Details
-
Bug
-
Resolution: Done
-
P1: Critical
-
5.2.0, 5.12
-
None
Description
The DynamicRoleModel code performs unsafe qobject_cast operations in its dtor and in the propertyWrite function.
The code assumes that if the data at that index is a QObject pointer, that the QObject is still valid / hasn't been destroyed, but the model doesn't necessarily have ownership of that object (unless it was a sub-model which it created in propertyWritten) and since the QObject pointer is stored in a QVariant, it's not guarded in any way.
Some possible solutions:
1) store a QSet of sub-model indices, which is maintained in propertyWritten, and only access/delete the QObject pointers at those indices in the dtor / propertyWrite.
2) guard ALL qobject pointers by having a QHash of QObject pointer to data index + role, and connecting the qobject::destroyed() signal to a guard function which updates the data at the related index/role to null.
Attachments
Issue Links
- is duplicated by
-
QTBUG-38907 ListModel with dynamicRoles enabled crashes after inserted different type of data
- Closed
- relates to
-
QTBUG-36156 QQmlAdaptorModel doesn't detect deleted QObject items
- Open