[Qt-interest] Please confirm critical bug

[Dmitry Baryshev]

Hi. I've found strange behaviour of QApplication subclass and
setProperty(). I've subclasses QApplication and put this subclass into
separate TU (and this is important). Then in main.cpp I created
Application instance and call setProperty() on it. After app.exec()
application crashed. In general, application does nothing but calls
setProperty() on Application's object. And this causes segfault. The
second very weird problem is that if you put Application subclass
directly into main.cpp, it will work fine.

And plus one problem more - If I call QCoreApplication::argc() exactly
after setProperty(), it will return some uninitialized value
(134517064 for example), and it will return "1" as expected if i don't
call setProperty(). If I call QCoreApplication::arguments() exactly
after setProperty(), it will crash immediately.

This crash doesn't depend on existance of Q_OBJECT in QApplication subclass.

This is very strange and seems to be a memory corruption somewhere in
QApplication or QObject::setProperty(). Small source code is attached
and also goes here.

application.h:
----------------
#ifndef G_APPLICATION_H
#define G_APPLICATION_H

#ifdef REPRODUCE

#include <QApplication>

class Application : public QApplication
{
    public:
        Application(int, char **);
};

#endif

#endif

application.cpp:
-------------------
#ifdef REPRODUCE
#include "application.h"

Application::Application(int argc, char **argv) : QApplication(argc, argv)
{}
#endif

main.cpp:
-----------
#include <QApplication>
#include <QVariant>
#include <QDebug>

#include "application.h"

#ifndef REPRODUCE
// this will not crash for some reason
class Application : public QApplication
{
    public:
        Application(int argc, char **argv) : QApplication(argc, argv)
        {}
};
#endif

int main(int argc, char *argv[])
{
    Application app(argc, argv);

    app.setProperty("hello", "hello");

    // will crash
    //QStringList list = app.arguments();

    // segfault
    return app.exec();
}

.pro:
-----

TEMPLATE = app
TARGET =
DEPENDPATH += .
INCLUDEPATH += .

CONFIG += warn_on release

# Input
HEADERS += application.h
SOURCES += main.cpp application.cpp

QMAKE_CXXFLAGS += -DREPRODUCE

-------------------

ltrace output:

$ ltrace -C ./qt4-template
__libc_start_main(0x8048e60, 1, 0xbffb6d24, 0x8048ff0, 0x8048fe0
<unfinished ...>
QApplication::QApplication(int&, char**, int)(0xbffb6c70, 0xbffb6c44,
0xbffb6d24, 263171, 0xb7466268 <unfinished ...>
QObject::childEvent(QChildEvent*)(0xbffb6c70, 0xbffb6a58, 0xbffb6940,
0, 0)                     = 0xb767ffa8
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0xbffb6c70,
0xbffb5dd8, 0, 0x91ff260 <unfinished ...>
QApplication::event(QEvent*)(0xbffb6c70, 0xbffb5dd8, 0xbffb5dd8,
0xbffb6c70, 0xbffb5d28 <unfinished ...>
QObject::childEvent(QChildEvent*)(0xbffb6c70, 0xbffb5dd8, 0xb7fb97c4,
0, 0)                     = 0xb7f644a8
<... QApplication::event(QEvent*) resumed> )
                         = 1
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0xbffb6c70,
0xbffb6978, 0, 0x91ff260 <unfinished ...>
QApplication::event(QEvent*)(0xbffb6c70, 0xbffb6978, 0xbffb6978,
0xb7db7bc3, 0xb7db7bd6 <unfinished ...>
QObject::childEvent(QChildEvent*)(0xbffb6c70, 0xbffb6978, 2, 4081,
0xbffb6ab4)                  = 0xb7f644a8
<... QApplication::event(QEvent*) resumed> )
                         = 1
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0x92298e0,
0xbffb6948, 0xb7680778, 0x91ff260 <unfinished ...>
QObject::childEvent(QChildEvent*)(0x92298e0, 0xbffb6948, 0xbffb6638,
0xb71770cd, 0xbffb6920)    = 0xb7f654a8
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
QObject::connectNotify(char const*)(0x922e640, 0xb7db8320, 0x92298e0,
4, 0)                     = 0x922e640
<... QApplication::QApplication(int&, char**, int) resumed> )
                         = 263171
QVariant::QVariant(char const*)(0xbffb6c64, 0x80490a8, 0xbffb6d24,
0xb71efd30, 0xb7f79734)      = 0x9234ed0
QObject::setProperty(char const*, QVariant const&)(0xbffb6c70,
0x80490a8, 0xbffb6c64, 0xb71efd30, 0xb7f79734 <unfinished ...>
QApplication::metaObject() const(0xbffb6c70, 0xb746ca48, 0xb7f9caf0,
0xb7680778, -1)            = 0xb7f64488
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0xbffb6c70,
0xbffb6c0c, 0xb7483b4b, 0x91ff260 <unfinished ...>
QApplication::event(QEvent*)(0xbffb6c70, 0xbffb6c0c, 0xbffb6c0c, 0, 1)
                         = 0
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 0
<... QObject::setProperty(char const*, QVariant const&) resumed> )
                         = 0
QVariant::~QVariant()(0xbffb6c64, 0x80490a8, 0xbffb6c64, 0xb71efd30,
0xb7f79734)                = 0x9234ed0
QApplication::exec()(0xbffb6c64, 0x80490a8, 0xbffb6c64, 0xb71efd30,
0xb7f79734 <unfinished ...>
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0xbffb6c70,
0x9206400, 0xb6e20090, 0x91ff260 <unfinished ...>
QApplication::event(QEvent*)(0xbffb6c70, 0x9206400, 0x9206400, 0,
0x9bdaf51 <unfinished ...>
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0xbffb6c70,
0xbffb654c, 0x556b9394, 0x91ff260 <unfinished ...>
QApplication::event(QEvent*)(0xbffb6c70, 0xbffb654c, 0xbffb654c,
0xb7fa73bd, 6 <unfinished ...>
QObject::childEvent(QChildEvent*)(0xbffb6c70, 0xbffb654c, 0xb7fb8ff4,
0x10822fdb, 0xb71aa6f0)   = 0x80490c8
<... QApplication::event(QEvent*) resumed> )
                         = 1
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0xbffb6c70,
0xbffb654c, 0x556b9394, 0x91ff260 <unfinished ...>
QApplication::event(QEvent*)(0xbffb6c70, 0xbffb654c, 0xbffb654c,
0xb7fa73bd, 6 <unfinished ...>
QObject::childEvent(QChildEvent*)(0xbffb6c70, 0xbffb654c, 0xb7fb8ff4,
0x10822fdb, 0xb71aa6f0)   = 0x80490c8
<... QApplication::event(QEvent*) resumed> )
                         = 1
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0xbffb6c70,
0xbffb654c, 0x556b9394, 0x91ff260 <unfinished ...>
QApplication::event(QEvent*)(0xbffb6c70, 0xbffb654c, 0xbffb654c,
0xb7fa73bd, 6 <unfinished ...>
QObject::childEvent(QChildEvent*)(0xbffb6c70, 0xbffb654c, 0xb7fb8ff4,
0x10822fdb, 0xb71aa6f0)   = 0x80490c8
<... QApplication::event(QEvent*) resumed> )
                         = 1
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
<... QApplication::event(QEvent*) resumed> )
                         = 1
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0x92298e0,
0x924eaf0, 0xb7435ff4, 0x91ff260 <unfinished ...>
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0x92298e0,
0xbffb65dc, 0xb71770cd, 0x91ff260 <unfinished ...>
QObject::childEvent(QChildEvent*)(0x92298e0, 0xbffb65dc, 0xb6e12b28,
0xb7f79734, 0xbffb654c)    = 0xb7f654a8
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
<... QApplication::notify(QObject*, QEvent*) resumed> )
                         = 1
QApplication::notify(QObject*, QEvent*)(0xbffb6c70, 0x922e640,
0xbffb6a10, 0x92298e0, 0x91ff260 <unfinished ...>
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++

-------------------

The system is Debian Lenny with gcc 4.3.2, Qt 4.4.3, Qt 4.5 is also
affected (tested with LD_LIBRARY_PATH). Can anybody reproduce this in
Linux? Thanks!

--
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qt4-template.tar.gz
Type: application/x-gzip
Size: 5475 bytes
Desc: not available
Url : http://lists.qt-project.org/pipermail/qt-interest-old/attachments/20090415/c10c9a43/attachment.gz