ListItem outside ListView segfaults

Bug #1514928 reported by Jonas G. Drange
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Canonical System Image
Fix Released
High
Zoltan Balogh
ubuntu-ui-toolkit (Ubuntu RTM)
Fix Released
High
Zsombor Egri

Bug Description

Reproduce:
Use the code from the documentation [1] but add selected: true to any ListItem.

What happens:
UUITK segfaults

What should happen:
It should highlight and not crash

Stack trace:
http://pastebin.ubuntu.com/13217004/

Seems selectedList.contains(-1) segfaults for some reason.

[1] http://pastebin.ubuntu.com/13217263/

Related branches

Bill Filler (bfiller)
Changed in canonical-devices-system-image:
milestone: none → ww02-2016
assignee: nobody → Zoltan Balogh (bzoltan)
importance: Undecided → High
Changed in ubuntu-ui-toolkit (Ubuntu):
assignee: nobody → Zoltan Balogh (bzoltan)
importance: Undecided → High
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ubuntu-ui-toolkit (Ubuntu):
status: New → Confirmed
Revision history for this message
Andrea Bernabei (faenil) wrote :

I confirm the bug.

I spent some time debugging it, I found out the following:
the main problem is that ItemParentHasChanged arrives to ListItem *after* setSelected is called. That means UCViewItemsAttachedPrivate::get(listItem) returns a QObject(0x0),
hence UCViewItemsAttachedPrivate::get(listItem)->addToSelected(q) is called on an uninitialized object.
addToSelected then calls selectedList.contains(<whatever>),
but selectedList is an uninitialized object at that point (note: even though it sits on the stack) because it is part of the state of the object UCViewItemsAttachedPrivate, which is uninitialized, and that makes selectedItem.contains(<whatever>) implementation lead to the crash.

Zsombor Egri (zsombi)
Changed in ubuntu-ui-toolkit (Ubuntu):
status: Confirmed → In Progress
assignee: Zoltan Balogh (bzoltan) → Zsombor Egri (zsombi)
Changed in canonical-devices-system-image:
status: New → In Progress
Zoltan Balogh (bzoltan)
affects: ubuntu-ui-toolkit (Ubuntu) → ubuntu-ui-toolkit (Ubuntu RTM)
Zoltan Balogh (bzoltan)
Changed in ubuntu-ui-toolkit (Ubuntu RTM):
status: In Progress → Fix Committed
Changed in canonical-devices-system-image:
status: In Progress → Fix Committed
Revision history for this message
Łukasz Zemczak (sil2100) wrote :
Download full text (7.8 KiB)

This bug was fixed in the package ubuntu-ui-toolkit 1.3.1761+15.04.20151216.1-0ubuntu1 in https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/stable-phone-overlay

---------------

ubuntu-ui-toolkit (1.3.1761+15.04.20151216.1-0ubuntu1) vivid; urgency=medium

  [ Zoltán Balogh ]
  * Drop dependency on qtc plugin script and wait for the shell with a local
    function.

  [ Christian Dywan ]
  * runtest.sh needs to add subdirs to the libpath. Fixes: LP: #1524710.
  * Explicit click/ touch threshold beyond handler.
  * Enter/Return/Space should trigger() Button. Fixes: LP: #1523794.
  * Only set ppmm in SwipeArea if screen has valid dpi. Fixes: LP: #1525174.

  [ Tim Peeters ]
  * Implement header slot management for convergence:
    - Adapt the number of action slots to the width of the view.
    - When a new action appears, show a quick fade-in.
    - Reverse the order of the actions in the header.
    - Update icon width to 4GU. Fixes: LP: #1428757.
  * To prevent an invalid sectionIndex, reset the value of sectionIndex to -1
    when the model of Sections is changed. Fixes: LP: #1513933.

  [ Loïc Molinari ]
  * UbuntuShape - Cleaned up includes.

  [ Albert Astals Cid ]
  * Simplify logic for emitting draggingChanged/pressedChanged
    No need for a switch that considers the possible cases, just store the
    status before and check after
    Fixes an issue in which the SwipeArea pressedChanged signal was not emitted
    if switching directly from WaitingForTouch to Recognized.
  * Fix memory leak in SwipeArea
    SwipeAreaPrivate is not deleted directly so make it part of the qobject
    hierarchy so it's auto deleted on parent destruction.

  [ Zsombor Egri ]
  * Add reset functionality to Action.shortcut property. Fixes: LP: #1518420.
  * Add contentWidth and contentHeight to Dialog so foreground can be resized.
    Fixes: LP: #1249325.
  * Fixing ListItem.selected and ListItem.selectMode bugs.
    Fixes: LP: #1493880, LP: #1493882, LP: #1514928.
  * Add private implementations to ActionItem, AbstractButton, BottomEdgeHint
    and BottomEdge. Fixes: LP: #1524234
  * Close Popups.Dialog when Esc key is pressed. Fixes LP: #1523833
  * Invoke the overridden trigger() function for Action and ActionItem
    derivates. Fixes LP: #1524234
  * Fix BottomEdge assertion when the content is committed by clicking on the
    hint. Fixes LP: #1524407

  [ CI Train Bot ]
  * No-change rebuild.

ubuntu-ui-toolkit (1.3.1742+16.04.20151209-0ubuntu1) xenial; urgency=medium

  [ Zoltán Balogh ]
  * Enable building the UITK tests in any case.
  * Remove Q_Q(UCStyledItemBase) because of unused variable warning.
  * Resolve Trusty specific compiler issue not resolving QPointer data on
    connections.
  * Use only the object name when selecting sections and labels in tests.

  [Zsombor Egri ]
  * Update BottomEdge with UI/UX agreed during the sprint. Fixes LP: #1368811.
  * BottomEdge component. Fixes LP: #1368811.
  * Remove build failure on Xenial caused by deprecated Qt functions.
  * Fix BottomEdgeHint consumes activeFocusOnPress handling. Fixes LP: #1517777
  * Migrate DirectionalDragArea from Unity8, named as SwipeArea. Original code
    (from lp...

Read more...

Changed in ubuntu-ui-toolkit (Ubuntu RTM):
status: Fix Committed → Fix Released
Changed in canonical-devices-system-image:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.