Crash when deleting the parent of a context menu while it is being displayed

Asynchronous deletion of a widget (e.g. calling deleteLater() after a timeout)
could be caught by the context menu's event loop if called with exec() instead
of popup(). This causes the context menu to be deleted twice in some cases,
and a crash generally follows.

Although this introduces a minor behaviour change, we now use popup() with the
WA_DeleteOnClose attribute to display the context menu in all the
contextMenuEvent() bodies, except in those where the menu was already
protected by a QPointer. In QDialog::contextMenuEvent(), we use QWeakPointer
to reflect the fact that the menu was previously allocated in the stack.

QAbstractSpinBox, QDialog and QMdiSubWindow keep using QMenu::exec() in
contextMenuEvent() as they need the QAction returned.

Some auto-tests included.

Reviewed-by: Olivier
Task-number: QTBUG-7902

1 files changed, 24 insertions, 0 deletions

diff --git a/tests/auto/qlabel/tst_qlabel.cpp b/tests/auto/qlabel/tst_qlabel.cpp
index 7099917836..153149e70e 100644
--- a/tests/auto/qlabel/tst_qlabel.cpp
+++ b/tests/auto/qlabel/tst_qlabel.cpp
@@ -121,6 +121,10 @@ private slots:
     void mnemonic();
     void selection();
 
+#ifndef QT_NO_CONTEXTMENU
+    void taskQTBUG_7902_contextMenuCrash();
+#endif
+
 private:
     QLabel *testWidget;
     QPointer<Widget> test_box;
@@ -582,5 +586,25 @@ void tst_QLabel::selection()
     QCOMPARE(label.selectionStart(), 6);
 }
 
+#ifndef QT_NO_CONTEXTMENU
+void tst_QLabel::taskQTBUG_7902_contextMenuCrash()
+{
+    QLabel *w = new QLabel("Test or crash?");
+    w->setTextInteractionFlags(Qt::TextSelectableByMouse);
+    w->show();
+    QTest::qWaitForWindowShown(w);
+
+    QTimer ti;
+    w->connect(&ti, SIGNAL(timeout()), w, SLOT(deleteLater()));
+    ti.start(300);
+
+    QContextMenuEvent *cme = new QContextMenuEvent(QContextMenuEvent::Mouse, w->rect().center());
+    qApp->postEvent(w, cme);
+
+    QTest::qWait(350);
+    // No crash, it's allright.
+}
+#endif
+
 QTEST_MAIN(tst_QLabel)
 #include "tst_qlabel.moc"