Fix crash when accessing newly constructed QTextObjects.

The pieceTable member was only initialized by QTextDocumentPrivate
_after_ the call to createObject. This patch initializes it at
construction time.

Task-number: 246138
Reviewed-by: Simon Hausmann

8 files changed, 45 insertions, 10 deletions

diff --git a/src/gui/text/qtextdocument.h b/src/gui/text/qtextdocument.h
index c337783..9c3d6c2 100644
--- a/src/gui/text/qtextdocument.h
+++ b/src/gui/text/qtextdocument.h
@@ -287,6 +287,7 @@ public:
 private:
     Q_DISABLE_COPY(QTextDocument)
     Q_DECLARE_PRIVATE(QTextDocument)
+    friend class QTextObjectPrivate;
 };
 
 Q_DECLARE_OPERATORS_FOR_FLAGS(QTextDocument::FindFlags)
diff --git a/src/gui/text/qtextdocument_p.cpp b/src/gui/text/qtextdocument_p.cpp
index 320ecbf..05ddf47 100644
--- a/src/gui/text/qtextdocument_p.cpp
+++ b/src/gui/text/qtextdocument_p.cpp
@@ -1484,7 +1484,6 @@ QTextObject *QTextDocumentPrivate::createObject(const QTextFormat &f, int object
     QTextObject *obj = document()->createObject(f);
 
     if (obj) {
-        obj->d_func()->pieceTable = this;
         obj->d_func()->objectIndex = objectIndex == -1 ? formats.createObjectIndex(f) : objectIndex;
         objects[obj->d_func()->objectIndex] = obj;
     }
diff --git a/src/gui/text/qtextlist.cpp b/src/gui/text/qtextlist.cpp
index e305027..d1a3361 100644
--- a/src/gui/text/qtextlist.cpp
+++ b/src/gui/text/qtextlist.cpp
@@ -50,6 +50,11 @@ QT_BEGIN_NAMESPACE
 
 class QTextListPrivate : public QTextBlockGroupPrivate
 {
+public:
+    QTextListPrivate(QTextDocument *doc)
+        : QTextBlockGroupPrivate(doc)
+    {
+    }
 };
 
 /*!
@@ -111,7 +116,7 @@ class QTextListPrivate : public QTextBlockGroupPrivate
 /*! \internal
  */
 QTextList::QTextList(QTextDocument *doc)
-    : QTextBlockGroup(*new QTextListPrivate, doc)
+    : QTextBlockGroup(*new QTextListPrivate(doc), doc)
 {
 }
 
diff --git a/src/gui/text/qtextobject.cpp b/src/gui/text/qtextobject.cpp
index 1645a21..3f4c8e5 100644
--- a/src/gui/text/qtextobject.cpp
+++ b/src/gui/text/qtextobject.cpp
@@ -88,7 +88,7 @@ QT_BEGIN_NAMESPACE
     from QTextDocument::createObject().
 */
 QTextObject::QTextObject(QTextDocument *doc)
-    : QObject(*new QTextObjectPrivate, doc)
+    : QObject(*new QTextObjectPrivate(doc), doc)
 {
 }
 
@@ -98,7 +98,7 @@ QTextObject::QTextObject(QTextDocument *doc)
   \internal
 */
 QTextObject::QTextObject(QTextObjectPrivate &p, QTextDocument *doc)
-    :QObject(p, doc)
+    : QObject(p, doc)
 {
 }
 
@@ -221,7 +221,7 @@ void QTextBlockGroupPrivate::markBlocksDirty()
     QTextDocument::createObject().
 */
 QTextBlockGroup::QTextBlockGroup(QTextDocument *doc)
-    : QTextObject(*new QTextBlockGroupPrivate, doc)
+    : QTextObject(*new QTextBlockGroupPrivate(doc), doc)
 {
 }
 
@@ -410,7 +410,7 @@ QTextFrameLayoutData::~QTextFrameLayoutData()
     Creates a new empty frame for the text \a document.
 */
 QTextFrame::QTextFrame(QTextDocument *doc)
-    : QTextObject(*new QTextFramePrivate, doc)
+    : QTextObject(*new QTextFramePrivate(doc), doc)
 {
     Q_D(QTextFrame);
     d->fragment_start = 0;
diff --git a/src/gui/text/qtextobject_p.h b/src/gui/text/qtextobject_p.h
index b00a16a..dd05eb4 100644
--- a/src/gui/text/qtextobject_p.h
+++ b/src/gui/text/qtextobject_p.h
@@ -55,6 +55,7 @@
 
 #include "QtGui/qtextobject.h"
 #include "private/qobject_p.h"
+#include "QtGui/qtextdocument.h"
 
 QT_BEGIN_NAMESPACE
 
@@ -64,6 +65,10 @@ class QTextObjectPrivate : public QObjectPrivate
 {
     Q_DECLARE_PUBLIC(QTextObject)
 public:
+    QTextObjectPrivate(QTextDocument *doc)
+        : pieceTable(doc->d_func()), objectIndex(-1)
+    {
+    }
     QTextDocumentPrivate *pieceTable;
     int objectIndex;
 };
@@ -72,7 +77,10 @@ class QTextBlockGroupPrivate : public QTextObjectPrivate
 {
     Q_DECLARE_PUBLIC(QTextBlockGroup)
 public:
-
+    QTextBlockGroupPrivate(QTextDocument *doc)
+        : QTextObjectPrivate(doc)
+    {
+    }
     typedef QList<QTextBlock> BlockList;
     BlockList blocks;
     void markBlocksDirty();
@@ -85,7 +93,10 @@ class QTextFramePrivate : public QTextObjectPrivate
     friend class QTextDocumentPrivate;
     Q_DECLARE_PUBLIC(QTextFrame)
 public:
-
+    QTextFramePrivate(QTextDocument *doc)
+        : QTextObjectPrivate(doc)
+    {
+    }
     virtual void fragmentAdded(const QChar &type, uint fragment);
     virtual void fragmentRemoved(const QChar &type, uint fragment);
     void remove_me();
diff --git a/src/gui/text/qtexttable.cpp b/src/gui/text/qtexttable.cpp
index 375bb09..ba1c04f 100644
--- a/src/gui/text/qtexttable.cpp
+++ b/src/gui/text/qtexttable.cpp
@@ -553,7 +553,7 @@ void QTextTablePrivate::update() const
 /*! \internal
  */
 QTextTable::QTextTable(QTextDocument *doc)
-    : QTextFrame(*new QTextTablePrivate, doc)
+    : QTextFrame(*new QTextTablePrivate(doc), doc)
 {
 }
 
diff --git a/src/gui/text/qtexttable_p.h b/src/gui/text/qtexttable_p.h
index 1ba3a3f..f2b45b6 100644
--- a/src/gui/text/qtexttable_p.h
+++ b/src/gui/text/qtexttable_p.h
@@ -62,7 +62,7 @@ class QTextTablePrivate : public QTextFramePrivate
 {
     Q_DECLARE_PUBLIC(QTextTable)
 public:
-    QTextTablePrivate() : grid(0), nRows(0), dirty(true), blockFragmentUpdates(false) {}
+    QTextTablePrivate(QTextDocument *document) : QTextFramePrivate(document), grid(0), nRows(0), dirty(true), blockFragmentUpdates(false) {}
     ~QTextTablePrivate();
 
     static QTextTable *createTable(QTextDocumentPrivate *, int pos, int rows, int cols, const QTextTableFormat &tableFormat);
diff --git a/tests/auto/qtextobject/tst_qtextobject.cpp b/tests/auto/qtextobject/tst_qtextobject.cpp
index 4fbc155..4d1d4b2 100644
--- a/tests/auto/qtextobject/tst_qtextobject.cpp
+++ b/tests/auto/qtextobject/tst_qtextobject.cpp
@@ -62,6 +62,7 @@ public:
 
 private slots:
     void getSetCheck();
+    void testStandAloneTextObject();
 };
 
 tst_QTextObject::tst_QTextObject()
@@ -105,5 +106,23 @@ void tst_QTextObject::getSetCheck()
     QCOMPARE(INT_MAX, obj2.userState());
 }
 
+class TestTextObject : public QTextObject
+{
+public:
+    TestTextObject(QTextDocument *document) : QTextObject(document) {}
+};
+
+void tst_QTextObject::testStandAloneTextObject()
+{
+    QTextDocument document;
+    TestTextObject textObject(&document);
+
+    QCOMPARE(textObject.document(), &document);
+    // don't crash
+    textObject.format();
+    textObject.formatIndex();
+    QCOMPARE(textObject.objectIndex(), -1);
+}
+
 QTEST_MAIN(tst_QTextObject)
 #include "tst_qtextobject.moc"