From 70199a43a978649d87c5b2815808c4a04902c6e0 Mon Sep 17 00:00:00 2001 From: Thomas Hartmann Date: Fri, 16 Nov 2018 18:52:56 +0100 Subject: Fix for SpinBox crash in Qt Quick Designer The crash was not 100% reliable and depends on the order in the hash(). Something in beginDeferred() has a side effect on deferData->bindings and an element gets deleted. This causes a crash while iterating (++it). Therefore we do a copy of the hash. I added a regression test. The test did only crash for SpinBox and it did only crash roughly half the time. Task-number: QTBUG-71942 Change-Id: I339e0a4382f97db44f6ff2e9f07f2be7278d1e24 Reviewed-by: Mitch Curtis --- src/quicktemplates2/qquickdeferredexecute.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src/quicktemplates2') diff --git a/src/quicktemplates2/qquickdeferredexecute.cpp b/src/quicktemplates2/qquickdeferredexecute.cpp index b298a81d..800dcedb 100644 --- a/src/quicktemplates2/qquickdeferredexecute.cpp +++ b/src/quicktemplates2/qquickdeferredexecute.cpp @@ -76,8 +76,9 @@ static bool beginDeferred(QQmlEnginePrivate *enginePriv, const QQmlProperty &pro for (auto dit = ddata->deferredData.rbegin(); dit != ddata->deferredData.rend(); ++dit) { QQmlData::DeferredData *deferData = *dit; - auto range = deferData->bindings.equal_range(propertyIndex); - if (range.first == deferData->bindings.end()) + auto bindings = deferData->bindings; + auto range = bindings.equal_range(propertyIndex); + if (range.first == bindings.end()) continue; QQmlComponentPrivate::ConstructionState *state = new QQmlComponentPrivate::ConstructionState; -- cgit v1.2.3