Make sure removed QTextBlock is invalid

If the block is removed from document block map, we will mark the
right node to the current head->freelist index, but it shouldn't
be accessed directly, otherwise it can cause crash because of
uninitialized node.

Hence we need to check if a node index is equal to current freelist
index. If so, it cannot be a valid block.

Task-number: QTBUG-18500
Reviewed-by: Eskil

1 files changed, 5 insertions, 0 deletions

diff --git a/src/gui/text/qfragmentmap_p.h b/src/gui/text/qfragmentmap_p.h
index 501bfff286..4057142b34 100644
--- a/src/gui/text/qfragmentmap_p.h
+++ b/src/gui/text/qfragmentmap_p.h
@@ -195,6 +195,10 @@ public:
         head->root = new_root;
     }
 
+    inline bool isValid(uint n) const {
+        return n > 0 && n != head->freelist;
+    }
+
     union {
         Header *head;
         Fragment *fragments;
@@ -854,6 +858,7 @@ public:
         return data.fragment(index);
     }
     inline uint position(uint node, uint field = 0) const { return data.position(node, field); }
+    inline bool isValid(uint n) const { return data.isValid(n); }
     inline uint next(uint n) const { return data.next(n); }
     inline uint previous(uint n) const { return data.previous(n); }
     inline uint size(uint node, uint field = 0) const { return data.size(node, field); }