Crash: Heap corruption due to selectedRows()

[Ankitha Varsha]

Hi,

I have a very simple thing implemented.

//Connect statement something like this...

connect( &contextMenu, SIGNAL( aboutToShow() ), q, SLOT( createContextMenu() ) );


void ClientsGroupsView::createContextMenu()
{
if( selectionModel() == 0 )
return;

const QModelIndexList rows = selectionModel()->selectedRows();

// some other code to show the contents of context menu

}

It is basically a tree view. When the function createContextMenu() returns ( at } ), it is causing crash stating that the crash is due to some heap corruption.

Strangely, If I remove the line which fetches the selectedRows(), the function return does not cause any crash!. I just commented all the lines which make use of "rows" list. It still causes the crash. I do not understand this. I mean, I am not even making use of rows list ( I have to make use of it eventually though), just fetching selectionModel()->selectedRows(); causes the crash at the function return.

Here is the call stack:

ntdll.dll!77f22ea8()
[Frames below may be incorrect and/or missing, no symbols loaded for ntdll.dll]
ntdll.dll!77f90c9a()
ntdll.dll!77f64bdf()
ntdll.dll!77ef894a()
> QtCored4.dll!QBasicAtomicPointer<QInternal_CallBac kTable>:perator!() Line 127
QtCored4.dll!global_callback_table() Line 2633 + 0x117 bytes C++


Any kind of information will be very helpful.

Thank you,
Ankitha Varsha

[jacek]

Do you set selection model somewhere in your code?

[Ankitha Varsha]

Not really, There will be a default selection model right?

[caduel]

yes, after you call setModel(), there will be a default selection model.

[Ankitha Varsha]

Then I am wondering what could be the problem .
Why would the function return lead to crash if I use selectedRows() method on the selection model. I made sure that there are not illegal statements on the usage of the return value of selectedRows(). Some light please

[jacek]

Probably selectedRows() returns invalid pointer. Does it crash if you only invoke selectedRows() (without dereferencing the pointer)? How do you set the model?

[Yeter]

Probably selectedRows() returns invalid pointer. Does it crash if you only invoke selectedRows() (without dereferencing the pointer)? How do you set the model?

Hi,

I have the same problem.

It does not crash when invoking selectedRows() but when the return value of selectedRows() leaves scope.

QItemSelectionModel *model = myQTableView->selectionModel();
 
	if (model)
	{
		QModelIndexList selectedRows = model->selectedRows();
 
		if (selectedRows.count() == 1)
		{
			int selRowIdx = selectedRows[0].row() ;
			...
		}
	} <---- here is the crash

QItemSelectionModel *model = myQTableView->selectionModel();

	if (model)
	{
		QModelIndexList selectedRows = model->selectedRows();

		if (selectedRows.count() == 1)
		{
			int selRowIdx = selectedRows[0].row() ;
			...
		}
	} <---- here is the crash

To copy to clipboard, switch view to plain text mode 

The call stack is as follows:

msvcr90d.dll!_CrtIsValidHeapPointer(const void * pUserData=0x0175d5c0) Line 2103 C++
msvcr90d.dll!_free_dbg_nolock(void * pUserData=0x0175d5c0, int nBlockUse=1) Line 1317 + 0x9 bytes C++
msvcr90d.dll!_free_dbg(void * pUserData=0x0175d5c0, int nBlockUse=1) Line 1258 + 0xd bytes C++
msvcr90d.dll!operator delete(void * pUserData=0x0175d5c0) Line 54 + 0x10 bytes C++
MyApp.exe!QModelIndex::`scalar deleting destructor'() + 0x46 bytes C++
MyApp!QList<QModelIndex>::node_destruct(QList<QMod elIndex>::Node * from=0x0175d7a4, QList<QModelIndex>::Node * to=0x0175d7a4) Line 340 + 0x3e bytes C++
MyApp!QList<QModelIndex>::free(QListData::Data * data=0x0175d790) Line 539 C++
MyApp!QList<QModelIndex>::~QList<QModelIndex>() Line 513 C++

Any help appreciated.

[jacek]

Does it crash if you comment out lines 7--11?

[Yeter]

Does it crash if you comment out lines 7--11?

It also chrashes if I comment out the lines 7-11.

In the call stack you can see that the call of the destructor of QList is the problem.

QModelIndexList selectedRows = model->selectedRows();

QModelIndexList selectedRows = model->selectedRows();

To copy to clipboard, switch view to plain text mode 

creates the list and after leaving scope the destructor of this list tries to delete its items.

I think the problem is either that the item already has been delete or belongs to an other object.

I just copied the code from the Qt-Reference and I really don't know why it crashes resp. what I could do to make it work.

[wysota]

Is your application multithreaded?

[Yeter]

Is your application multithreaded?

No it is not

Here is an example:
test.h

#ifndef TEST_H_
#define TEST_H_
 
#include "types.h"
 
#include "Ui_test.h"
 
 
class tableView : public QDialog, protected Ui_Dialog
{
	Q_OBJECT
public:
	tableView(QWidget* parent = 0, Qt::WindowFlags flags = 0);
 
private slots:
	void btn_testClick();
};
 
#endif // end of #ifndef TEST_H_

#ifndef TEST_H_
#define TEST_H_

#include "types.h"

#include "Ui_test.h"


class tableView : public QDialog, protected Ui_Dialog
{
	Q_OBJECT
public:
	tableView(QWidget* parent = 0, Qt::WindowFlags flags = 0);

private slots:
	void btn_testClick();
};

#endif // end of #ifndef TEST_H_

To copy to clipboard, switch view to plain text mode 

test.cpp

#include <QtGui/QMessageBox>
#include <QtGui/QStandardItemModel>
#include <QtGui/QItemSelectionModel>
 
#include "test.h"
 
 
tableView::tableView(QWidget* parent /* = 0 */, Qt::WindowFlags flags /* = 0 */)
	: QDialog(parent, flags)
{
	// create gui elements defined in the Ui_tableView class
	setupUi(this);
 
	connect(btn_test, SIGNAL(clicked()), this, SLOT(btn_testClick()) );
 
	setWindowFlags(windowFlags() & ~Qt::WindowMaximizeButtonHint);	
 
	if (!tv_test->model())
	{
        QStandardItemModel *newModel = new QStandardItemModel(0, 1);
		tv_test->setModel(newModel);
	}
 
	QStandardItemModel *model = dynamic_cast<QStandardItemModel*>( tv_test->model() );
 
	for (int idx = 1; idx < 11; idx++)
	{
		QStandardItem* item1 = new QStandardItem( QString("bla_%1").arg(idx) );
		model->appendRow( item1 );
	}
 
	tv_test->setSelectionModel( new QItemSelectionModel( model ) );
}
 
void tableView::btn_testClick()
{
	QItemSelectionModel *model = tv_test->selectionModel();
 
	if (model)
	{
		QModelIndexList selectedRows = model->selectedRows();
	}
}

#include <QtGui/QMessageBox>
#include <QtGui/QStandardItemModel>
#include <QtGui/QItemSelectionModel>

#include "test.h"


tableView::tableView(QWidget* parent /* = 0 */, Qt::WindowFlags flags /* = 0 */)
	: QDialog(parent, flags)
{
	// create gui elements defined in the Ui_tableView class
	setupUi(this);

	connect(btn_test, SIGNAL(clicked()), this, SLOT(btn_testClick()) );

	setWindowFlags(windowFlags() & ~Qt::WindowMaximizeButtonHint);	

	if (!tv_test->model())
	{
        QStandardItemModel *newModel = new QStandardItemModel(0, 1);
		tv_test->setModel(newModel);
	}

	QStandardItemModel *model = dynamic_cast<QStandardItemModel*>( tv_test->model() );

	for (int idx = 1; idx < 11; idx++)
	{
		QStandardItem* item1 = new QStandardItem( QString("bla_%1").arg(idx) );
		model->appendRow( item1 );
	}

	tv_test->setSelectionModel( new QItemSelectionModel( model ) );
}

void tableView::btn_testClick()
{
	QItemSelectionModel *model = tv_test->selectionModel();

	if (model)
	{
		QModelIndexList selectedRows = model->selectedRows();
	}
}

To copy to clipboard, switch view to plain text mode 

Remark: The code just crashes if I select a row and push the Test button.