Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-88966

[REG 5.15 -> 6.0.0] Crash when expanding items in QTreeView

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P1: Critical
    • Resolution: Done
    • Affects Version/s: 6.0.0 Beta2
    • Fix Version/s: 6.0.0
    • Component/s: Widgets: Itemviews
    • Labels:
      None
    • Commits:
      83e95956ed58e88b11e2cc3cb61c5beacb7985db (qt/qtbase/6.0.0) 2f747bb57cd958f9fc65f406474c429ca00941ac (qt/qtbase/6.0) 6012285e7dedb4364e2db087b7d5cbfc2973320a (qt/qtbase/dev)

      Description

      Add below test to tst_qtreeview.cpp:

      static void populateModel(QStandardItemModel *model)
      {
          const int depth = 10;
          for (int i1 = 0; i1 < depth; ++i1) {
              QStandardItem *s1 = new QStandardItem;
              s1->setText(QString::number(i1));
              model->appendRow(s1);
              for (int i2 = 0; i2 < depth; ++i2) {
                  QStandardItem *s2 = new QStandardItem;
                  s2->setText(QStringLiteral("%1 - %2").arg(i1).arg(i2));
                  s1->appendRow(s2);
                  for (int i3 = 0; i3 < depth; ++i3) {
                      QStandardItem *s3 = new QStandardItem;
                      s3->setText(QStringLiteral("%1 - %2 - %3").arg(i1).arg(i2).arg(i3));
                      s2->appendRow(s3);
                  }
              }
          }
      }
      
      void tst_QTreeView::expandAfterTake()
      {
          QStandardItemModel model;
          populateModel(&model);
          QTreeView view;
          view.setUniformRowHeights(true);
          view.setModel(&model);
          view.show();
          QVERIFY(QTest::qWaitForWindowExposed(&view));
      
          view.expandAll();
          while (model.takeItem(0))
              ; // mimic clear, but this leaves QTreeViewPrivate::expandedIndexes dirty with corrupted items
      
          populateModel(&model); // populate model again, having corrupted items inside QTreeViewPrivate::expandedIndexes
          view.expandAll(); // adding new items to QTreeViewPrivate::expandedIndexes with corrupted persistent indices, causing crash sometimes
      }
      

      Sometimes it happens, that this test passes, however, in more than 50% cases it crashes with assert:

      QFATAL : tst_QTreeView::expandAfterTake() ASSERT: "it.isUnused()" in file ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qhash.h, line 519
      FAIL!  : tst_QTreeView::expandAfterTake() Received a fatal error.
         Loc: [Unknown file(0)]
      Totals: 96 passed, 1 failed, 0 skipped, 0 blacklisted, 7099ms
      

      Call stack:

      #0  0x00007ffff580e9d5 in raise () from /lib64/libc.so.6
      #1  0x00007ffff57f78a4 in abort () from /lib64/libc.so.6
      #2  0x00007ffff5e98f99 in qt_message_fatal (context=..., message=...)
          at /home/jarek/dev/qt-dev/qtbase/src/corelib/global/qlogging.cpp:1893
      #3  0x00007ffff5e9524e in QMessageLogger::fatal (this=0x7fffffffbf50, msg=0x7ffff631bea8 "ASSERT: \"%s\" in file %s, line %d")
          at /home/jarek/dev/qt-dev/qtbase/src/corelib/global/qlogging.cpp:889
      #4  0x00007ffff5e87864 in qt_assert (assertion=0x7ffff7d2c00a "it.isUnused()", 
          file=0x7ffff7d2bb38 "../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qhash.h", line=519)
          at /home/jarek/dev/qt-dev/qtbase/src/corelib/global/qglobal.cpp:3108
      #5  0x00007ffff7ac5137 in QHashPrivate::Data<QHashPrivate::Node<QPersistentModelIndex, QHashDummyValue> >::rehash (this=0x659290, 
          sizeHint=2049) at ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qhash.h:519
      #6  0x00007ffff7ac38e2 in QHashPrivate::Data<QHashPrivate::Node<QPersistentModelIndex, QHashDummyValue> >::findOrInsert (
          this=0x659290, key=...) at ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qhash.h:589
      #7  0x00007ffff7ac1f83 in QHash<QPersistentModelIndex, QHashDummyValue>::emplace<QHashDummyValue const&> (this=0x9119d0, key=...)
          at ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qhash.h:1121
      #8  0x00007ffff7ac01a0 in QHash<QPersistentModelIndex, QHashDummyValue>::emplace<QHashDummyValue const&> (this=0x9119d0, key=...)
          at ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qhash.h:1113
      #9  0x00007ffff7abe3b7 in QHash<QPersistentModelIndex, QHashDummyValue>::insert (this=0x9119d0, key=..., value=...)
          at ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qhash.h:1091
      #10 0x00007ffff7abc9c8 in QSet<QPersistentModelIndex>::insert (this=0x9119d0, value=...)
          at ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/tools/qset.h:181
      #11 0x00007ffff7b1e5b9 in QTreeViewPrivate::storeExpanded (this=0x9114d0, idx=...)
          at ../../include/QtWidgets/6.0.0/QtWidgets/private/../../../../../../../qt-dev/qtbase/src/widgets/itemviews/qtreeview_p.h:215
      #12 0x00007ffff7b1a5e7 in QTreeViewPrivate::layout (this=0x9114d0, i=1933, recursiveExpanding=true, afterIsUninitialized=true)
          at /home/jarek/dev/qt-dev/qtbase/src/widgets/itemviews/qtreeview.cpp:3404
      #13 0x00007ffff7b1a663 in QTreeViewPrivate::layout (this=0x9114d0, i=1888, recursiveExpanding=true, afterIsUninitialized=true)
          at /home/jarek/dev/qt-dev/qtbase/src/widgets/itemviews/qtreeview.cpp:3407
      #14 0x00007ffff7b1a663 in QTreeViewPrivate::layout (this=0x9114d0, i=-1, recursiveExpanding=true, afterIsUninitialized=true)
          at /home/jarek/dev/qt-dev/qtbase/src/widgets/itemviews/qtreeview.cpp:3407
      #15 0x00007ffff7b170cd in QTreeView::expandAll (this=0x7fffffffc5f0)
          at /home/jarek/dev/qt-dev/qtbase/src/widgets/itemviews/qtreeview.cpp:2699
      #16 0x0000000000435dd3 in tst_QTreeView::expandAfterTake (this=0x7fffffffd620)
          at /home/jarek/dev/qt-dev/qtbase/tests/auto/widgets/itemviews/qtreeview/tst_qtreeview.cpp:1829
      #17 0x0000000000465ae3 in tst_QTreeView::qt_static_metacall (_o=0x7fffffffd620, _c=QMetaObject::InvokeMetaMethod, _id=38, 
          _a=0x7fffffffc710) at .moc/tst_qtreeview.moc:640
      #18 0x00007ffff61efd48 in QMetaMethod::invoke (this=0x5ddd50, object=0x7fffffffd620, connectionType=Qt::DirectConnection, 
          returnValue=..., val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...)
          at /home/jarek/dev/qt-dev/qtbase/src/corelib/kernel/qmetaobject.cpp:2322
      #19 0x00007ffff663f588 in QMetaMethod::invoke (this=0x5ddd50, object=0x7fffffffd620, connectionType=Qt::DirectConnection, val0=..., 
          val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...)
          at ../../include/QtCore/../../../../qt-dev/qtbase/src/corelib/kernel/qmetaobject.h:125
      #20 0x00007ffff66373d7 in QTest::TestMethods::invokeTestOnData (this=0x7fffffffd420, index=31)
          at /home/jarek/dev/qt-dev/qtbase/src/testlib/qtestcase.cpp:934
      #21 0x00007ffff6637f1b in QTest::TestMethods::invokeTest (this=0x7fffffffd420, index=31, data=0x0, watchDog=0x0)
          at /home/jarek/dev/qt-dev/qtbase/src/testlib/qtestcase.cpp:1163
      --Type <RET> for more, q to quit, c to continue without paging-- 
      #22 0x00007ffff663928f in QTest::TestMethods::invokeTests (this=0x7fffffffd420, testObject=0x7fffffffd620)
          at /home/jarek/dev/qt-dev/qtbase/src/testlib/qtestcase.cpp:1506
      #23 0x00007ffff6639aa3 in QTest::qRun () at /home/jarek/dev/qt-dev/qtbase/src/testlib/qtestcase.cpp:1933
      #24 0x00007ffff6639581 in QTest::qExec (testObject=0x7fffffffd620, argc=1, argv=0x7fffffffd748)
          at /home/jarek/dev/qt-dev/qtbase/src/testlib/qtestcase.cpp:1841
      #25 0x000000000046563e in main (argc=1, argv=0x7fffffffd748)
          at /home/jarek/dev/qt-dev/qtbase/tests/auto/widgets/itemviews/qtreeview/tst_qtreeview.cpp:5261
      

      For Qt 5.15 I cannot crash on the above test.

      Please see https://codereview.qt-project.org/c/qt/qtbase/+/324206

      This issue is a result of investigation on: QTCREATORBUG-24981

        Attachments

          Issue Links

          For Gerrit Dashboard: QTBUG-88966
          # Subject Branch Project Status CR V

            Activity

              People

              Assignee:
              laknoll Lars Knoll
              Reporter:
              jkobus Jarek Kobus
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: