Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-39780

Valgrind reports read on deleted memory if model emits reset from destructor

    XMLWordPrintable

Details

    • 9f22767784dc859283b321c47636ea708eef3bfe (qtdeclarative)

    Description

      Valgrind says
      ==27114== Invalid read of size 8
      ==27114== at 0x56293E0: QQmlContext::isValid() const (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56DF243: QQmlDelegateModelPrivate::emitChanges() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56E5361: QQmlDelegateModel::_q_modelReset() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707524: QQmlDelegateModel::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707AEE: QQmlDelegateModel::qt_metacall(QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x63E29CC: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x6359EFD: QAbstractItemModel::endResetModel() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4031B2: MyModel::~MyModel() (main.cpp:17)
      ==27114== by 0x4043A6: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (in /home/tsdgeos_work/test/test)
      ==27114== by 0x4043F7: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (qqmlprivate.h:106)
      ==27114== by 0x63E136B: QObjectPrivate::deleteChildren() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x63EA0EB: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4FC74C5: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114== Address 0x1b6ac9f8 is 8 bytes inside a block of size 16 free'd
      ==27114== at 0x4C2C2BC: operator delete(void*) (vg_replace_malloc.c:503)
      ==27114== by 0x5629BF0: QQmlContextData::destroy() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x560D238: QQmlPrivate::qdeclarativeelement_destructor(QObject*) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x4FC74BD: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114==
      ==27114== Invalid read of size 8
      ==27114== at 0x56293E4: QQmlContext::isValid() const (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56DF243: QQmlDelegateModelPrivate::emitChanges() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56E5361: QQmlDelegateModel::_q_modelReset() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707524: QQmlDelegateModel::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707AEE: QQmlDelegateModel::qt_metacall(QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x63E29CC: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x6359EFD: QAbstractItemModel::endResetModel() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4031B2: MyModel::~MyModel() (main.cpp:17)
      ==27114== by 0x4043A6: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (in /home/tsdgeos_work/test/test)
      ==27114== by 0x4043F7: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (qqmlprivate.h:106)
      ==27114== by 0x63E136B: QObjectPrivate::deleteChildren() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x63EA0EB: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4FC74C5: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114== Address 0x1bafa150 is 112 bytes inside a block of size 144 free'd
      ==27114== at 0x4C2C2BC: operator delete(void*) (vg_replace_malloc.c:503)
      ==27114== by 0x63EA11F: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x5629D48: QQmlContext::~QQmlContext() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5629BF0: QQmlContextData::destroy() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x560D238: QQmlPrivate::qdeclarativeelement_destructor(QObject*) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x4FC74BD: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114==
      ==27114== Invalid read of size 8
      ==27114== at 0x56293ED: QQmlContext::isValid() const (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56DF243: QQmlDelegateModelPrivate::emitChanges() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56E5361: QQmlDelegateModel::_q_modelReset() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707524: QQmlDelegateModel::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707AEE: QQmlDelegateModel::qt_metacall(QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x63E29CC: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x6359EFD: QAbstractItemModel::endResetModel() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4031B2: MyModel::~MyModel() (main.cpp:17)
      ==27114== by 0x4043A6: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (in /home/tsdgeos_work/test/test)
      ==27114== by 0x4043F7: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (qqmlprivate.h:106)
      ==27114== by 0x63E136B: QObjectPrivate::deleteChildren() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x63EA0EB: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4FC74C5: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114== Address 0x1baf89d8 is 8 bytes inside a block of size 168 free'd
      ==27114== at 0x4C2C2BC: operator delete(void*) (vg_replace_malloc.c:503)
      ==27114== by 0x560D238: QQmlPrivate::qdeclarativeelement_destructor(QObject*) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x4FC74BD: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)

      on the attached code.

      I understand emitting reset from the destructor is not very useful, but in the real world code we are just reusing the clean() function that is also called in other instances that is not the destructor so it is very handy that it does not crash (it didn't use to in Qt 5.2)

      I'll attach main.cpp main.qml and test.pro

      Attachments

        1. main.cpp
          0.8 kB
        2. main.qml
          0.2 kB
        3. test.pro
          0.3 kB

        Issue Links

          For Gerrit Dashboard: QTBUG-39780
          # Subject Branch Project Status CR V

          Activity

            People

              shausman Simon Hausmann
              tsdgeos_canonical Albert Astals Cid (Canonical) (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes