diff options
author | Friedemann Kleint <Friedemann.Kleint@qt.io> | 2020-09-18 13:00:21 +0200 |
---|---|---|
committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2020-09-19 01:41:15 +0000 |
commit | c7e5f92aac16c83611c6b106fbdf311d0a474548 (patch) | |
tree | a9abaa271a8ed322e5bf0d9663fccdce7e2b66ac | |
parent | 9769e43e34b56937100f7b27b4c12d48585e2db9 (diff) |
Fix a double deletion in QDomAttr::setNodeValue()
Check the reference count before deleting. Patch
as contributed on bug report.
Fixes: QTBUG-86547
Change-Id: I2cb197e3eeda7ade2442c23f6b4f1ae6ff2ff810
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
(cherry picked from commit af22ccf5605c6b7b20b845fb2b4003d3f56d8bc9)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
-rw-r--r-- | src/xml/dom/qdom.cpp | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/xml/dom/qdom.cpp b/src/xml/dom/qdom.cpp index c54f4a0bc8..ba37374f75 100644 --- a/src/xml/dom/qdom.cpp +++ b/src/xml/dom/qdom.cpp @@ -3619,7 +3619,9 @@ void QDomAttrPrivate::setNodeValue(const QString& v) // keep the refcount balanced: appendChild() does a ref anyway. t->ref.deref(); if (first) { - delete removeChild(first); + auto removed = removeChild(first); + if (removed && !removed->ref) + delete removed; } appendChild(t); } |