Make sure removed QTextBlock is invalid

If the block is removed from document block map, we will mark the
right node to the current head->freelist index, but it shouldn't
be accessed directly, otherwise it can cause crash because of
uninitialized node.

Hence we need to check if a node index is equal to current freelist
index. If so, it cannot be a valid block.

Task-number: QTBUG-18500
Reviewed-by: Eskil

3 files changed, 11 insertions, 1 deletions

diff --git a/src/gui/text/qfragmentmap_p.h b/src/gui/text/qfragmentmap_p.h
index 501bfff..4057142 100644
--- a/src/gui/text/qfragmentmap_p.h
+++ b/src/gui/text/qfragmentmap_p.h
@@ -195,6 +195,10 @@ public:
         head->root = new_root;
     }
 
+    inline bool isValid(uint n) const {
+        return n > 0 && n != head->freelist;
+    }
+
     union {
         Header *head;
         Fragment *fragments;
@@ -854,6 +858,7 @@ public:
         return data.fragment(index);
     }
     inline uint position(uint node, uint field = 0) const { return data.position(node, field); }
+    inline bool isValid(uint n) const { return data.isValid(n); }
     inline uint next(uint n) const { return data.next(n); }
     inline uint previous(uint n) const { return data.previous(n); }
     inline uint size(uint node, uint field = 0) const { return data.size(node, field); }
diff --git a/src/gui/text/qtextobject.cpp b/src/gui/text/qtextobject.cpp
index 94f2fc7..a403cc5 100644
--- a/src/gui/text/qtextobject.cpp
+++ b/src/gui/text/qtextobject.cpp
@@ -891,6 +891,11 @@ QTextBlockUserData::~QTextBlockUserData()
     Returns true if this text block is valid; otherwise returns false.
 */
 
+bool QTextBlock::isValid() const
+{
+    return p != 0 && p->blockMap().isValid(n);
+}
+
 /*!
     \fn QTextBlock &QTextBlock::operator=(const QTextBlock &other)
 
diff --git a/src/gui/text/qtextobject.h b/src/gui/text/qtextobject.h
index d5c1e8d..73aed79 100644
--- a/src/gui/text/qtextobject.h
+++ b/src/gui/text/qtextobject.h
@@ -204,7 +204,7 @@ public:
     inline QTextBlock(const QTextBlock &o) : p(o.p), n(o.n) {}
     inline QTextBlock &operator=(const QTextBlock &o) { p = o.p; n = o.n; return *this; }
 
-    inline bool isValid() const { return p != 0 && n != 0; }
+    bool isValid() const;
 
     inline bool operator==(const QTextBlock &o) const { return p == o.p && n == o.n; }
     inline bool operator!=(const QTextBlock &o) const { return p != o.p || n != o.n; }