Ubuntu Layouts causes application to crash while switching from one layout to the other

[Nekhelesh Ramananthan]

We are trying to implement tablet and phone interfaces for the ubuntu-clock-app. Both interfaces have been implemented, however switching between them causes the clock app to crash.

Steps to reproduce this bug:
1. Branch clock app code from the MR at https://code.launchpad.net/~mdspencer/ubuntu-clock-app/initial-convergent-layout/+merge/203368
2. Run it and switch from the tablet interface to mobile interface by reducing the application width

The app then freezes and then crashes unexpectedly.

The gdb crash log is attached below.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff74c2fd9 in QQmlEngine::contextForObject(QObject const*) () from /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5
(gdb) bt
#0 0x00007ffff74c2fd9 in QQmlEngine::contextForObject(QObject const*) () from /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5
#1 0x00007fffc61c0891 in PropertyAction::PropertyAction(QObject*, QString const&, PropertyAction::Type) ()
   from /usr/lib/x86_64-linux-gnu/qt5/qml/Ubuntu/Layouts/libUbuntuLayouts.so
#2 0x00007fffc61c0950 in PropertyChange::PropertyChange(QQuickItem*, QString const&, QVariant const&, PropertyChange::Priority) ()
   from /usr/lib/x86_64-linux-gnu/qt5/qml/Ubuntu/Layouts/libUbuntuLayouts.so
#3 0x00007fffc61ba4ca in ULLayoutsPrivate::itemActivate(QQuickItem*, bool) () from /usr/lib/x86_64-linux-gnu/qt5/qml/Ubuntu/Layouts/libUbuntuLayouts.so
#4 0x00007fffc61bceeb in ULLayoutsPrivate::hideExcludedItems() () from /usr/lib/x86_64-linux-gnu/qt5/qml/Ubuntu/Layouts/libUbuntuLayouts.so
#5 0x00007fffc61bcf98 in ULLayoutsPrivate::statusChanged(QQmlIncubator::Status) () from /usr/lib/x86_64-linux-gnu/qt5/qml/Ubuntu/Layouts/libUbuntuLayouts.so
#6 0x00007ffff74e2376 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5
#7 0x00007ffff74e2333 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5
#8 0x00007ffff74e29cd in QQmlIncubationController::incubateFor(int) () from /usr/lib/x86_64-linux-gnu/libQt5Qml.so.5
#9 0x00007ffff628519e in QObject::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#10 0x00007ffff6d7009c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#11 0x00007ffff6d74db2 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#12 0x00007ffff625fcbd in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#13 0x00007ffff6261497 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#14 0x00007ffff62a4e43 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#15 0x00007ffff437a3b6 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#16 0x00007ffff437a708 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007ffff437a7ac in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007ffff62a4b0c in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#19 0x00007ffff625eb6b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#20 0x00007ffff6264301 in QCoreApplication::exec() () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#21 0x0000000000403e0c in ?? ()
#22 0x00007ffff56acde5 in __libc_start_main (main=0x4036e0, argc=2, ubp_av=0x7fffffffdca8, init=<optimized out>, fini=<optimized out>,
    rtld_fini=<optimized out>, stack_end=0x7fffffffdc98) at libc-start.c:260
#23 0x0000000000406133 in ?? ()

[Florian Boucault (fboucault)]

Minimal program independent from the clock app that reproduces the crash.

[Florian Boucault (fboucault)]

This is a better, simpler test program that crashes the same way.

[Zsombor Egri (zsombi)]

The problem is with instances assigned to property values.

Item {
    property var anItem: Item{}
}

Such kind of setup makes the instance of "anItem" to be excluded from layouting, which causes the crash.

[Zsombor Egri (zsombi)]

More explanation:
The Dialer causes crash as DialerStyle uses OpacityMask component, where both ShaderEffectSource instances used in source and sourceMask properties are excluded from layouting. And that causes trouble.

[Zsombor Egri (zsombi)]

The same issue is present in the second test program (sourceItem from ShaderEffectSource): the Item from sourceItem is excluded from layouting, and when Loader's source is reset, the component is not removed from the ones being excluded from layouting. Therefore dereferencing released pointer segfaults.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-ui-toolkit - 0.1.46+14.04.20140220-0ubuntu1

---------------
ubuntu-ui-toolkit (0.1.46+14.04.20140220-0ubuntu1) trusty; urgency=low

  [ Michael Zanetti ]
  * use data instead of children In ListItems.Base to allow having
    QtObjects as childs. In findChild() to be able to find invisible
    things like QtObject and Animations. Changes the return value from
    undefined to null as that's more correct.
  * Fix some issues in DatePicker's docs

  [ CI bot ]
  * Resync trunk

  [ Iain Lane ]
  * Support building with DEB_BUILD_OPTIONS=nocheck to skip the
    testsuite, per Debian policy.

  [ Leo Arias ]
  * Refactor the fake application used by the autopilot emulator tests
    to make a fixture that can be reused by other projects.

  [ Zsombor Egri ]
  * Mouse filters attacheable to mouse handling primitives.
  * Item instances set as property values were excluded from layouting,
    causing segfaults when re-layouting was performed or when the
    component got deleted due to or during re-layouting. (LP: #1280359)
  * ItemSelector regression fix. (LP: #1275861)
 -- Ubuntu daily release <email address hidden> Thu, 20 Feb 2014 10:04:25 +0000