From 3be99799a675a631c67e05897383af9abbc377b3 Mon Sep 17 00:00:00 2001 From: Volker Hilsheimer Date: Tue, 16 Aug 2022 15:32:58 +0200 Subject: Don't access QObjectPrivate::declarativeData unguarded MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The QObjectPrivate::declarativeData member is stored in a union with currentChildBeingDeleted. The QObject destructor always sets the currentChildBeingDeleted member of the union. It also sets the isDeletingChildren bool, which is the only way to find out which union member we can safely access. While the QObject destructor is deleting children and isDeletingChildren is set, we must not access the declarativeData member of the union. Add a test case that initializes the function pointers for the declarative handlers and constructs a situation where an object emits a signal while it is destroying children. Fixes: QTBUG-105286 Pick-to: 6.4 6.3 6.3.2 6.2 5.15 Change-Id: Iea5ba2f7843b6926a8d157be166e6044d98d6c02 Reviewed-by: Qt CI Bot Reviewed-by: Mårten Nordheim --- src/corelib/kernel/qobject.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/corelib/kernel/qobject.cpp') diff --git a/src/corelib/kernel/qobject.cpp b/src/corelib/kernel/qobject.cpp index a7f48b5c598..ac5e839eb2e 100644 --- a/src/corelib/kernel/qobject.cpp +++ b/src/corelib/kernel/qobject.cpp @@ -1001,7 +1001,7 @@ QObject::~QObject() emit destroyed(this); } - if (d->declarativeData && QAbstractDeclarativeData::destroyed) + if (!d->isDeletingChildren && d->declarativeData && QAbstractDeclarativeData::destroyed) QAbstractDeclarativeData::destroyed(d->declarativeData, this); QObjectPrivate::ConnectionData *cd = d->connections.loadRelaxed(); @@ -2625,7 +2625,7 @@ int QObject::receivers(const char *signal) const if (!d->isSignalConnected(signal_index)) return receivers; - if (d->declarativeData && QAbstractDeclarativeData::receivers) { + if (!d->isDeletingChildren && d->declarativeData && QAbstractDeclarativeData::receivers) { receivers += QAbstractDeclarativeData::receivers(d->declarativeData, this, signal_index); } -- cgit v1.2.3