Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-39780

Valgrind reports read on deleted memory if model emits reset from destructor

XMLWordPrintable

    • 9f22767784dc859283b321c47636ea708eef3bfe (qtdeclarative)

      Valgrind says
      ==27114== Invalid read of size 8
      ==27114== at 0x56293E0: QQmlContext::isValid() const (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56DF243: QQmlDelegateModelPrivate::emitChanges() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56E5361: QQmlDelegateModel::_q_modelReset() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707524: QQmlDelegateModel::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707AEE: QQmlDelegateModel::qt_metacall(QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x63E29CC: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x6359EFD: QAbstractItemModel::endResetModel() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4031B2: MyModel::~MyModel() (main.cpp:17)
      ==27114== by 0x4043A6: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (in /home/tsdgeos_work/test/test)
      ==27114== by 0x4043F7: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (qqmlprivate.h:106)
      ==27114== by 0x63E136B: QObjectPrivate::deleteChildren() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x63EA0EB: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4FC74C5: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114== Address 0x1b6ac9f8 is 8 bytes inside a block of size 16 free'd
      ==27114== at 0x4C2C2BC: operator delete(void*) (vg_replace_malloc.c:503)
      ==27114== by 0x5629BF0: QQmlContextData::destroy() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x560D238: QQmlPrivate::qdeclarativeelement_destructor(QObject*) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x4FC74BD: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114==
      ==27114== Invalid read of size 8
      ==27114== at 0x56293E4: QQmlContext::isValid() const (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56DF243: QQmlDelegateModelPrivate::emitChanges() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56E5361: QQmlDelegateModel::_q_modelReset() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707524: QQmlDelegateModel::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707AEE: QQmlDelegateModel::qt_metacall(QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x63E29CC: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x6359EFD: QAbstractItemModel::endResetModel() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4031B2: MyModel::~MyModel() (main.cpp:17)
      ==27114== by 0x4043A6: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (in /home/tsdgeos_work/test/test)
      ==27114== by 0x4043F7: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (qqmlprivate.h:106)
      ==27114== by 0x63E136B: QObjectPrivate::deleteChildren() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x63EA0EB: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4FC74C5: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114== Address 0x1bafa150 is 112 bytes inside a block of size 144 free'd
      ==27114== at 0x4C2C2BC: operator delete(void*) (vg_replace_malloc.c:503)
      ==27114== by 0x63EA11F: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x5629D48: QQmlContext::~QQmlContext() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5629BF0: QQmlContextData::destroy() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x560D238: QQmlPrivate::qdeclarativeelement_destructor(QObject*) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x4FC74BD: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114==
      ==27114== Invalid read of size 8
      ==27114== at 0x56293ED: QQmlContext::isValid() const (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56DF243: QQmlDelegateModelPrivate::emitChanges() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x56E5361: QQmlDelegateModel::_q_modelReset() (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707524: QQmlDelegateModel::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x5707AEE: QQmlDelegateModel::qt_metacall(QMetaObject::Call, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x63E29CC: QMetaObject::activate(QObject*, int, int, void**) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x6359EFD: QAbstractItemModel::endResetModel() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4031B2: MyModel::~MyModel() (main.cpp:17)
      ==27114== by 0x4043A6: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (in /home/tsdgeos_work/test/test)
      ==27114== by 0x4043F7: QQmlPrivate::QQmlElement<MyModel>::~QQmlElement() (qqmlprivate.h:106)
      ==27114== by 0x63E136B: QObjectPrivate::deleteChildren() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x63EA0EB: QObject::~QObject() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.3.0)
      ==27114== by 0x4FC74C5: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)
      ==27114== Address 0x1baf89d8 is 8 bytes inside a block of size 168 free'd
      ==27114== at 0x4C2C2BC: operator delete(void*) (vg_replace_malloc.c:503)
      ==27114== by 0x560D238: QQmlPrivate::qdeclarativeelement_destructor(QObject*) (in /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5.3.0)
      ==27114== by 0x4FC74BD: QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A169: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x505A1D8: QQuickView::~QQuickView() (in /usr/lib/x86_64-linux-gnu/libQt5Quick.so.5.3.0)
      ==27114== by 0x402C17: main (main.cpp:36)

      on the attached code.

      I understand emitting reset from the destructor is not very useful, but in the real world code we are just reusing the clean() function that is also called in other instances that is not the destructor so it is very handy that it does not crash (it didn't use to in Qt 5.2)

      I'll attach main.cpp main.qml and test.pro

        1. main.cpp
          0.8 kB
        2. main.qml
          0.2 kB
        3. test.pro
          0.3 kB
        For Gerrit Dashboard: QTBUG-39780
        # Subject Branch Project Status CR V

            shausman Simon Hausmann
            tsdgeos_canonical Albert Astals Cid (Canonical) (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved:

                There are no open Gerrit changes