Crash when deleting the parent of a context menu while it is being displayed

Asynchronous deletion of a widget (e.g. calling deleteLater() after a timeout)
could be caught by the context menu's event loop if called with exec() instead
of popup(). This causes the context menu to be deleted twice in some cases,
and a crash generally follows.

Although this introduces a minor behaviour change, we now use popup() with the
WA_DeleteOnClose attribute to display the context menu in all the
contextMenuEvent() bodies, except in those where the menu was already
protected by a QPointer. In QDialog::contextMenuEvent(), we use QWeakPointer
to reflect the fact that the menu was previously allocated in the stack.

QAbstractSpinBox, QDialog and QMdiSubWindow keep using QMenu::exec() in
contextMenuEvent() as they need the QAction returned.

Some auto-tests included.

Reviewed-by: Olivier
Task-number: QTBUG-7902

1 files changed, 23 insertions, 0 deletions

diff --git a/tests/auto/qlineedit/tst_qlineedit.cpp b/tests/auto/qlineedit/tst_qlineedit.cpp
index 7283916..fcca58a 100644
--- a/tests/auto/qlineedit/tst_qlineedit.cpp
+++ b/tests/auto/qlineedit/tst_qlineedit.cpp
@@ -271,6 +271,9 @@ private slots:
     void taskQTBUG_4401_enterKeyClearsPassword();
     void taskQTBUG_4679_moveToStartEndOfBlock();
     void taskQTBUG_4679_selectToStartEndOfBlock();
+#ifndef QT_NO_CONTEXTMENU
+    void taskQTBUG_7902_contextMenuCrash();
+#endif
 
 protected slots:
 #ifdef QT3_SUPPORT
@@ -3638,5 +3641,25 @@ void tst_QLineEdit::taskQTBUG_4679_selectToStartEndOfBlock()
 #endif // Q_OS_MAC
 }
 
+#ifndef QT_NO_CONTEXTMENU
+void tst_QLineEdit::taskQTBUG_7902_contextMenuCrash()
+{
+    // Would pass before the associated commit, but left as a guard.
+    QLineEdit *w = new QLineEdit;
+    w->show();
+    QTest::qWaitForWindowShown(w);
+
+    QTimer ti;
+    w->connect(&ti, SIGNAL(timeout()), w, SLOT(deleteLater()));
+    ti.start(200);
+
+    QContextMenuEvent *cme = new QContextMenuEvent(QContextMenuEvent::Mouse, w->rect().center());
+    qApp->postEvent(w, cme);
+
+    QTest::qWait(300);
+    // No crash, it's allright.
+}
+#endif
+
 QTEST_MAIN(tst_QLineEdit)
 #include "tst_qlineedit.moc"