AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Widgets that become top-level widgets may crash the application

Browse Source 
You can reproduce the bug with the QMainWindow demo application: Just
dock the toolbar on the left side, then try to drag the bar back to
the top and observe that the application crashes.

This happens, because the toolbar becomes a top-level widget during the
dragging action and therefore some data structures like a window are
created. After the toolbar has been docked, it loses its top-level state
and the window object is destroyed. The same is not true for the backing
store structure, which still keeps a pointer to the destroyed window.
When the toolbar is dragged the next time, a new window object is created,
but the backing store tries to access the deleted one. Crash occurs.

Change-Id: I0d1ffc04c19ec14654ceb62a0d3cf7cf65cb952d
Reviewed-by: Girish Ramakrishnan <girish.1.ramakrishnan@nokia.com>
This commit is contained in:
Berthold Krevert 2012-06-06 13:52:29 +02:00 committed by Qt by Nokia
parent e83c3a0d33
commit 3a77bbe68b
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/widgets/kernel/qwidget.cpp
View File

@ -1601,9 +1601,8 @@ void QWidgetPrivate::deleteExtra()
#endif
if (extra->topextra) {
deleteTLSysExtra();
extra->topextra->backingStoreTracker.destroy();
// extra->topextra->backingStore destroyed in QWidgetPrivate::deleteTLSysExtra()
delete extra->topextra->icon;
delete extra->topextra->backingStore;
delete extra->topextra;
}
delete extra;

6
src/widgets/kernel/qwidget_qpa.cpp
View File

@ -914,9 +914,13 @@ void QWidgetPrivate::deleteTLSysExtra()
extra->topextra->window->destroy();
}
setWinId(0);
//hmmm. should we delete window..
delete extra->topextra->window;
extra->topextra->window = 0;
extra->topextra->backingStoreTracker.destroy();
delete extra->topextra->backingStore;
extra->topextra->backingStore = 0;
}
}