Fix undefined behavior in QSharedPointer::create()5.8

Initialize a deleter for a new object, created by
QSharedPointer::create(), only after the object is actually
constructed.

[ChangeLog][QtCore][QSharedPointer] Fixed undefined behavior when
creating an object with QSharedPointer::create() and its conscructor
throws an exception.

Task-number: QTBUG-49824
Change-Id: I07f77a78ff468d9b45b8ef133278e8cdd96a0647
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/src/corelib/tools/qsharedpointer_impl.h b/src/corelib/tools/qsharedpointer_impl.h
index 5738413bfb..373fc3a662 100644
--- a/src/corelib/tools/qsharedpointer_impl.h
+++ b/src/corelib/tools/qsharedpointer_impl.h
@@ -260,6 +260,7 @@ namespace QtSharedPointer {
             internalSafetyCheckRemove(self);
             deleter(self);
         }
+        static void noDeleter(ExternalRefCountData *) { }
 
         static inline ExternalRefCountData *create(T **ptr, DestroyerFn destroy)
         {
@@ -433,11 +434,13 @@ public:
 # else
         typename Private::DestroyerFn destroy = &Private::deleter;
 # endif
+        typename Private::DestroyerFn noDestroy = &Private::noDeleter;
         QSharedPointer result(Qt::Uninitialized);
-        result.d = Private::create(&result.value, destroy);
+        result.d = Private::create(&result.value, noDestroy);
 
         // now initialize the data
         new (result.data()) T(std::forward<Args>(arguments)...);
+        result.d->destroyer = destroy;
         result.d->setQObjectShared(result.value, true);
 # ifdef QT_SHAREDPOINTER_TRACK_POINTERS
         internalSafetyCheckAdd(result.d, result.value);