mitchcurtis / slate

Pixel Art Editor
GNU General Public License v3.0
1.05k stars 102 forks source link

heap-use-after-free when running "test-app saveAndLoadLayeredImageProject layerVisibilityAfterMoving" #189

Closed mitchcurtis closed 1 year ago

mitchcurtis commented 1 year ago

This is due to the project binding in the LayerPanel loader not being re-evaluated when the ProjectManager's project is nullified. The Loader's active binding gets triggered first due to it using isLayeredImageProjectType, which checks projectManager.ready. CanvasContainer.qml's args project binding already has a workaround for this, so we should use the same thing here.

10:49:49: Starting /Users/mitch/dev/slate-qt_dev_debug_non_fw-Debug/tests/auto/test-app saveAndLoadLayeredImageProject layerVisibilityAfterMoving...
Failed to load slate_* translation for locale "en_GB" from "/Users/mitch/dev/slate-qt_dev_debug_non_fw-Debug/tests"
Failed to load qt_* translation for locale "en_GB" from "/Users/mitch/dev/qt-dev-debug-non-fw/qtbase/translations"
qml:
___ window.project changed to null

qrc:/qml/main.qml:98:5: QML Settings: The Settings type from Qt.labs.settings is deprecated and will be removed in a future release. Please use the one from QtCore instead.
qml:
___ window.project changed to LayeredImageProject(0x12957bf00, "LayeredImageProject")

CONSTRUCT LayerModel(0x130838440)
qml:
___ Loader sourceComponent.project changed to LayeredImageProject(0x12957bf00, "LayeredImageProject")

!!! LayerModel(0x130838440) setLayeredImageProject called with LayeredImageProject 0x12957bf00 currentLayerIndex=0, layers:
    name="Layer 1" visible=true opacity=1 image=QImage(QSize(256, 256),format=QImage::Format_ARGB32_Premultiplied,depth=32,devicePixelRatio=1,bytesPerLine=1024,sizeInBytes=262144)
LayerModel(0x130838440) rowCount
LayerModel(0x130838440) rowCount
LayerModel(0x130838440) rowCount
LayerModel(0x130838440) rowCount
LayerModel(0x130838440) rowCount
LayerModel(0x130838440) rowCount
********* Start testing of tst_App *********
Config: Using QtTest library 6.6.0, Qt 6.6.0 (arm64-little_endian-lp64 shared (dynamic) debug build; by Apple LLVM 14.0.3 (clang-1403.0.22.14.1)), macos 13.3
PASS   : tst_App::initTestCase()
QDEBUG : tst_App::saveAndLoadLayeredImageProject() qml:
___ window.project changed to null

QDEBUG : tst_App::saveAndLoadLayeredImageProject() qml:
___ window.project changed to LayeredImageProject(0x14b729980, "LayeredImageProject")

QDEBUG : tst_App::saveAndLoadLayeredImageProject() CONSTRUCT LayerModel(0x14d619900)
QDEBUG : tst_App::saveAndLoadLayeredImageProject() qml:
___ Loader sourceComponent.project changed to LayeredImageProject(0x14b729980, "LayeredImageProject")

QDEBUG : tst_App::saveAndLoadLayeredImageProject() !!! LayerModel(0x14d619900) setLayeredImageProject called with LayeredImageProject 0x14b729980 currentLayerIndex=0, layers:
    name="Layer 1" visible=true opacity=1 image=QImage(QSize(256, 256),format=QImage::Format_ARGB32_Premultiplied,depth=32,devicePixelRatio=1,bytesPerLine=1024,sizeInBytes=262144)
QDEBUG : tst_App::saveAndLoadLayeredImageProject() DESTRUCT LayerModel(0x130838440)
QDEBUG : tst_App::saveAndLoadLayeredImageProject() qml:
___ window.project changed to null

QDEBUG : tst_App::saveAndLoadLayeredImageProject() qml:
___ window.project changed to LayeredImageProject(0x14b730280, "LayeredImageProject")

QDEBUG : tst_App::saveAndLoadLayeredImageProject() CONSTRUCT LayerModel(0x1271f3880)
QDEBUG : tst_App::saveAndLoadLayeredImageProject() qml:
___ Loader sourceComponent.project changed to LayeredImageProject(0x14b730280, "LayeredImageProject")

QDEBUG : tst_App::saveAndLoadLayeredImageProject() !!! LayerModel(0x1271f3880) setLayeredImageProject called with LayeredImageProject 0x14b730280 currentLayerIndex=43, layers: [...]
QDEBUG : tst_App::saveAndLoadLayeredImageProject() DESTRUCT LayerModel(0x14d619900)
PASS   : tst_App::saveAndLoadLayeredImageProject()
QDEBUG : tst_App::layerVisibilityAfterMoving() @@@ about to call createNewLayeredImageProject
QDEBUG : tst_App::layerVisibilityAfterMoving() qml:
___ window.project changed to null

QDEBUG : tst_App::layerVisibilityAfterMoving() qml:
___ window.project changed to LayeredImageProject(0x1295f0580, "LayeredImageProject")

QDEBUG : tst_App::layerVisibilityAfterMoving() CONSTRUCT LayerModel(0x1117c2640)
QDEBUG : tst_App::layerVisibilityAfterMoving() qml:
___ Loader sourceComponent.project changed to LayeredImageProject(0x1295f0580, "LayeredImageProject")

QDEBUG : tst_App::layerVisibilityAfterMoving() !!! LayerModel(0x1117c2640) setLayeredImageProject called with LayeredImageProject 0x1295f0580 currentLayerIndex=0, layers:
    name="Layer 1" visible=true opacity=1 image=QImage(QSize(256, 256),format=QImage::Format_ARGB32_Premultiplied,depth=32,devicePixelRatio=1,bytesPerLine=1024,sizeInBytes=262144)
QDEBUG : tst_App::layerVisibilityAfterMoving() LayerModel(0x1271f3880) rowCount
=================================================================
==58177==ERROR: AddressSanitizer: heap-use-after-free on address 0x00014b730380 at pc 0x000101b7fe80 bp 0x00016f893d20 sp 0x00016f893d18
READ of size 8 at 0x00014b730380 thread T0
    #0 0x101b7fe7c in QList<ImageLayer*>::size() const qlist.h:378
    #1 0x101bb281c in LayeredImageProject::layerCount() const layeredimageproject.cpp:123
    #2 0x101be9550 in LayerModel::rowCount(QModelIndex const&) const layermodel.cpp:94
    #3 0x10313dea8 in VDMAbstractItemModelDataType::rowCount(QQmlAdaptorModel const&) const qqmldmabstractitemmodeldata_p.h:216
    #4 0x10313fc70 in non-virtual thunk to VDMAbstractItemModelDataType::rowCount(QQmlAdaptorModel const&) const qqmldmabstractitemmodeldata_p.h
    #5 0x10313b5cc in QQmlAdaptorModel::rowCount() const qqmladaptormodel.cpp:83
    #6 0x10313bb50 in QQmlAdaptorModel::rowAt(int) const qqmladaptormodel.cpp:93
    #7 0x102ff098c in QQmlAdaptorModel::createItem(QQmlRefPointer<QQmlDelegateModelItemMetaType> const&, int) qqmladaptormodel_p.h:114
    #8 0x10317d950 in QQmlDelegateModelPrivate::object(QQmlListCompositor::Group, int, QQmlIncubator::IncubationMode) qqmldelegatemodel.cpp:1220
    #9 0x10317ff40 in QQmlDelegateModel::object(int, QQmlIncubator::IncubationMode) qqmldelegatemodel.cpp:1323
    #10 0x10c5fbd2c in QQuickItemViewPrivate::createItem(int, QQmlIncubator::IncubationMode) qquickitemview.cpp:2369
    #11 0x10c665960 in QQuickListViewPrivate::addVisibleItems(double, double, double, double, bool) qquicklistview.cpp:760
    #12 0x10c5fe380 in QQuickItemViewPrivate::refill(double, double) qquickitemview.cpp:1803
    #13 0x10c5dc89c in QQuickItemViewPrivate::refill() qquickitemview.cpp:1758
    #14 0x10c6093c0 in QQuickItemView::createdItem(int, QObject*) qquickitemview.cpp:2418
    #15 0x10c60d244 in QQuickItemView::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) moc_qquickitemview_p.cpp:1045
    #16 0x119ea4900 in void doActivate<false>(QObject*, int, void**) qobject.cpp:3989
    #17 0x119ea1838 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) qobject.cpp:4037
    #18 0x102fc95a8 in QQmlInstanceModel::createdItem(int, QObject*) moc_qqmlobjectmodel_p.cpp:357
    #19 0x10317cf5c in QQmlDelegateModelPrivate::emitCreatedItem(QQDMIncubationTask*, QObject*) qqmldelegatemodel_p_p.h:269
    #20 0x103179e0c in QQmlDelegateModelPrivate::incubatorStatusChanged(QQDMIncubationTask*, QQmlIncubator::Status) qqmldelegatemodel.cpp:1129
    #21 0x103179814 in QQDMIncubationTask::statusChanged(QQmlIncubator::Status) qqmldelegatemodel.cpp:1006
    #22 0x10f260af8 in QQmlIncubatorPrivate::changeStatus(QQmlIncubator::Status) qqmlincubator.cpp:765
    #23 0x10f2621c4 in QQmlIncubatorPrivate::incubate(QQmlInstantiationInterrupt&) qqmlincubator.cpp:365
    #24 0x10f266210 in QQmlIncubationController::incubateFor(int) qqmlincubator.cpp:421
    #25 0x10b7c5578 in QQuickWindowIncubationController::incubate() qquickwindow.cpp:109
    #26 0x10b7c53f4 in QQuickWindowIncubationController::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) qquickwindow.moc:119
    #27 0x119ea4900 in void doActivate<false>(QObject*, int, void**) qobject.cpp:3989
    #28 0x119ea1838 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) qobject.cpp:4037
    #29 0x10bb386a8 in QSGRenderLoop::timeToIncubate() moc_qsgrenderloop_p.cpp:161
    #30 0x10c4c5b90 in QSGThreadedRenderLoop::polishAndSync(QSGThreadedRenderLoop::Window*, bool) qsgthreadedrenderloop.cpp:1656
    #31 0x10c4c68d0 in QSGThreadedRenderLoop::handleUpdateRequest(QQuickWindow*) qsgthreadedrenderloop.cpp:1374
    #32 0x10b7b599c in QQuickWindow::event(QEvent*) qquickwindow.cpp:1536
    #33 0x105118ffc in QApplicationPrivate::notify_helper(QObject*, QEvent*) qapplication.cpp:3286
    #34 0x105124ed8 in QApplication::notify(QObject*, QEvent*) qapplication.cpp:3237
    #35 0x119c7f3e0 in QCoreApplication::notifyInternal2(QObject*, QEvent*) qcoreapplication.cpp:1115
    #36 0x119c827d0 in QCoreApplication::sendEvent(QObject*, QEvent*) qcoreapplication.cpp:1533
    #37 0x112ee7ed4 in QPlatformWindow::deliverUpdateRequest() qplatformwindow.cpp:783
    #38 0x11cafd118 in QCocoaWindow::deliverUpdateRequest() qcocoawindow.mm:1553
    #39 0x11caca65c in QCocoaScreen::deliverUpdateRequests() qcocoascreen.mm:487
    #40 0x11caca9c0 in invocation function for block in QCocoaScreen::deliverUpdateRequests() qcocoascreen.mm:432
    #41 0x10378a588 in __wrap_dispatch_source_set_event_handler_block_invoke+0xc0 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x42588) (BuildId: f0a7ac5c49bc3abc851181b6f92b308a32000000200000000100000000000b00)
    #42 0x19b6ec3fc in _dispatch_client_callout+0x10 (libdispatch.dylib:arm64e+0x43fc) (BuildId: 8e87dc0ea5703933b37d5e05ad51620632000000200000000100000000030d00)
    #43 0x19b6ef880 in _dispatch_continuation_pop+0x1f4 (libdispatch.dylib:arm64e+0x7880) (BuildId: 8e87dc0ea5703933b37d5e05ad51620632000000200000000100000000030d00)
    #44 0x19b702e78 in _dispatch_source_invoke+0x630 (libdispatch.dylib:arm64e+0x1ae78) (BuildId: 8e87dc0ea5703933b37d5e05ad51620632000000200000000100000000030d00)
    #45 0x19b6fab48 in _dispatch_main_queue_drain+0x2f0 (libdispatch.dylib:arm64e+0x12b48) (BuildId: 8e87dc0ea5703933b37d5e05ad51620632000000200000000100000000030d00)
    #46 0x19b6fa844 in _dispatch_main_queue_callback_4CF+0x28 (libdispatch.dylib:arm64e+0x12844) (BuildId: 8e87dc0ea5703933b37d5e05ad51620632000000200000000100000000030d00)
    #47 0x19b9bbc84 in __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__+0xc (CoreFoundation:arm64e+0xc0c84) (BuildId: b4fdaece97273969b01427f7f24c8e0132000000200000000100000000030d00)
    #48 0x19b9794a4 in __CFRunLoopRun+0x7c4 (CoreFoundation:arm64e+0x7e4a4) (BuildId: b4fdaece97273969b01427f7f24c8e0132000000200000000100000000030d00)
    #49 0x19b978588 in CFRunLoopRunSpecific+0x260 (CoreFoundation:arm64e+0x7d588) (BuildId: b4fdaece97273969b01427f7f24c8e0132000000200000000100000000030d00)
    #50 0x1a51addf0 in RunCurrentEventLoopInMode+0x120 (HIToolbox:arm64e+0x30df0) (BuildId: 5f34bbf5653a31a5b4b30a02c91ab48832000000200000000100000000030d00)
    #51 0x1a51adc2c in ReceiveNextEventCommon+0x284 (HIToolbox:arm64e+0x30c2c) (BuildId: 5f34bbf5653a31a5b4b30a02c91ab48832000000200000000100000000030d00)
    #52 0x1a51ad984 in _BlockUntilNextEventMatchingListInModeWithFilter+0x48 (HIToolbox:arm64e+0x30984) (BuildId: 5f34bbf5653a31a5b4b30a02c91ab48832000000200000000100000000030d00)
    #53 0x19eb97f54 in _DPSNextEvent+0x278 (AppKit:arm64e+0x38f54) (BuildId: cc3e52154cd7364c87506eb7002720ce32000000200000000100000000030d00)
    #54 0x19eb970f0 in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]+0x2c8 (AppKit:arm64e+0x380f0) (BuildId: cc3e52154cd7364c87506eb7002720ce32000000200000000100000000030d00)
    #55 0x11ca95d5c in QCocoaEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qcocoaeventdispatcher.mm:456
    #56 0x119c80ad0 in QCoreApplication::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) qcoreapplication.cpp:1344
    #57 0x1007315d4 in QTest::mouseEvent(QTest::MouseAction, QWindow*, Qt::MouseButton, QFlags<Qt::KeyboardModifier>, QPoint, int) qtestmouse.h:126
    #58 0x1005ea494 in QTest::mouseClick(QWindow*, Qt::MouseButton, QFlags<Qt::KeyboardModifier>, QPoint, int) qtestmouse.h:140
    #59 0x1007ff000 in TestHelper::mouseEventOnCentre(QQuickItem*, TestHelper::TestMouseEventType, Qt::MouseButton) testhelper.cpp:250
    #60 0x10080dcf8 in TestHelper::clickButton(QQuickItem*, Qt::MouseButton) testhelper.cpp:2199
    #61 0x10092ba40 in TestHelper::createNewProject(Project::Type, QMap<QString, QVariant> const&) testhelper.cpp:3000
    #62 0x10094ec5c in TestHelper::createNewLayeredImageProject(int, int, bool) testhelper.cpp:3051
    #63 0x100716afc in tst_App::layerVisibilityAfterMoving() tst_app.cpp:6532
    #64 0x10072f748 in tst_App::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) tst_app.moc:1578
    #65 0x119ce8954 in QMetaMethodInvoker::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) qmetaobject.cpp:2729
    #66 0x119cffdd8 in QMetaMethod::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) qmetaobject.cpp:2568
    #67 0x1023370c4 in std::__1::enable_if<!AreOldStyleArgs<>::value, bool>::type QMetaMethod::invoke<>(QObject*, Qt::ConnectionType, QMetaMethodReturnArgument) const qmetaobject.h:148
    #68 0x1022e8dc0 in std::__1::enable_if<!AreOldStyleArgs<>::value, bool>::type QMetaMethod::invoke<>(QObject*, Qt::ConnectionType) const qmetaobject.h:160
    #69 0x1022e7dcc in QTest::TestMethods::invokeTestOnData(int) const qtestcase.cpp:1134
    #70 0x1022eaec8 in QTest::TestMethods::invokeTest(int, QLatin1String, QTest::WatchDog*) const qtestcase.cpp:1426
    #71 0x1022f0970 in QTest::TestMethods::invokeTests(QObject*) const qtestcase.cpp:1752
    #72 0x1022f34e8 in QTest::qRun() qtestcase.cpp:2365
    #73 0x1022f1d20 in QTest::qExec(QObject*, int, char**) qtestcase.cpp:2251
    #74 0x10072ed7c in main tst_app.cpp:7109
    #75 0x19b543f24  (<unknown module>)

0x00014b730380 is located 256 bytes inside of 504-byte region [0x00014b730280,0x00014b730478)
freed by thread T0 here:
    #0 0x1037997b0 in wrap__ZdlPv+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x517b0) (BuildId: f0a7ac5c49bc3abc851181b6f92b308a32000000200000000100000000000b00)
    #1 0x101bb148c in LayeredImageProject::~LayeredImageProject() layeredimageproject.cpp:70
    #2 0x101c522b8 in std::__1::default_delete<Project>::operator()[abi:v15006](Project*) const unique_ptr.h:48
    #3 0x101c4dc38 in std::__1::unique_ptr<Project, std::__1::default_delete<Project>>::reset[abi:v15006](Project*) unique_ptr.h:305
    #4 0x101c51f8c in std::__1::unique_ptr<Project, std::__1::default_delete<Project>>::~unique_ptr[abi:v15006]() unique_ptr.h:259
    #5 0x101c4c8bc in std::__1::unique_ptr<Project, std::__1::default_delete<Project>>::~unique_ptr[abi:v15006]() unique_ptr.h:259
    #6 0x101c4f164 in ProjectManager::completeCreation() projectmanager.cpp:158
    #7 0x1018b6f9c in ProjectManager::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) moc_projectmanager.cpp:279
    #8 0x1018b8708 in ProjectManager::qt_metacall(QMetaObject::Call, int, void**) moc_projectmanager.cpp:377
    #9 0x119ce9d30 in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) qmetaobject.cpp:334
    #10 0x10f3fc450 in QQmlObjectOrGadget::metacall(QMetaObject::Call, int, void**) const qqmlobjectorgadget.cpp:14
    #11 0x10eb70cd8 in QV4::CallMethod(QQmlObjectOrGadget const&, int, QMetaType, int, QMetaType const*, QV4::ExecutionEngine*, QV4::CallData*, QMetaObject::Call) qv4qobjectwrapper.cpp:1502
    #12 0x10eb5eb3c in QV4::CallPrecise(QQmlObjectOrGadget const&, QQmlPropertyData const&, QV4::ExecutionEngine*, QV4::CallData*, QMetaObject::Call) qv4qobjectwrapper.cpp:1757
    #13 0x10eb6e1d0 in QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_2::operator()() const qv4qobjectwrapper.cpp:2641
    #14 0x10eb5bf48 in auto QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_0::operator()<QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_2>(QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_2 const&) const qv4qobjectwrapper.cpp:2619
    #15 0x10eb58ecc in QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const qv4qobjectwrapper.cpp:2641
    #16 0x10eb57658 in QV4::QObjectMethod::virtualCall(QV4::FunctionObject const*, QV4::Value const*, QV4::Value const*, int) qv4qobjectwrapper.cpp:2539
    #17 0x10e74db54 in QV4::FunctionObject::call(QV4::Value const*, QV4::Value const*, int) const qv4functionobject_p.h:171
    #18 0x10ed89a0c in QV4::Moth::VME::interpret(QV4::JSTypesStackFrame*, QV4::ExecutionEngine*, char const*) qv4vme_moth.cpp:862
    #19 0x10ed7c720 in QV4::Moth::VME::exec(QV4::JSTypesStackFrame*, QV4::ExecutionEngine*) qv4vme_moth.cpp:544
    #20 0x10ea04064 in qfoDoCall(QV4::FunctionObject const*, QV4::Value const*, QV4::Value const*, int) qv4functionobject.cpp:526
    #21 0x10ea00a5c in QV4::ArrowFunction::virtualCall(QV4::FunctionObject const*, QV4::Value const*, QV4::Value const*, int) qv4functionobject.cpp:556
    #22 0x10e74db54 in QV4::FunctionObject::call(QV4::Value const*, QV4::Value const*, int) const qv4functionobject_p.h:171
    #23 0x10ec94e98 in QV4::Runtime::CallQmlContextPropertyLookup::call(QV4::ExecutionEngine*, unsigned int, QV4::Value*, int) qv4runtime.cpp:1416
    #24 0x10ed8b2c8 in QV4::Moth::VME::interpret(QV4::JSTypesStackFrame*, QV4::ExecutionEngine*, char const*) qv4vme_moth.cpp:886
    #25 0x10ed7c720 in QV4::Moth::VME::exec(QV4::JSTypesStackFrame*, QV4::ExecutionEngine*) qv4vme_moth.cpp:544
    #26 0x10e9e1d58 in QV4::doCall(QV4::Function*, QV4::Value const*, QV4::Value const*, int, QV4::ExecutionContext*) qv4function.cpp:54
    #27 0x10e9e03d4 in QV4::Function::call(QV4::Value const*, QV4::Value const*, int, QV4::ExecutionContext*) qv4function.cpp:79
    #28 0x10e9ee2d4 in QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*)::$_0::operator()(QV4::Value const*, QV4::Value const*, int) const qv4function.cpp:30
    #29 0x10e9df620 in bool QV4::convertAndCall<QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*)::$_0>(QV4::ExecutionEngine*, QObject*, void**, QMetaType const*, int, QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*)::$_0) qv4jscall_p.h:197

previously allocated by thread T0 here:
    #0 0x103799370 in wrap__Znwm+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x51370) (BuildId: f0a7ac5c49bc3abc851181b6f92b308a32000000200000000100000000000b00)
    #1 0x101c4d524 in ProjectManager::beginCreation(Project::Type) projectmanager.cpp:103
    #2 0x1018b6f90 in ProjectManager::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) moc_projectmanager.cpp:278
    #3 0x1018b8708 in ProjectManager::qt_metacall(QMetaObject::Call, int, void**) moc_projectmanager.cpp:377
    #4 0x119ce9d30 in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) qmetaobject.cpp:334
    #5 0x10f3fc450 in QQmlObjectOrGadget::metacall(QMetaObject::Call, int, void**) const qqmlobjectorgadget.cpp:14
    #6 0x10eb70a8c in QV4::CallMethod(QQmlObjectOrGadget const&, int, QMetaType, int, QMetaType const*, QV4::ExecutionEngine*, QV4::CallData*, QMetaObject::Call) qv4qobjectwrapper.cpp:1491
    #7 0x10eb5e9c8 in QV4::CallPrecise(QQmlObjectOrGadget const&, QQmlPropertyData const&, QV4::ExecutionEngine*, QV4::CallData*, QMetaObject::Call) qv4qobjectwrapper.cpp:1751
    #8 0x10eb6e1d0 in QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_2::operator()() const qv4qobjectwrapper.cpp:2641
    #9 0x10eb5bf48 in auto QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_0::operator()<QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_2>(QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const::$_2 const&) const qv4qobjectwrapper.cpp:2619
    #10 0x10eb58ecc in QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const qv4qobjectwrapper.cpp:2641
    #11 0x10eb57658 in QV4::QObjectMethod::virtualCall(QV4::FunctionObject const*, QV4::Value const*, QV4::Value const*, int) qv4qobjectwrapper.cpp:2539
    #12 0x10e74db54 in QV4::FunctionObject::call(QV4::Value const*, QV4::Value const*, int) const qv4functionobject_p.h:171
    #13 0x10ed89a0c in QV4::Moth::VME::interpret(QV4::JSTypesStackFrame*, QV4::ExecutionEngine*, char const*) qv4vme_moth.cpp:862
    #14 0x10ed7c720 in QV4::Moth::VME::exec(QV4::JSTypesStackFrame*, QV4::ExecutionEngine*) qv4vme_moth.cpp:544
    #15 0x10ea04064 in qfoDoCall(QV4::FunctionObject const*, QV4::Value const*, QV4::Value const*, int) qv4functionobject.cpp:526
    #16 0x10ea00a5c in QV4::ArrowFunction::virtualCall(QV4::FunctionObject const*, QV4::Value const*, QV4::Value const*, int) qv4functionobject.cpp:556
    #17 0x10ea0e8b4 in QV4::ArrowFunction::virtualCallWithMetaTypes(QV4::FunctionObject const*, QObject*, void**, QMetaType const*, int)::$_1::operator()(QV4::Value const*, QV4::Value const*, int) const qv4functionobject.cpp:496
    #18 0x10ea02394 in bool QV4::convertAndCall<QV4::ArrowFunction::virtualCallWithMetaTypes(QV4::FunctionObject const*, QObject*, void**, QMetaType const*, int)::$_1>(QV4::ExecutionEngine*, QObject*, void**, QMetaType const*, int, QV4::ArrowFunction::virtualCallWithMetaTypes(QV4::FunctionObject const*, QObject*, void**, QMetaType const*, int)::$_1) qv4jscall_p.h:197
    #19 0x10ea01614 in QV4::ArrowFunction::virtualCallWithMetaTypes(QV4::FunctionObject const*, QObject*, void**, QMetaType const*, int) qv4functionobject.cpp:494
    #20 0x10e9f62cc in QV4::FunctionObject::call(QObject*, void**, QMetaType const*, int) qv4functionobject.cpp:127
    #21 0x10f7d7bb0 in QQmlVMEMetaObject::metaCall(QObject*, QMetaObject::Call, int, void**) qqmlvmemetaobject.cpp:1077
    #22 0x119ce9c84 in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) qmetaobject.cpp:332
    #23 0x119ce8a70 in QMetaMethodInvoker::invokeImpl(QMetaMethod, void*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) qmetaobject.cpp:2730
    #24 0x119cf9604 in QMetaObject::invokeMethodImpl(QObject*, char const*, Qt::ConnectionType, long long, void const* const*, char const* const*, QtPrivate::QMetaTypeInterface const* const*) qmetaobject.cpp:1603
    #25 0x1005fe4fc in std::__1::enable_if<!AreOldStyleArgs<QMetaMethodArgument>::value, bool>::type QMetaObject::invokeMethod<QMetaMethodArgument>(QObject*, char const*, Qt::ConnectionType, QMetaMethodReturnArgument, QMetaMethodArgument&&) qobjectdefs.h:367
    #26 0x100959f80 in std::__1::enable_if<!AreOldStyleArgs<QMetaMethodArgument>::value, bool>::type QMetaObject::invokeMethod<QMetaMethodArgument>(QObject*, char const*, Qt::ConnectionType, QMetaMethodArgument&&) qobjectdefs.h:380
    #27 0x10095458c in TestHelper::loadProject(QUrl const&, QRegularExpression const&) testhelper.cpp:3108
    #28 0x1007149e0 in tst_App::saveAndLoadLayeredImageProject() tst_app.cpp:6506
    #29 0x10072f73c in tst_App::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) tst_app.moc:1577

SUMMARY: AddressSanitizer: heap-use-after-free qlist.h:378 in QList<ImageLayer*>::size() const
Shadow bytes around the buggy address:
  0x007029706020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x007029706030: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x007029706040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x007029706050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x007029706060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x007029706070:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x007029706080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x007029706090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0070297060a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0070297060b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0070297060c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==58177==ABORTING
Received signal 6 (SIGABRT)
         layerVisibilityAfterMoving function time: 556ms, total time: 3668ms
10:49:55: /Users/mitch/dev/slate-qt_dev_debug_non_fw-Debug/tests/auto/test-app crashed.