Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-62666

JS `delete` operator leads to segfaults on garbage collecton or leaks memory rapidly

    XMLWordPrintable

Details

    • Bug
    • Resolution: Duplicate
    • P1: Critical
    • 5.9.5, 5.11.0
    • 5.9.1, 5.10.0, 5.10.1
    • None

    Description

      Testcase:

      import QtQuick 2.0
      
      Item {
        property var foo
        Component.onCompleted: {
          foo = {"key1":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key2":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key3":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key4":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key5":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key6":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key7":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}
          var keys = Object.keys(foo)
          for (var i = 0; i < keys.length; i++)
            delete foo[keys[i]]
      
          gc() // Direct call not required, it also fails on subsequent automatic gc
        }
      }
      

      Alternative testcase without manual gc() call:

      import QtQuick 2.0
      
      Item {
        property var foo
        Component.onCompleted: {
          foo = {"key1":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key2":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key3":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key4":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key5":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key6":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                 "key7":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}
          var keys = Object.keys(foo)
          for (var i = 0; i < keys.length; i++)
            delete foo[keys[i]]
      
          // Alternative to manual gc call — just do some stuff, it also crashes
          var x;
          for (var j = 0; j < 1000; j++)
            x = Array(200).join('0')
        }
      }
      

      Crude (release build) trace for the first testcase:

      #0  0x0000000000000000 in ?? ()
      #1  0x00007f51412c0da7 in QV4::MemoryManager::mark() () from /usr/lib/libQt5Qml.so.5
      #2  0x00007f51412c13ec in ?? () from /usr/lib/libQt5Qml.so.5
      #3  0x00007f51414faab0 in QV4::GlobalExtensions::method_gc(QV4::BuiltinFunction const*, QV4::Scope&, QV4::CallData*) () from /usr/lib/libQt5Qml.so.5
      #4  0x00007f514143e3e3 in QV4::Runtime::method_callActivationProperty(QV4::ExecutionEngine*, int, QV4::CallData*) () from /usr/lib/libQt5Qml.so.5
      #5  0x00007f5141eaeab4 in ?? ()
      #6  0x0000000000000000 in ?? ()
      

      Crude (release build) trace for the second testcase:

      #0  0x0000000000000000 in ?? ()
      #1  0x00007ff183925da7 in QV4::MemoryManager::mark() () from /usr/lib/libQt5Qml.so.5
      #2  0x00007ff1839263ec in ?? () from /usr/lib/libQt5Qml.so.5
      #3  0x00007ff183927ff8 in QV4::MemoryManager::allocString(unsigned long) () from /usr/lib/libQt5Qml.so.5
      #4  0x00007ff183a0547a in QV4::ExecutionEngine::newString(QString const&) () from /usr/lib/libQt5Qml.so.5
      #5  0x00007ff183a23684 in ?? () from /usr/lib/libQt5Qml.so.5
      #6  0x00007ff183aa726a in QV4::Runtime::method_callProperty(QV4::ExecutionEngine*, int, QV4::CallData*) () from /usr/lib/libQt5Qml.so.5
      #7  0x00007ff184512ba4 in ?? ()
      #8  0x0000000000000000 in ?? ()
      

      Attachments

        Issue Links

          Activity

            People

              shausman Simon Hausmann
              chalker Сковорода Никита
              Votes:
              4 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: