Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-63063

Crash in QV4 memory manager

    XMLWordPrintable

    Details

    • Commits:
      0167f5fc6115cbb52ecd1d882048c1f2cf70fc7f

      Description

      The crash is reproducible with qtquickcontrols2/tests/benchmarks/creationtime. I'm not sure which particular commit causes the crash, but it appears between 18ac01a..ad63e84. The merge commit 43a615e3 looks also quite complicated, so perhaps something went wrong there, because I'm not able to reproduce the crash in 5.9.

      Thread 1 "tst_creationtim" received signal SIGSEGV, Segmentation fault.
      0x00007f814496ec02 in QV4::MarkStack::push (m=0x7f810fc2d920, this=0x7fffffffb870)
          at /home/jpnurmi/Projects/qt-510/qtbase/include/QtQml/5.10.0/QtQml/private/../../../../../../qtdeclarative/src/qml/memory/qv4mmdefs_p.h:279
      279	        *top = m;
      (gdb) bt
      #0  0x00007f814496ec02 in QV4::MarkStack::push(QV4::Heap::Base*) (m=0x7f810fc2d920, this=0x7fffffffb870)
          at /home/jpnurmi/Projects/qt-510/qtbase/include/QtQml/5.10.0/QtQml/private/../../../../../../qtdeclarative/src/qml/memory/qv4mmdefs_p.h:279
      #1  0x00007f814496ec02 in QV4::Heap::Base::mark(QV4::MarkStack*) (markStack=0x7fffffffb870, this=0x7f810fc2d920)
          at /home/jpnurmi/Projects/qt-510/qtbase/include/QtQml/5.10.0/QtQml/private/../../../../../../qtdeclarative/src/qml/jsruntime/qv4engine_p.h:524
      #2  0x00007f814496ec02 in QV4::CompiledData::CompilationUnit::markObjects(QV4::MarkStack*) (this=0x7f8112974dd0, markStack=markStack@entry=0x7fffffffb870) at compiler/qv4compileddata.cpp:252
      #3  0x00007f8144a4530f in QV4::ExecutionEngine::markObjects(QV4::MarkStack*) (this=0x57dc00, markStack=markStack@entry=0x7fffffffb870) at jsruntime/qv4engine.cpp:988
      #4  0x00007f814494df76 in QV4::MemoryManager::collectRoots(QV4::MarkStack*) (this=this@entry=0x5dc200, markStack=markStack@entry=0x7fffffffb870) at memory/qv4mm.cpp:999
      #5  0x00007f814494e2ba in QV4::MemoryManager::mark() (this=this@entry=0x5dc200) at memory/qv4mm.cpp:1047
      #6  0x00007f814494f1b8 in QV4::MemoryManager::runGC() (this=this@entry=0x5dc200) at memory/qv4mm.cpp:1151
      #7  0x00007f8144952006 in QV4::MemoryManager::allocData(unsigned long) (this=0x5dc200, size=128) at memory/qv4mm.cpp:928
      #8  0x00007f8144952114 in QV4::MemoryManager::allocObjectWithMemberData(QV4::VTable const*, unsigned int) (this=this@entry=0x5dc200, vtable=vtable@entry=0x7f8144d55780 <QV4::QmlListWrapper::static_vtbl>, nMembers=<optimized out>) at memory/qv4mm.cpp:944
      #9  0x00007f8144be942e in QV4::MemoryManager::allocateObject<QV4::QmlListWrapper>() (this=0x5dc200)
          at /home/jpnurmi/Projects/qt-510/qtbase/include/QtQml/5.10.0/QtQml/private/../../../../../../qtdeclarative/src/qml/memory/qv4mm_p.h:256
      #10 0x00007f8144be942e in QV4::MemoryManager::allocObject<QV4::QmlListWrapper>() (this=0x5dc200)
          at /home/jpnurmi/Projects/qt-510/qtbase/include/QtQml/5.10.0/QtQml/private/../../../../../../qtdeclarative/src/qml/memory/qv4mm_p.h:341
      #11 0x00007f8144be942e in QV4::QmlListWrapper::create(QV4::ExecutionEngine*, QObject*, int, int) (engine=engine@entry=0x57dc00, object=object@entry=0x4f72470, propId=31, propType=1213)
          at qml/qqmllistwrapper.cpp:77
      #12 0x00007f8144b10f79 in loadProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData const&) (v4=v4@entry=0x57dc00, object=object@entry=0x4f72470, property=...) at jsruntime/qv4qobjectwrapper.cpp:132
      #13 0x00007f8144b115af in QV4::QObjectWrapper::getProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData*, bool) (engine=engine@entry=0x57dc00, object=object@entry=0x4f72470, property=property@entry=0x7f81102c88d8, captureRequired=captureRequired@entry=true) at jsruntime/qv4qobjectwrapper.cpp:261
      #14 0x00007f8144b148f4 in QV4::QObjectWrapper::getQmlProperty(QV4::ExecutionEngine*, QQmlContextData*, QObject*, QV4::String*, QV4::QObjectWrapper::RevisionMode, bool*) (engine=engine@entry=0x57dc00, qmlContext=qmlContext@entry=0x4f72750, object=object@entry=0x4f72470, name=name@entry=0x7f812192a500, revisionMode=revisionMode@entry=QV4::QObjectWrapper::CheckRevision, hasProperty=hasProperty@entry=0x7fffffffbe10)
          at jsruntime/qv4qobjectwrapper.cpp:376
      #15 0x00007f8144aa6f0b in QV4::QQmlContextWrapper::get(QV4::Managed const*, QV4::String*, bool*) (m=<optimized out>, name=0x7f812192a500, hasProperty=0x7fffffffbedf) at jsruntime/qv4qmlcontext.cpp:198
      #16 0x00007f8144a5603d in QV4::Object::get(QV4::String*, bool*) const (hasProperty=0x7fffffffbedf, name=0x7f812192a500, this=<optimized out>) at jsruntime/qv4object_p.h:380
      #17 0x00007f8144a5603d in QV4::ExecutionContext::getProperty(QV4::String*) (this=0x7f812192a490, name=0x7f812192a500) at jsruntime/qv4context.cpp:452
      #18 0x00007f8144b2e1bf in QV4::Runtime::method_getActivationProperty(QV4::ExecutionEngine*, int) (engine=0x57dc00, nameIndex=<optimized out>) at jsruntime/qv4runtime.cpp:774
      #19 0x00007f810a05c259 in  ()
      #20 0x0000000000000001 in  ()
      #21 0x0000000000000002 in  ()
      #22 0x00007fffffffc070 in  ()
      #23 0x00007f81211e3243 in QQuickOverlayAttached::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (_o=_o@entry=0xfffc000000000000, _c=_c@entry=4294950896, _id=_id@entry=1, _a=_a@entry=0x7f812192a4f8) at .moc/moc_qquickoverlay_p.cpp:389
      #24 0x00007f81211e343a in QQuickOverlayAttached::qt_metacall(QMetaObject::Call, int, void**) (this=0xfffc000000000000, _c=4294950896, _id=1, _a=0x7f812192a4f8) at .moc/moc_qquickoverlay_p.cpp:434
      #25 0x00007f8144a56fca in QV4::ExecutionContext::simpleCall(QV4::Scope&, QV4::CallData*, QV4::Function*) (this=0x57dc00, scope=..., callData=callData@entry=0x7f812192a440, function=0x57dc00, 
          function@entry=0x3f2a240) at jsruntime/qv4context.cpp:302
      #26 0x00007f8144bd9953 in QQmlJavaScriptExpression::evaluate(QV4::CallData*, bool*, QV4::Scope&) (this=this@entry=0x4c4e850, callData=0x7f812192a440, isUndefined=isUndefined@entry=0x7fffffffc19f, scope=...)
          at qml/qqmljavascriptexpression.cpp:223
      #27 0x00007f8144be59fe in QQmlNonbindingBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlags<QQmlPropertyData::WriteFlag>, QV4::Scope&) (this=0x4c4e850, watcher=..., flags=..., scope=...)
          at qml/qqmlbinding.cpp:207
      #28 0x00007f8144be2fca in QQmlBinding::update(QFlags<QQmlPropertyData::WriteFlag>) (this=this@entry=0x4c4e850, flags=flags@entry=...) at qml/qqmlbinding.cpp:168
      #29 0x00007f8144be39a4 in QQmlBinding::setEnabled(bool, QFlags<QQmlPropertyData::WriteFlag>) (this=0x4c4e850, e=<optimized out>, flags=...) at qml/qqmlbinding.cpp:499
      #30 0x00007f8144b46c39 in QQmlData::flushPendingBindingImpl(QQmlPropertyIndex) (this=0x4f72490, index=...) at qml/qqmlengine.cpp:910
      #31 0x00007f8144b115c5 in QQmlData::flushPendingBinding(QObject*, QQmlPropertyIndex) (propertyIndex=..., o=0x4f72470)
          at /home/jpnurmi/Projects/qt-510/qtbase/include/QtQml/5.10.0/QtQml/private/../../../../../../qtdeclarative/src/qml/qml/qqmldata_p.h:326
      #32 0x00007f8144b115c5 in QV4::QObjectWrapper::getProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData*, bool) (engine=engine@entry=0x57dc00, object=object@entry=0x4f72470, property=property@entry=0x7f81102c85f8, captureRequired=captureRequired@entry=true) at jsruntime/qv4qobjectwrapper.cpp:229
      #33 0x00007f8144b148f4 in QV4::QObjectWrapper::getQmlProperty(QV4::ExecutionEngine*, QQmlContextData*, QObject*, QV4::String*, QV4::QObjectWrapper::RevisionMode, bool*) (engine=engine@entry=0x57dc00, qmlContext=qmlContext@entry=0x4f72750, object=object@entry=0x4f72470, name=name@entry=0x7f812192a3f8, revisionMode=revisionMode@entry=QV4::QObjectWrapper::CheckRevision, hasProperty=hasProperty@entry=0x7fffffffc490)
          at jsruntime/qv4qobjectwrapper.cpp:376
      #34 0x00007f8144aa6f0b in QV4::QQmlContextWrapper::get(QV4::Managed const*, QV4::String*, bool*) (m=<optimized out>, name=0x7f812192a3f8, hasProperty=0x7fffffffc55f) at jsruntime/qv4qmlcontext.cpp:198
      #35 0x00007f8144a5603d in QV4::Object::get(QV4::String*, bool*) const (hasProperty=0x7fffffffc55f, name=0x7f812192a3f8, this=<optimized out>) at jsruntime/qv4object_p.h:380
      #36 0x00007f8144a5603d in QV4::ExecutionContext::getProperty(QV4::String*) (this=0x7f812192a378, name=0x7f812192a3f8) at jsruntime/qv4context.cpp:452
      #37 0x00007f8144b2e1bf in QV4::Runtime::method_getActivationProperty(QV4::ExecutionEngine*, int) (engine=0x57dc00, nameIndex=<optimized out>) at jsruntime/qv4runtime.cpp:774
      #38 0x00007f810a05bb0c in  ()
      #39 0x0000000000000000 in  ()
      

        Attachments

          Issue Links

          For Gerrit Dashboard: QTBUG-63063
          # Subject Branch Project Status CR V

            Activity

              People

              Assignee:
              laknoll Lars Knoll
              Reporter:
              jpnurmi J-P Nurmi
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Gerrit Reviews

                  There are no open Gerrit changes