From 19c0a31319148d4ac716f7cb3295891b5a3b20d9 Mon Sep 17 00:00:00 2001
From: Matthew Vogt <matthew.vogt@nokia.com>
Date: Fri, 6 Jul 2012 09:53:03 +1000
Subject: Do not permit excessive recursion in component creation

Limit recursion during component creation to prevent infinite
recursion resulting in a crash.  Recursion results from invoking
createObject() in the Component.onCompleted handler.

Task-number: QTBUG-25439
Change-Id: Ica2ba099d82b5747c938501af04e67f7ace8402e
Reviewed-by: Michael Brasser <michael.brasser@nokia.com>
---
 .../qml/qqmlcomponent/data/RecursiveComponent.qml  | 10 ++++++++
 tests/auto/qml/qqmlcomponent/data/recursion.qml    | 12 +++++++++
 .../qqmlcomponent/data/recursionContinuation.qml   | 16 ++++++++++++
 tests/auto/qml/qqmlcomponent/tst_qqmlcomponent.cpp | 30 ++++++++++++++++++++++
 4 files changed, 68 insertions(+)
 create mode 100644 tests/auto/qml/qqmlcomponent/data/RecursiveComponent.qml
 create mode 100644 tests/auto/qml/qqmlcomponent/data/recursion.qml
 create mode 100644 tests/auto/qml/qqmlcomponent/data/recursionContinuation.qml

(limited to 'tests/auto/qml/qqmlcomponent')

diff --git a/tests/auto/qml/qqmlcomponent/data/RecursiveComponent.qml b/tests/auto/qml/qqmlcomponent/data/RecursiveComponent.qml
new file mode 100644
index 0000000000..eec17a772d
--- /dev/null
+++ b/tests/auto/qml/qqmlcomponent/data/RecursiveComponent.qml
@@ -0,0 +1,10 @@
+import QtQuick 2.0
+
+Item {
+    id: inner
+    property Item innermost: null
+
+    Component.onCompleted: {
+        innermost = Qt.createComponent("./RecursiveComponent.qml").createObject();
+    }
+}
diff --git a/tests/auto/qml/qqmlcomponent/data/recursion.qml b/tests/auto/qml/qqmlcomponent/data/recursion.qml
new file mode 100644
index 0000000000..d7f9471a43
--- /dev/null
+++ b/tests/auto/qml/qqmlcomponent/data/recursion.qml
@@ -0,0 +1,12 @@
+import QtQuick 2.0
+
+Item {
+    id: root
+
+    property RecursiveComponent myInner: RecursiveComponent {}
+    property bool success: false
+
+    Component.onCompleted: {
+        success = (myInner.innermost != null)
+    }
+}
diff --git a/tests/auto/qml/qqmlcomponent/data/recursionContinuation.qml b/tests/auto/qml/qqmlcomponent/data/recursionContinuation.qml
new file mode 100644
index 0000000000..a10afd3ebe
--- /dev/null
+++ b/tests/auto/qml/qqmlcomponent/data/recursionContinuation.qml
@@ -0,0 +1,16 @@
+import QtQuick 2.0
+
+Item {
+    id: root
+
+    property bool success: false
+
+    Component.onCompleted: {
+        for (var i = 0; i < 10; ++i) {
+            Qt.createComponent("RecursiveComponent.qml").createObject(root)
+        }
+
+        var o = Qt.createComponent("TestComponent.qml").createObject(root)
+        root.success = (o != null)
+    }
+}
diff --git a/tests/auto/qml/qqmlcomponent/tst_qqmlcomponent.cpp b/tests/auto/qml/qqmlcomponent/tst_qqmlcomponent.cpp
index be38829f65..3a3952d101 100644
--- a/tests/auto/qml/qqmlcomponent/tst_qqmlcomponent.cpp
+++ b/tests/auto/qml/qqmlcomponent/tst_qqmlcomponent.cpp
@@ -114,6 +114,8 @@ private slots:
     void componentUrlCanonicalization();
     void onDestructionLookup();
     void onDestructionCount();
+    void recursion();
+    void recursionContinuation();
 
 private:
     QQmlEngine engine;
@@ -410,6 +412,34 @@ void tst_qqmlcomponent::onDestructionCount()
     QCOMPARE(warnings.count(), 0);
 }
 
+void tst_qqmlcomponent::recursion()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("recursion.qml"));
+
+    QTest::ignoreMessage(QtWarningMsg, QLatin1String("QQmlComponent: Component creation is recursing - aborting").data());
+    QScopedPointer<QObject> object(component.create());
+    QVERIFY(object != 0);
+
+    // Sub-object creation does not succeed
+    QCOMPARE(object->property("success").toBool(), false);
+}
+
+void tst_qqmlcomponent::recursionContinuation()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("recursionContinuation.qml"));
+
+    for (int i = 0; i < 10; ++i)
+        QTest::ignoreMessage(QtWarningMsg, QLatin1String("QQmlComponent: Component creation is recursing - aborting").data());
+
+    QScopedPointer<QObject> object(component.create());
+    QVERIFY(object != 0);
+
+    // Eventual sub-object creation succeeds
+    QVERIFY(object->property("success").toBool());
+}
+
 QTEST_MAIN(tst_qqmlcomponent)
 
 #include "tst_qqmlcomponent.moc"
-- 
cgit v1.2.3