Details
-
Bug
-
Resolution: Done
-
P2: Important
-
5.6.0 Alpha
-
None
-
1e3924d8f585dd9099eb74ffbc17950c693d14da, fa8bfd6ed (dev), fc84765ce (6.10), c1539406e (6.9)
Description
Run the following example and click one of the items => crash. The test case looks silly, but ListView really shouldn't crash that easily...
import QtQuick 2.2 import QtQml.Models 2.1 import QtQuick.Window 2.1 Window { id: window width: 360 height: 360 visible: true ListView { anchors.fill: parent anchors.margins: 20 spacing: 20 model: ObjectModel { MouseArea { width: 160; height: 160 Rectangle { anchors.fill: parent; color: "tan" } onClicked: destroy() } MouseArea { width: 160; height: 160 Rectangle { anchors.fill: parent; color: "thistle" } onClicked: destroy() } MouseArea { width: 160; height: 160 Rectangle { anchors.fill: parent; color: "tomato" } onClicked: destroy() } } } }
A more realistic use case is in Qt Quick Controls 2, namely TabBar and SwipeView. Both use ListView + ObjectModel internally, and offer an API to add/insert/move/remove items dynamically. This means that items may get destroyed while the view and model are still alive.
Attachments
For Gerrit Dashboard: QTBUG-46798 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
659932,1 | Fix heap-use-after-free in Container when using ListView transitions | tqtc/lts-6.8 | qt/tqtc-qtdeclarative | Status: NEW | 0 | 0 |
115223,6 | Fixed a QQuickListView crash | dev | qt/qtdeclarative | Status: MERGED | -2 | 0 |
629802,23 | Fix heap-use-after-free in Container when using ListView transitions | dev | qt/qtdeclarative | Status: MERGED | +2 | 0 |
658602,2 | Fix heap-use-after-free in Container when using ListView transitions | 6.10 | qt/qtdeclarative | Status: MERGED | +2 | 0 |
658701,3 | Fix heap-use-after-free in Container when using ListView transitions | 6.9 | qt/qtdeclarative | Status: MERGED | +2 | 0 |