Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-71037

Component::createObject() created objects are unexpectedly garbage collected leaving dangling pointers if parent is null

    XMLWordPrintable

Details

    • macOS
    • b17091b0006e41c0bb4ddf77dbbc09621d809aea (qt/qtdeclarative/5.12)

    Description

      I'm experiencing a regular crash in my QML application when using the QML debugger. The stack in the target application is:

      1 QQmlContextData::isValid() const qqmlcontext_p.h 122 0x1017f08cf 
        2 QQmlContext::isValid() const qqmlcontext.cpp 233 0x101822efc 
        3 QQmlEngineDebugServiceImpl::buildObjectList(QDataStream&, QQmlContext *, QList<QPointer<QObject>> const&) qqmlenginedebugservice.cpp 392 0x10f79a81f 
        4 QQmlEngineDebugServiceImpl::buildObjectList(QDataStream&, QQmlContext *, QList<QPointer<QObject>> const&) qqmlenginedebugservice.cpp 416 0x10f79a932 
        5 QQmlEngineDebugServiceImpl::buildObjectList(QDataStream&, QQmlContext *, QList<QPointer<QObject>> const&) qqmlenginedebugservice.cpp 416 0x10f79a932 
        6 QQmlEngineDebugServiceImpl::processMessage(QByteArray const&) qqmlenginedebugservice.cpp 536 0x10f796abc 
        7 QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QByteArray const&>, void, void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&)>::call(void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&), QQmlEngineDebugServiceImpl *, void * *) qobjectdefs_impl.h 134 0x10f7a1265 
        8 void QtPrivate::FunctionPointer<void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&)>::call<QtPrivate::List<QByteArray const&>, void>(void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&), QQmlEngineDebugServiceImpl *, void * *) qobjectdefs_impl.h 167 0x10f7a11b0 
        9 QtPrivate::QSlotObject<void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&), QtPrivate::List<QByteArray const&>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void * *, bool *) qobjectdefs_impl.h 396 0x10f7a10d6 
        10 QtPrivate::QSlotObjectBase::call(QObject *, void * *) qobjectdefs_impl.h 376 0x10225b196 
        11 QMetaCallEvent::placeMetaCall(QObject *) qobject.cpp 504 0x102297958 
        12 QObject::event(QEvent *) qobject.cpp 1251 0x102299668 
        13 QCoreApplicationPrivate::notify_helper(QObject *, QEvent *) qcoreapplication.cpp 1197 0x10224ba26 
        14 doNotify(QObject *, QEvent *) qcoreapplication.cpp 1138 0x10224b50a 
        15 QCoreApplication::notify(QObject *, QEvent *) qcoreapplication.cpp 1124 0x10224b5d7 
        16 QGuiApplication::notify(QObject *, QEvent *) qguiapplication.cpp 1770 0x102890166 
        17 QCoreApplication::notifyInternal2(QObject *, QEvent *) qcoreapplication.cpp 1048 0x10224b425 
        18 QCoreApplication::sendEvent(QObject *, QEvent *) qcoreapplication.h 234 0x10224ce78 
        19 QCoreApplicationPrivate::sendPostedEvents(QObject *, int, QThreadData *) qcoreapplication.cpp 1745 0x10224ccfe 
        20 QCoreApplication::sendPostedEvents(QObject *, int) qcoreapplication.cpp 1599 0x10224bebf 
        21 QCocoaEventDispatcherPrivate::processPostedEvents() qcocoaeventdispatcher.mm 897 0x108a2f87e 
        22 QCocoaEventDispatcherPrivate::postedEventsSourceCallback(void *) qcocoaeventdispatcher.mm 919 0x108a306ff 
        23 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 0x7fff52cf0405 
        24 __CFRunLoopDoSource0 0x7fff52cf03ab 
        25 __CFRunLoopDoSources0 0x7fff52cd3e51 
        26 __CFRunLoopRun 0x7fff52cd33fa 
        27 CFRunLoopRunSpecific 0x7fff52cd2ce4 
        28 RunCurrentEventLoopInMode 0x7fff51f6c895 
        29 ReceiveNextEventCommon 0x7fff51f6c5cb 
        30 _BlockUntilNextEventMatchingListInModeWithFilter 0x7fff51f6c348 
        31 _DPSNextEvent 0x7fff5022995b 
        32 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] 0x7fff502286fa 
        33 -[NSApplication run] 0x7fff5022275d 
        34 QCocoaEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qcocoaeventdispatcher.mm 430 0x108a2e530 
        35 QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qeventloop.cpp 136 0x10224566b 
        36 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) qeventloop.cpp 214 0x10224587b 
        37 QCoreApplication::exec() qcoreapplication.cpp 1336 0x10224bd2c 
        38 QGuiApplication::exec() qguiapplication.cpp 1761 0x102890106 
        39 main main.cpp 327 0x100011707 
        40 start 0x7fff7fd68085
      

      The message being processed is LIST_OBJECTS. In QQmlContextData::isValid():

      inline bool isValid() const 
      
      {     return engine && (!isInternal || !contextObject || !QObjectPrivate::get(contextObject)->wasDeleted); }
      

      QObjectPrivate::get(contextObject) returns null because contextObject->d_ptr == null. Dereferencing this null to access wasDeleted causes the crash.

      This seems to happen when the LIST_OBJECTS command arrives in the target while various QML objects are animating and being added or removed from display.

      No crash occurs if the debugger is not attached.

      Attachments

        1. bug_report.png
          bug_report.png
          743 kB
        2. Bug.zip
          4 kB
        For Gerrit Dashboard: QTBUG-71037
        # Subject Branch Project Status CR V

        Activity

          People

            ulherman Ulf Hermann
            dhess David Hess
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes