.toString());
              }
              return qobjectRef;
          }
      
          Component.onCompleted: {
              var obj = createObject();
              console.log(obj.t1c0ip); // expect "2", get "inline:1: TypeError: Cannot read property 't2ip' of undefined" as testOne.testTwo doesn't resolve properly
          }
      }
      

      Note that:

      import QtQuick 2.0
      
      Item {
          id: root;
      
          function createObject() {
              var qobjectRef;
              try {
                  qobjectRef = Qt.createQmlObject("import QtQuick 2.0; Item { id: testOne; x: 50; y: 100; width: 200; height: 400; Item { id: testTwo; property int t2ip: 2; } property var t1c0ip: testOne.children[0].t2ip; }", root);
              } catch (e) {
                  console.log("error occurred: " + e.toString());
              }
              return qobjectRef;
          }
      
          Component.onCompleted: {
              var obj = createObject();
              console.log(obj.t1c0ip); // expect "2", get "2"
          }
      }
      

      works as expected.

      The third problem is that after some random amount of GC cycles the code will crash (may be related to https://bugreports.qt.nokia.com/browse/QTBUG-22237):

      import QtQuick 2.0
      
      Item {
          id: root
          Component.onCompleted: {
              var retn;
              var i = 0; var iterations = 10000;
              for (i = 0; i < iterations; ++i) {
                  retn = Qt.createQmlObject("import QtQuick 2.0;Item { id: complexItem; width: 200; height: 200; x: 100; y: 100;property int first: 1;property bool second: true;property string third: '3';property int fourth: 4;property int fifth: 5;property int sixth: 6;property int seventh: 7;property int eighth: 8;signal firstSignal();signal secondSignal();function firstFunc() { first = first + 1; firstSignal(); } function secondFunc() { if (second == true) second = false; secondSignal(); } function thirdFunc() { return false; } function fourthFunc() { return 42; } Item { id: itemFoo;anchors.fill: parent;property string foo: 'foo'; } Item { id: itemBar;anchors.fill: parent;property string bar: 'bar'; Item { id: itemBaz;property string baz: 'baz'; } } property var vfoo: complexItem.children[0]; property var vbar: complexItem.children[1]; property var vbaz: complexItem.children[1].children[0]; }", root);
              }
          }
      }
      

      Funnily enough, this problem appears to vanish if the FastAccessors generation code in QV8QObjectWrapper::newObject() is removed.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              mvogt Matthew Vogt (closed Nokia identity) (Inactive)
              chriadam Christopher Adams (closed Nokia identity) (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes