Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-62087

Segfault in QV4::SimpleArrayData with a simple testcase

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P1: Critical
    • Resolution: Done
    • Affects Version/s: 5.8.0, 5.9.1, 5.10.0 Beta 1, 5.10.0, 5.10.1
    • Fix Version/s: 5.9.5
    • Labels:
      None
    • Environment:
      1) Linux pc 4.12.2-1-ARCH #1 SMP PREEMPT x86_64 GNU/Linux
      2) Windows 10 x86_64 / Windows 7
      3) Android 6.0 x86
      4) Android 8.0 armeabi-v7a
    • Commits:
      efc7f85520f19dfc5628704cfb5bbe3bc546297f

      Description

      A simple testcase (see below for a more complex one with smaller arrays and smaller expected memory consumption):

      import QtQuick 2.0
      
      Item {
      	Component.onCompleted: {
      		var len = 3000000;
      		var foo = new Array(len + 1).join('x');
      		var chars = foo.split('');
      	}
      }
      

      The `len` required to crash is dependent on the platform, e.g.

      • On Android phone (Nexus 5x with Android 8), it's below 600000
      • On my Linux setup, it's below 2100000

      For comparison, Node.js/v8 memory consumption on this test with various lengths:

      • 0 — 9 MiB (baseline)
      • 600000 — 19 MiB
      • 2100000 — 45 MiB

      Allocating a single array is not the only way to reach the segfault, but that was the most simple testcase.

      Here is a more complex one, involving smaller arrays and smaller expected memory consumption:

      var foo, chars, i;
      for (i = 0; i < 100; i++) {
      	console.log(i)
      	foo = new Array(i * 10000 + 1).join('x');
      	chars = foo.split('');
      }
      

      That also works in an asynchronous way:

      Timer {
      	interval: 10
      	running: true
      	repeat: true
      	property int i: 0
      	onTriggered: {
      		console.log(i)
      		var foo = new Array(i * 10000 + 1).join('x');
      		var chars = foo.split('');
      		i++;
      	}
      }
      

      On my Linux pc, it segfaults at about i~=30 (drifting a bit).

        Attachments

          Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            Activity

              People

              Assignee:
              erikv Erik Verbruggen
              Reporter:
              chalker Сковорода Никита
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Gerrit Reviews

                  There are no open Gerrit changes