[Qt-interest] Crash in QGraphicsScene::addItem()

[Patrick Hartling]

Attached is a sample program that demonstrates a crash in
QGraphicsScene::addItem() related to dynamic addition and removal of
QGraphicsWidget objects from a QGraphicsScene. At a high level, what we are
doing is adding children to a QGraphicsWidget, removing them, and then
restoring them later. If we remove the parent from the scene before removing
the children, the QGraphicsScenePrivate::tabFocusFirst member can end up
being a dangling pointer. The sample code shows how this can occur.

There are two different demonstrations of the behavior in the sample code.
The non-interactive version (the default) does everything in main() without
opening any windows. The interactive version (enabled by uncommenting the
#define for INTERACTIVE in main.cpp) requires user input to cause the right
sequence of steps that lead to the crash. In the interactive version, these
steps are as follows:

   1. Click 'Add' to add the parents QGraphicsWidgets to the scene.
   2. Click 'Show' to show the children.
      NOTE: This actually simulates showing, hiding, and then showing again.
   3. Click 'Remove' to remove the parents from the scene.
   4. Click 'Add' to add new parents to the scene.
      There should be a crash at this point.

Note that the sample code deliberately prevents the allocator from reusing
the address pointed to by QGraphicsScenePrivate::tabFocusFirst. The
allocator could happen to reuse that address when allocating a new
QGraphicsWidget, and that would hide the problematic behavior.

Is this a bug, or is there a requirement that the child QGraphicsWidget
objects be removed from the scene before their parent?

 -Patrick


-- 
Patrick L. Hartling
Senior Software Engineer, Priority 5
http://www.priority5.com/

The information transmitted in this communication is intended only for
the person or entity to which it is addressed and contains proprietary
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you
received this in error, please destroy any copies, contact the sender
and delete the material from any computer.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: graphics_crash.zip
Type: application/zip
Size: 4077 bytes
Desc: not available
Url : http://lists.qt-project.org/pipermail/qt-interest-old/attachments/20091201/632bcdad/attachment.zip 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.qt-project.org/pipermail/qt-interest-old/attachments/20091201/632bcdad/attachment.bin