diff options
authorMarc Mutz <>2016-01-06 17:46:11 +0100
committerMarc Mutz <>2016-01-07 13:00:28 +0000
commitf5291bf8b4f74e7dcaa4911594fae8c929e28229 (patch)
parentbccbb70de548c5defcb2ab58a987ef2e966788bc (diff)
Fix UB in tst_QObject::noDeclarativeParentChangedOnDestruction()
If QObjectPrivate::declarativeData is set, it is in various places in Qt expected to point to a QAbstractDeclarativeDataImpl, from which ownedByQml1 is unconditionally read. In noDeclarativeParentChangedOnDestruction(), the declarativeData pointer is, however, set to a local QAbstractDeclarativeData instance, which, being an empty class, has size 1 and alignment 1. Depending on the compiler's idea of bit field order, this code either read uninitialized data from the dummy object, or else some random stack memory outside any (valid) object. What caught UBSan's attention, though, was the difference in alignment between the two classes: src/corelib/kernel/qobject.cpp:917:9: runtime error: member access within misaligned address 0x7fffc9cf706f for type 'struct QAbstractDeclarativeDataImpl', which requires 4 byte alignment Fix by providing a properly initialized object of the correct type. Change-Id: Iae83a949ee5a7bc98df13e35ea614c063085fa13 Reviewed-by: Lars Knoll <> Reviewed-by: Jędrzej Nowacki <> Reviewed-by: Olivier Goffart (Woboq GmbH) <> Reviewed-by: Oswald Buddenhagen <>
1 files changed, 2 insertions, 1 deletions
diff --git a/tests/auto/corelib/kernel/qobject/tst_qobject.cpp b/tests/auto/corelib/kernel/qobject/tst_qobject.cpp
index 4617ce5e74..aa6ab31065 100644
--- a/tests/auto/corelib/kernel/qobject/tst_qobject.cpp
+++ b/tests/auto/corelib/kernel/qobject/tst_qobject.cpp
@@ -6396,7 +6396,8 @@ void tst_QObject::noDeclarativeParentChangedOnDestruction()
QObject *parent = new QObject;
QObject *child = new QObject;
- QAbstractDeclarativeData dummy;
+ QAbstractDeclarativeDataImpl dummy;
+ dummy.ownedByQml1 = false;
QObjectPrivate::get(child)->declarativeData = &dummy;
parentChangeCalled = false;