Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-71037

Component::createObject() created objects are unexpectedly garbage collected leaving dangling pointers if parent is null

XMLWordPrintable

    • macOS
    • b17091b0006e41c0bb4ddf77dbbc09621d809aea (qt/qtdeclarative/5.12)

      I'm experiencing a regular crash in my QML application when using the QML debugger. The stack in the target application is:

      1 QQmlContextData::isValid() const qqmlcontext_p.h 122 0x1017f08cf 
        2 QQmlContext::isValid() const qqmlcontext.cpp 233 0x101822efc 
        3 QQmlEngineDebugServiceImpl::buildObjectList(QDataStream&, QQmlContext *, QList<QPointer<QObject>> const&) qqmlenginedebugservice.cpp 392 0x10f79a81f 
        4 QQmlEngineDebugServiceImpl::buildObjectList(QDataStream&, QQmlContext *, QList<QPointer<QObject>> const&) qqmlenginedebugservice.cpp 416 0x10f79a932 
        5 QQmlEngineDebugServiceImpl::buildObjectList(QDataStream&, QQmlContext *, QList<QPointer<QObject>> const&) qqmlenginedebugservice.cpp 416 0x10f79a932 
        6 QQmlEngineDebugServiceImpl::processMessage(QByteArray const&) qqmlenginedebugservice.cpp 536 0x10f796abc 
        7 QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QByteArray const&>, void, void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&)>::call(void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&), QQmlEngineDebugServiceImpl *, void * *) qobjectdefs_impl.h 134 0x10f7a1265 
        8 void QtPrivate::FunctionPointer<void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&)>::call<QtPrivate::List<QByteArray const&>, void>(void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&), QQmlEngineDebugServiceImpl *, void * *) qobjectdefs_impl.h 167 0x10f7a11b0 
        9 QtPrivate::QSlotObject<void (QQmlEngineDebugServiceImpl:: *)(QByteArray const&), QtPrivate::List<QByteArray const&>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void * *, bool *) qobjectdefs_impl.h 396 0x10f7a10d6 
        10 QtPrivate::QSlotObjectBase::call(QObject *, void * *) qobjectdefs_impl.h 376 0x10225b196 
        11 QMetaCallEvent::placeMetaCall(QObject *) qobject.cpp 504 0x102297958 
        12 QObject::event(QEvent *) qobject.cpp 1251 0x102299668 
        13 QCoreApplicationPrivate::notify_helper(QObject *, QEvent *) qcoreapplication.cpp 1197 0x10224ba26 
        14 doNotify(QObject *, QEvent *) qcoreapplication.cpp 1138 0x10224b50a 
        15 QCoreApplication::notify(QObject *, QEvent *) qcoreapplication.cpp 1124 0x10224b5d7 
        16 QGuiApplication::notify(QObject *, QEvent *) qguiapplication.cpp 1770 0x102890166 
        17 QCoreApplication::notifyInternal2(QObject *, QEvent *) qcoreapplication.cpp 1048 0x10224b425 
        18 QCoreApplication::sendEvent(QObject *, QEvent *) qcoreapplication.h 234 0x10224ce78 
        19 QCoreApplicationPrivate::sendPostedEvents(QObject *, int, QThreadData *) qcoreapplication.cpp 1745 0x10224ccfe 
        20 QCoreApplication::sendPostedEvents(QObject *, int) qcoreapplication.cpp 1599 0x10224bebf 
        21 QCocoaEventDispatcherPrivate::processPostedEvents() qcocoaeventdispatcher.mm 897 0x108a2f87e 
        22 QCocoaEventDispatcherPrivate::postedEventsSourceCallback(void *) qcocoaeventdispatcher.mm 919 0x108a306ff 
        23 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 0x7fff52cf0405 
        24 __CFRunLoopDoSource0 0x7fff52cf03ab 
        25 __CFRunLoopDoSources0 0x7fff52cd3e51 
        26 __CFRunLoopRun 0x7fff52cd33fa 
        27 CFRunLoopRunSpecific 0x7fff52cd2ce4 
        28 RunCurrentEventLoopInMode 0x7fff51f6c895 
        29 ReceiveNextEventCommon 0x7fff51f6c5cb 
        30 _BlockUntilNextEventMatchingListInModeWithFilter 0x7fff51f6c348 
        31 _DPSNextEvent 0x7fff5022995b 
        32 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] 0x7fff502286fa 
        33 -[NSApplication run] 0x7fff5022275d 
        34 QCocoaEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qcocoaeventdispatcher.mm 430 0x108a2e530 
        35 QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qeventloop.cpp 136 0x10224566b 
        36 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) qeventloop.cpp 214 0x10224587b 
        37 QCoreApplication::exec() qcoreapplication.cpp 1336 0x10224bd2c 
        38 QGuiApplication::exec() qguiapplication.cpp 1761 0x102890106 
        39 main main.cpp 327 0x100011707 
        40 start 0x7fff7fd68085
      

      The message being processed is LIST_OBJECTS. In QQmlContextData::isValid():

      inline bool isValid() const 
      
      {     return engine && (!isInternal || !contextObject || !QObjectPrivate::get(contextObject)->wasDeleted); }
      

      QObjectPrivate::get(contextObject) returns null because contextObject->d_ptr == null. Dereferencing this null to access wasDeleted causes the crash.

      This seems to happen when the LIST_OBJECTS command arrives in the target while various QML objects are animating and being added or removed from display.

      No crash occurs if the debugger is not attached.

        1. bug_report.png
          743 kB
          David Hess
        2. Bug.zip
          4 kB
          David Hess
        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            ulherman Ulf Hermann
            dhess David Hess
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved:

                There are no open Gerrit changes