Details
-
Bug
-
Resolution: Done
-
Not Evaluated
-
Qt Creator 2.1.0-rc1
-
None
-
0765a9819d88dd044b67732b67850ddc5d73bb97
Description
From a valgrind run:
=24871== Invalid read of size 1 ==24871== at 0xBE209EC: Core::Internal::SettingsDialog::execDialog() (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libCore.so) ==24871== by 0x1A163E7F: QmlProjectManager::Internal::QmlRunControlFactory::showQmlObserverToolWarning() (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libQmlProjectManager.so) ==24871== by 0x1A164B48: QmlProjectManager::Internal::QmlRunControlFactory::createDebugRunControl(QmlProjectManager::QmlProjectRunConfiguration*) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libQmlProjectManager.so) ==24871== by 0x1A1651EA: QmlProjectManager::Internal::QmlRunControlFactory::create(ProjectExplorer::RunConfiguration*, QString const&) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libQmlProjectManager.so) ==24871== by 0x11CB8ECC: ProjectExplorer::ProjectExplorerPlugin::executeRunConfiguration(ProjectExplorer::RunConfiguration*, QString const&) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x11CB917E: ProjectExplorer::ProjectExplorerPlugin::runProjectImpl(ProjectExplorer::Project*, QString) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x11CB9235: ProjectExplorer::ProjectExplorerPlugin::debugProject() (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x11D6C7CC: ProjectExplorer::ProjectExplorerPlugin::qt_metacall(QMetaObject::Call, int, void**) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x671D27E: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237) ==24871== by 0x67320B4: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3272) ==24871== by 0x548D551: QAction::triggered(bool) (moc_qaction.cpp:263) ==24871== by 0x548CC22: QAction::qt_metacall(QMetaObject::Call, int, void**) (moc_qaction.cpp:167) ==24871== Address 0x263ab0f9 is 121 bytes inside a block of size 136 free'd ==24871== at 0x4C25C8D: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==24871== by 0x5A859D4: QDialog::exec() (qdialog.cpp:561) ==24871== by 0xBE20A08: Core::Internal::SettingsDialog::execDialog() (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libCore.so) ==24871== by 0x1A163E7F: QmlProjectManager::Internal::QmlRunControlFactory::showQmlObserverToolWarning() (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libQmlProjectManager.so) ==24871== by 0x1A164B48: QmlProjectManager::Internal::QmlRunControlFactory::createDebugRunControl(QmlProjectManager::QmlProjectRunConfiguration*) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libQmlProjectManager.so) ==24871== by 0x1A1651EA: QmlProjectManager::Internal::QmlRunControlFactory::create(ProjectExplorer::RunConfiguration*, QString const&) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libQmlProjectManager.so) ==24871== by 0x11CB8ECC: ProjectExplorer::ProjectExplorerPlugin::executeRunConfiguration(ProjectExplorer::RunConfiguration*, QString const&) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x11CB917E: ProjectExplorer::ProjectExplorerPlugin::runProjectImpl(ProjectExplorer::Project*, QString) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x11CB9235: ProjectExplorer::ProjectExplorerPlugin::debugProject() (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x11D6C7CC: ProjectExplorer::ProjectExplorerPlugin::qt_metacall(QMetaObject::Call, int, void**) (in /home/kkoehne/dev/creator/lib/qtcreator/plugins/Nokia/libProjectExplorer.so) ==24871== by 0x671D27E: QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237) ==24871== by 0x67320B4: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3272)
What happens here is that a member variable (m_applied) is accessed after exec() returns. However, exec() calls "delete this" because Qt::WA_DeleteOnClose is given. Therefore m_applied is already freed at this point.