Fix crash with QTextEdit::textChanged() when deleting a character

QTextEdit::textChanged() will be emitted from a function called from
within QTextCursorPrivate. If the code connected to textChanged()
makes a local copy of the current text cursor and then causes it
to detach, we will crash when returning to QTextCursorPrivate and
trying to access the now-deleted data. To avoid this, we make a local
reference to the current text cursor that gives us a guarantee that
it will be valid throughout the delete-call.

Task-number: QTBUG-9599
Reviewed-by: Gunnar

1 files changed, 4 insertions, 2 deletions

diff --git a/src/gui/text/qtextcontrol.cpp b/src/gui/text/qtextcontrol.cpp
index aaaa3ca..2206e5e 100644
--- a/src/gui/text/qtextcontrol.cpp
+++ b/src/gui/text/qtextcontrol.cpp
@@ -1199,7 +1199,8 @@ void QTextControlPrivate::keyPressEvent(QKeyEvent *e)
             blockFmt.setIndent(blockFmt.indent() - 1);
             cursor.setBlockFormat(blockFmt);
         } else {
-            cursor.deletePreviousChar();
+            QTextCursor localCursor = cursor;
+            localCursor.deletePreviousChar();
         }
         goto accept;
     }
@@ -1232,7 +1233,8 @@ void QTextControlPrivate::keyPressEvent(QKeyEvent *e)
     }
 #endif
     else if (e == QKeySequence::Delete) {
-        cursor.deleteChar();
+        QTextCursor localCursor = cursor;
+        localCursor.deleteChar();
     }
     else if (e == QKeySequence::DeleteEndOfWord) {
         if (!cursor.hasSelection())