Qt3D 5.12.0 crash at show/exit when using QText2DEntity msvc2017

[Harold]

Hi all,

I have reproduced a crash with a minimal example happening sometimes when the window is shown, sometimes at application exit.
The crash appears only if i add a QText2DEntity and only in debug mode, here is the code to reproduce it :

#include <QGuiApplication>
#include <Qt3DWindow>
#include <Qt3DCore/QEntity>
#include <Qt3DExtras/QText2DEntity>

int main(int argc, char* argv[])
{
	QGuiApplication app(argc, argv);
	Qt3DExtras::Qt3DWindow view;

	QEntity * rootEntity = new QEntity;
	Qt3DExtras::QText2DEntity * text2D = new Qt3DExtras::QText2DEntity(rootEntity);
	text2D->setFont(QFont("arial"));
	text2D->setHeight(25);
	text2D->setWidth(100);
	text2D->setText("A");
	text2D->setColor(Qt::red);

	view.setRootEntity(rootEntity);
	view.show();

	return app.exec();
}

Here is the call stack when it crashs at application exit ( closing the window ) :

Qt5Cored.dll!QMetaObject::cast(const QObject * obj) Line 368
Qt5Cored.dll!QMetaObject::cast(QObject * obj) Line 358
Qt53DCored.dll!qobject_cast<Qt3DCore::QNode *>(QObject * object) Line 505
Qt53DCored.dll!Qt3DCore::QNodeVisitor::traverseChildren<Qt3DCore::QNodeVisitor::MemberFunctionFunctor<Qt3DCore::QNodePrivate,void,Qt3DCore::QNode *> >(Qt3DCore::QNodeVisitor::MemberFunctionFunctor<Qt3DCore::QNodePrivate,void,Qt3DCore::QNode *> & fN) Line 159
Qt53DCored.dll!Qt3DCore::QNodeVisitor::visitNode<Qt3DCore::QNodeVisitor::MemberFunctionFunctor<Qt3DCore::QNodePrivate,void,Qt3DCore::QNode *> >(Qt3DCore::QNode * nd, Qt3DCore::QNodeVisitor::MemberFunctionFunctor<Qt3DCore::QNodePrivate,void,Qt3DCore::QNode *> & fN) Line 129
Qt53DCored.dll!Qt3DCore::QNodeVisitor::startTraversing<Qt3DCore::QNodeVisitor::MemberFunctionFunctor<Qt3DCore::QNodePrivate,void,Qt3DCore::QNode *> >(Qt3DCore::QNode * rootNode_, Qt3DCore::QNodeVisitor::MemberFunctionFunctor<Qt3DCore::QNodePrivate,void,Qt3DCore::QNode *> fN) Line 110
Qt53DCored.dll!Qt3DCore::QNodeVisitor::traverse<Qt3DCore::QNodePrivate,void (__thiscall Qt3DCore::QNodePrivate::*)(Qt3DCore::QNode *)>(Qt3DCore::QNode * rootNode_, Qt3DCore::QNodePrivate * instance, void(Qt3DCore::QNodePrivate::*)(Qt3DCore::QNode *) fN) Line 79
Qt53DCored.dll!Qt3DCore::QNodePrivate::notifyDestructionChangesAndRemoveFromScene() Line 161
Qt53DCored.dll!Qt3DCore::QNode::~QNode() Line 754
Qt53DCored.dll!Qt3DCore::QEntity::~QEntity() Line 113
[External Code]	
Qt53DExtrasd.dll!QtSharedPointer::CustomDeleter<Qt3DCore::QEntity,QtSharedPointer::NormalDeleter>::execute() Line 195
Qt53DExtrasd.dll!QtSharedPointer::ExternalRefCountWithCustomDeleter<Qt3DCore::QEntity,QtSharedPointer::NormalDeleter>::deleter(QtSharedPointer::ExternalRefCountData * self) Line 217
Qt53DCored.dll!QtSharedPointer::ExternalRefCountData::destroy() Line 157
Qt53DCored.dll!QSharedPointer<Qt3DCore::QEntity>::deref(QtSharedPointer::ExternalRefCountData * dd) Line 467
Qt53DCored.dll!QSharedPointer<Qt3DCore::QEntity>::deref() Line 460
Qt53DCored.dll!QSharedPointer<Qt3DCore::QEntity>::~QSharedPointer<Qt3DCore::QEntity>() Line 315
Qt53DCored.dll!QSharedPointer<Qt3DCore::QEntity>::operator=(const QSharedPointer<Qt3DCore::QEntity> & other) Line 336
Qt53DCored.dll!Qt3DCore::QAspectEngine::setRootEntity(QSharedPointer<Qt3DCore::QEntity> root) Line 428
Qt53DCored.dll!Qt3DCore::QAspectEngine::~QAspectEngine() Line 205
[External Code]	
Qt53DExtrasd.dll!Qt3DExtras::Qt3DWindow::~Qt3DWindow() Line 134
GeckoPrez.exe!main(int argc, char * * argv) Line 41

It seems that during the graph destruction, a cast is done on an already destructed object :

const QObject *QMetaObject::cast(const QObject *obj) const
{
    return (obj && obj->metaObject()->inherits(this)) ? obj : nullptr;
}

Exception thrown: read access violation.
obj-> was 0xDDDDDDDD.

Any insight ?

Regards,
Harold

[SGaist]

Hi,

No an insight but you should test again against 5.12.1 since it just got released.

[kshegunov]

Smells like a bug to me.

Does anything change if you do this:

QSharedPointer<QEntity> rootEntity(new QEntity);

[Harold]

Hi SGaist and kshegunov,

Thank you for your answers.
5.12.1 does not help, but wrapping the root entity into a QScopedPointer seems to fix the crash.

It is weird that Qt3DWindow::setRootEntity takes a raw QEntity pointer as input where QAspectEngine::setRootEntity receives a QEntityPtr ( which is a QSharedPointer<QEntity> ).
Intuitively we assume that Qt3DWindow::setRootEntity will take the ownership of the pointer.

Well, black magic to me :p

Thank you for you help.

Regards,
Harold

[DavidFaure]

In case anyone lands here, I just fixed a crash in QNodeVisitor::traverseChildren: https://codereview.qt-project.org/c/qt/qt3d/+/656476

[SGaist]

@DavidFaure that was a sneaky one !