mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-27 02:34:53 +00:00
44da7d4f09
QV4's InternalClass::changeMember returns a stale property index when cleanInternalClass rebuilds the transition hierarchy, which happens after 255 redundant transitions from add/delete/re-add property churn on a JS object. The rebuilt object may hold all surviving members inline with no out-of-line memberData, so a store through the stale index dereferences null. Long-running QML applications crash with SIGSEGV in QV4::Object::insertMember; reported against quickshell based desktop shells (noctalia-dev/noctalia#3992) with a deterministic reproducer. Upstream fix qt/qtdeclarative@624e90bb5e (Pick-to: 6.12 6.11 6.8) is not in any released Qt yet (absent from 6.11.1). Patch applies to 6.11.1 with offsets only.