subagent transcript

PROVEN (empirical, ground truth): On FreeCAD-for-WebAssembly (Qt 6.11 static, JSPI + native wasm-EH, single-thread QT_FEATURE_thread=-1, shiboken/PySide bindings), activating the CAM **or** BIM GUI workbench throws a wasm 'RuntimeError: memory access out of bounds'. It is NOT OOM (peak wasm memory 23-29MB, MAXIMUM_MEMORY=4GB, no emscripten abort() — onAbort never fires) and NOT a missing Python module (all imports succeed first). CAM and BIM produce the IDENTICAL, deterministic stack (top frames, truncated below by the JSPI promise boundary): RuntimeError: memory access out of bounds at QMetaObject::cast(QObject const*) const <-- OOB read occurs HERE at QWidget::isActiveWindow() const at QStyleOption::initFrom(QWidget const*) at QGroupBox::initStyleOption(QStyleOptionGroupBox*) const at QGroupBox::event(QEvent*) at QApplicationPrivate::notify_helper(QObject*, QEvent*) at QApplication::notify -> Gui::GUIApplication::notify at QCoreApplication::sendEvent(QObject*, QEvent*) at QWidgetPrivate::hideChildren(bool) Working workbenches (Part, Draft, Sketcher) do NOT crash on activation. Qt source tree: /opt/toolchains/qtsrc/qtbase (read qtbase/src/corelib/kernel/qmetaobject.cpp, qtbase/src/widgets/kernel/qwidget.cpp, qtbase/src/widgets/styles/qstyleoption.cpp, qtbase/src/widgets/widgets/qgroupbox.cpp). FreeCAD source: /home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/Gui (Application.cpp activateWorkbench/onToolBarSwitch, Workbench.cpp, MainWindow.cpp, DockWindowManager.cpp, PreferencePages/dialog). Read-only — do NOT build. Four parallel analyses (JSON): [{"area":"Qt use-after-free: QMetaObject::cast dereferencing a dangling QObject's corrupted vtable pointer during QGroupBox hide on CAM/BIM workbench activation","findings":"EXACT OOB: The out-of-bounds read is the virtual-dispatch load inside `obj->metaObject()` in QMetaObject::cast (qtbase/src/corelib/kernel/qmetaobject.cpp:413 -- `return (obj && obj->metaObject()->inherits(this)) ? obj : nullptr;`). cast() first null-checks obj, so obj is NON-null. It then does the virtual call obj->metaObject(): (a) load the vtable base pointer from *(obj+0), then (b) load the metaObject() slot at (vptr + slotOffset), then (c) call_indirect. The OOB memory-access trap is step (b): the load of the vtable slot through a garbage vtable base.\n\nWhy it is a memory-access-out-of-bounds and not something else: obj is a DANGLING/freed QObject whose backing heap chunk has been returned to the allocator and its first word (the vptr slot) overwritten with allocator/freelist data (emscripten dlmalloc/emmalloc store freelist next-pointers exactly at offset 0 of a freed chunk). So *(obj+0) yields a large garbage integer G, and load(G + slotOffset) addresses beyond linear memory -> wasm \"memory access out of bounds\". This is the classic use-after-free signature. Peak memory 23-29MB rules out OOM; the fault is a wild address, not exhaustion.\n\nIt is DEFINITIVELY NOT: (1) the superdata/inherits walk (qmetaobject.cpp:387-395) -- that walks static QMetaObject data (&Class::staticMetaObject and ->d.superdata) which is compile-time-constant and always in bounds; a merely-freed-but-intact object would return a valid &staticMetaObject and inherits() would not fault. (2) a null/dangling QWindow handle -- the windowHandle()->handle() path (qwidget.cpp:7010-7012) is explicitly null-guarded, and cast() null-guards obj. The only way to reach an OOB in cast() is a NON-null but INVALID (freed, allocator-reused) obj whose vptr word is corrupted.\n\nWhich obj: the sole QMetaObject::cast reachable in QWidget::isActiveWindow() is the qobject_cast in the QGuiApplication::focusWindow() container loop -- qwidget.cpp:6997 `qobject_cast<QWidgetWindow *>(ww)` and 6998 `qobject_cast<QWindowContainer *>(qww->widget())`. ww originates from QGuiApplicationPrivate::focus_window, a raw QWindow* (qguiapplication.cpp:194) that is not cleared on widget teardown; qww->widget() reads QWidgetWindow::m_widget (qwidgetwindow_p.h:43). So the dangling obj is a stale QWindow/QWidget reached from focus_window (or its m_widget), left dangling when the object that had focus was destroyed during the workbench switch.\n\nTRIGGER CHAIN (all confirmed in source): QGroupBox::event() (qgroupbox.cpp:288) unconditionally calls initStyleOption(&box) at line 306 for EVERY event -> QStyleOption::initFrom() (qstyleoption.cpp:141) computes window=widget->window() (143) and calls window->isActiveWindow() (153) -> isActiveWindow() (qwidget.cpp:6967) enters the focusWindow loop (6995-7003) -> qobject_cast (6997/6998) -> qobject_cast_helper (qobjectdefs.h:758) -> QMetaObject::cast (qmetaobject.cpp:413) -> obj->metaObject() OOB. This event is delivered by QWidgetPrivate::hideChildren() -> QCoreApplication::sendEvent(widget,&e) (qwidget.cpp:8560), reached from hide_helper (8264) during workbench-switch teardown.","evidence":["qtbase/src/corelib/kernel/qmetaobject.cpp:413 -- cast(): obj null-checked then obj->metaObject() (virtual) dereferenced; the vtable-slot load through obj's corrupted vptr is the OOB","qtbase/src/corelib/kernel/qmetaobject.cpp:387-395 -- inherits()/superdata walk uses static QMetaObject data only; ruled out as the OOB site","qtbase/src/widgets/kernel/qwidget.cpp:6967-7003 -- isActiveWindow(); only cast is the focusWindow container loop at 6997-6998","qtbase/src/widgets/kernel/qwidget.cpp:6997 -- qobject_cast<QWidgetWindow*>(ww), ww from focusWindow()","qtbase/src/widgets/kernel/qwidget.cpp:7010-7012 -- windowHandle()->handle() path is null-guarded (rules out null-handle theory)","qtbase/src/gui/kernel/qguiapplication.cpp:194 -- QGuiApplicationPrivate::focus_window is a raw QWindow* (can dangle)","qtbase/src/widgets/kernel/qwidgetwindow_p.h:43 -- QWidgetWindow::widget() returns raw m_widget","qtbase/src/corelib/kernel/qobjectdefs.h:758 -- qobject_cast_helper -> staticMetaObject.cast(object)","qtbase/src/widgets/styles/qstyleoption.cpp:141-153 -- initFrom(): …