From 7d09f690d5b4c56699092444665d1879deb86a6e Mon Sep 17 00:00:00 2001 From: Yoann Lopes Date: Fri, 9 Jul 2010 16:28:18 +0200 Subject: Fixes crash in QGraphicsScene::addItem(). MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Crashed because tabFocusFirst could end up being a dangling pointer when removing an item from the scene before deleting it. When setting tabFocusFirst in fixFocusChainBeforeReparenting, we now check that the item is in the scene. If it is not, tabFocusFirst is set to 0. Autotest included. Task-number: QTBUG-12056 Reviewed-by: Alexis Ménard --- src/gui/graphicsview/qgraphicswidget_p.cpp | 4 ++-- tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp | 20 ++++++++++++++++++++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/src/gui/graphicsview/qgraphicswidget_p.cpp b/src/gui/graphicsview/qgraphicswidget_p.cpp index 28070da..f7850ca 100644 --- a/src/gui/graphicsview/qgraphicswidget_p.cpp +++ b/src/gui/graphicsview/qgraphicswidget_p.cpp @@ -761,7 +761,7 @@ void QGraphicsWidgetPrivate::fixFocusChainBeforeReparenting(QGraphicsWidget *new QGraphicsWidget *firstOld = 0; bool wasPreviousNew = true; - + while (w != q) { bool isCurrentNew = q->isAncestorOf(w); if (isCurrentNew) { @@ -796,7 +796,7 @@ void QGraphicsWidgetPrivate::fixFocusChainBeforeReparenting(QGraphicsWidget *new newScene = newParent->scene(); if (oldScene && newScene != oldScene) - oldScene->d_func()->tabFocusFirst = firstOld; + oldScene->d_func()->tabFocusFirst = (firstOld && firstOld->scene() == oldScene) ? firstOld : 0; QGraphicsItem *topLevelItem = newParent ? newParent->topLevelItem() : 0; QGraphicsWidget *topLevel = 0; diff --git a/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp b/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp index ed8ff04..a771332 100644 --- a/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp +++ b/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp @@ -176,6 +176,7 @@ private slots: void task243004_setStyleCrash(); void task250119_shortcutContext(); void QT_BUG_6544_tabFocusFirstUnsetWhenRemovingItems(); + void QT_BUG_12056_tabFocusFirstUnsetWhenRemovingItems(); }; @@ -3089,6 +3090,25 @@ void tst_QGraphicsWidget::QT_BUG_6544_tabFocusFirstUnsetWhenRemovingItems() //This should not crash } +void tst_QGraphicsWidget::QT_BUG_12056_tabFocusFirstUnsetWhenRemovingItems() +{ + QGraphicsScene scene; + QGraphicsWidget* item1 = new QGraphicsWidget; + QGraphicsWidget* item2 = new QGraphicsWidget; + QGraphicsWidget* item3 = new QGraphicsWidget; + + scene.addItem(item1); + scene.addItem(item2); + + scene.removeItem(item2); + scene.removeItem(item1); + delete item2; + delete item1; + + scene.addItem(item3); + + //This should not crash +} QTEST_MAIN(tst_QGraphicsWidget) #include "tst_qgraphicswidget.moc" -- cgit v0.12