Repository navigation
Fix the red master and nightly CI: a ui use-after-free, two glaze brace-init bugs, and eight CI causes - #1037
Merged
Merged
Conversation
… Mounter A failed page is reported through onSelect, which may destroy the Mounted that owns the Mounter. The overlay was put back by a destructor that ran after that report, writing into freed memory (Valgrind: invalid write in underOverlay's Restore). Only the page's mount now runs under the overlay, so the overlay is back before the failure is reported. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
saveGrab's parameter and kGrabSettle are unused when the client has no Qt Quick frontend, which -Werror rejects, breaking every sanitizer leg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
… reaches first With every detail/ header dropped, the consumer now stops at reactive/detail/graph.hpp (through client/shell.hpp), not core/detail/completion_awaiter.hpp, so the mutation was caught for the right reason but reported as the wrong one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
A Windows temp path spliced into the document's JSON carried backslashes that the loader reads as escapes, so the document failed to load on both Windows legs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
MorphStack read Layout through children typed QtObject, which Qt 6.8's qmllint rejects as an attached type on a non-Item; the child is now cast to Item. MorphPanel's divider set height on an item a layout manages, which a layout overrides; it now sets implicitHeight. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
… pixels The table pads a content column by two units of the theme font's average character width; the tests assumed 8 pixels, so they failed wherever the font's average width is below 8 (6.08 on CI's runner). Also the const references clang-tidy asked for. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
…positive Same mechanism as the runtime_error entry: the last reference to a shared exception is dropped on another thread than the one that read what(), ordered only by libstdc++'s uninstrumented refcounts. A race-free standalone control reproduces the report on Linux with libstdc++. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
…meet Each step waits on a real connect and handshake; under Valgrind memcheck that sometimes outran the default two seconds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
…are no longer one-element arrays
glaze's generic JSON prefers its initializer-list constructor under braces,
so Json{std::string{text}} built ["text"] and Json{Json::object_t{}} built
[{}]. A string-typed field component therefore reported its change as an
array, and an MCP tools/call that omitted `arguments` was refused as "the
arguments are not an object". Both now construct with parentheses.
Also: a changeWire refusal for an `exact` prop reads "an exact".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
…, follow moved hints include/morph/ui had dropped to 91.37% of branch arms, under its 92% floor: inline bytes and base64 over the whole alphabet, a field component's change read as its prop's type, rows held as a map's values, sizing validation and a localized screen title had no test. With them it measures 92.16%. include/morph/client was in the report with no floor; it now has one, after testing what a source answers before its first bundle (4 of 4 arms). Six allowlist line hints in rational.hpp and document.hpp had moved with their lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Master CI has been red on most legs since #1004, and two nightly checks have failed three nights running (#1005, #1006). This branch fixes every cause found, including three library defects.
Library defects (
include/morph,src)ui::detail::Mounter. If a tab's page fails to mount, the failure is reported throughonSelect, and that handler may destroy theMounted.underOverlay'sRestorethen wrote into the freedMounter. Valgrind reportedInvalid write of size 8 … Restore::~Restore() (mount.hpp:244), reproduced locally on master. Only the page's mount now runs under the overlay, so the overlay is back in place before the failure is reported.Json{std::string{text}}gave["text"], so a string-typed field component reported its change as an array.Json{Json::object_t{}}gave[{}], so an MCPtools/callwithoutargumentswas refused. Both now use parentheses. Reverting either fix makes its new test fail.src/qt_quick.MorphStackreadLayoutthroughchildren(typedQtObject), which Qt 6.8 rejects.MorphPanel's divider setheighton an item a layout manages.CI, tests and examples
examples/client:saveGrab's parameter andkGrabSettlewere unused without Qt Quick. That-Werrorbroke the asan, tsan and ubsan legs before any test ran, which is also why ASan never saw the use-after-free.test_check_install_export.sh: the dropped-detail-headers mutation is caught, but now onreactive/detail/graph.hpp, notcompletion_awaiter.hpp. Updated the needle. The installed tree itself was fine.test_sign_in(Windows): the temp path was spliced into JSON with backslashes. It now usesgeneric_string().test_qt_quick_table: the tests hardcoded a unit of 8 px, but the table pads byTheme.unitWidth, the font's average character width (6.08 px on CI). Also the const references clang-tidy asked for.cmake/tsan.supp: addedrace:std::logic_error::~logic_error, thelogic_errorform of the existingexception_ptrfalse-positive entries. A race-free standalone control reproduces the report on Linux/libstdc++. A planted race is still reported 10/10. Closes core: TSan reports a race between a Completion's exception being freed on the pool and read in onError on the main thread #985.test_push_net: the connect-and-reconnect test gets a 10 s budget. It timed out at 2 s under Valgrind on two of three nights.include/morph/uifell to 91.37% against its 92% floor. New tests cover inline bytes and base64, field-component change typing, map-held rows, sizing validation and localized explorer titles. It now measures 92.16%.include/morph/clientgets a floor (4/4 arms).rational.hppanddocument.hppare updated.Verification (local, Arch, GCC 16 / clang 23, Qt 6.12)
gcc-debug: full ctest passed, 3991/3991, before the last two commits. Since then the affected[interpreter],[agent]and[explorer]tests pass there, and the coverage run below passes on the final tree.morph_tests [ui]under Valgrind: 0 errors.clang-coveragewith CI's configure: 4131/4131 tests pass, andscripts/coverage.shpasses its gate.scripts/test_check_install_export.sh: all checks pass.examples/client/main.cppcompiles with-Werror, with Qt Quick both on and off.🤖 Generated with Claude Code
https://claude.ai/code/session_01Hw9JacbWXaAPaoKGVy6ZHw