Crash when deleting the parent of a context menu while it is being displayed

Asynchronous deletion of a widget (e.g. calling deleteLater() after a timeout)
could be caught by the context menu's event loop if called with exec() instead
of popup(). This causes the context menu to be deleted twice in some cases,
and a crash generally follows.

Although this introduces a minor behaviour change, we now use popup() with the
WA_DeleteOnClose attribute to display the context menu in all the
contextMenuEvent() bodies, except in those where the menu was already
protected by a QPointer. In QDialog::contextMenuEvent(), we use QWeakPointer
to reflect the fact that the menu was previously allocated in the stack.

QAbstractSpinBox, QDialog and QMdiSubWindow keep using QMenu::exec() in
contextMenuEvent() as they need the QAction returned.

Some auto-tests included.

Reviewed-by: Olivier
Task-number: QTBUG-7902

1 files changed, 2 insertions, 2 deletions

diff --git a/src/gui/text/qtextcontrol.cpp b/src/gui/text/qtextcontrol.cpp
index aaaa3ca..8d3923f 100644
--- a/src/gui/text/qtextcontrol.cpp
+++ b/src/gui/text/qtextcontrol.cpp
@@ -1762,8 +1762,8 @@ void QTextControlPrivate::contextMenuEvent(const QPoint &screenPos, const QPoint
     QMenu *menu = q->createStandardContextMenu(docPos, contextWidget);
     if (!menu)
         return;
-    menu->exec(screenPos);
-    delete menu;
+    menu->setAttribute(Qt::WA_DeleteOnClose);
+    menu->popup(screenPos);
 #endif
 }