[Qt-interest] setItemIndexMethod ( NoIndex ) leads to crash in QGraphicsScene::clear()

[Malyushytsky, Alex]

When scene itemIndexMethod () is set to NoIndex,
at least two QGraphicsItem items are created with the same ZValue,
then last created item ZValue is changed to lower value (in other words order of items to be displayed changed),
call to scene clear ( I did it in scene destructor ) leads to access violation at:

void QGraphicsScene::clear()
{
    Q_D(QGraphicsScene);
    // NB! We have to clear the index before deleting items; otherwise the
    // index might try to access dangling item pointers.
    d->index->clear();
    // NB! QGraphicsScenePrivate::unregisterTopLevelItem() removes items
    while (!d->topLevelItems.isEmpty())
        delete d->topLevelItems.first(); // <<<<<<< here is garbage pointer
    Q_ASSERT(d->topLevelItems.isEmpty());
    d->lastItemCount = 0;
    d->allItemsIgnoreHoverEvents = true;
    d->allItemsUseDefaultCursor = true;
    d->allItemsIgnoreTouchEvents = true;
}

System discovered: Windows XP 64 bit, QT 4.6.3 build for win 32 with MS VC 2005

Problem can be reproduced with modified diagramscene project from Qt/examples (in attachment).
When example run it will add 2 items to the scene ( you can see them if you scroll window).
Then simply close window, clear() will be called in destructor when you close window.

Attempt to delete second item in clear will result in access violation.

        delete d->topLevelItems.first(); // <<<<<<< here is garbage pointer

The key changes:

Added call to initSceneForCrash() function in constructor;

//! [0]
DiagramScene::DiagramScene(QMenu *itemMenu, QObject *parent)
    : QGraphicsScene(parent)
{
    myItemMenu = itemMenu;
    myMode = MoveItem;
    myItemType = DiagramItem::Step;
    line = 0;
    textItem = 0;
    myItemColor = Qt::white;
    myTextColor = Qt::black;
    myLineColor = Qt::black;

        initSceneForCrash(); // ! [test 1]
}

void DiagramScene::initSceneForCrash()
{
        setItemIndexMethod ( NoIndex );

        QGraphicsRectItem * item;

        // Create 2 partially overlapping items

        qreal x0 = 50;
        qreal y0 = 50;
        qreal a  = 200;
        qreal b = 440;
        qreal height = 55.;
        qreal angle =0.;

        item = insertTestRectangle( x0, y0, a ,b, height, angle );
        this->addItem( item );

        x0 = 100;
        y0 = 100;

        item = insertTestRectangle( x0, y0, a ,b, height, angle );
        this->addItem( item );

// set item ZValue so it goes below 1st item
        item->setZValue(  15 );
}

QGraphicsRectItem * DiagramScene::insertTestRectangle( qreal x0, qreal y0, qreal a ,qreal b, qreal height, qreal angle )
{
    QGraphicsRectItem *item = this->addRect( 0, 0, a, b );
        item->setFlags( QGraphicsItem::ItemIsMovable|QGraphicsItem::ItemIsSelectable );

    int z = qrand()%256;
    item->setBrush( QColor(z,z,10, 128) );
    item->setPen( QPen(QColor(qrand()%32*8,qrand()%32*8,qrand()%32*8), 2) );
        item->setZValue( height );

        item->setPos( x0, y0 );
        if( angle != qreal(0.) )
                item->setRotation( angle );

        return item;
}


I would post it as a bug, but it might be I am missing something which has to be done when indexing is disabled.

Could anybody provide comments on this?

Regards,

Alex Malyushytsky
Research Engineer - Weidlinger Associates Inc.
office: 650 230 0210,
direct: 650 230 0349
web: http://www.wai.com


---------------------------------------------------------------------------------------------------
Weidlinger Associates, Inc. made the following annotations.

“This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use, or distribution of the information included in this message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank you.”

“Please consider our environment before printing this email.”
-------------- next part --------------
A non-text attachment was scrubbed...
Name: diagramscene_mod.zip
Type: application/x-zip-compressed
Size: 20823 bytes
Desc: diagramscene_mod.zip
Url : http://lists.qt-project.org/pipermail/qt-interest-old/attachments/20100915/99facefa/attachment.bin