Avoid crashing when the end of an empty markdown list is detected

The markdown parser generates empty lists in some cases when a character
that can be used as a bullet is found on a line by itself.
cbEnterBlock() and cbLeaveBlock() are called symmetrically in such cases.
QStack::pop() on an empty stack triggers an assert, so push and pop need
to be done symmetrically too.  But it's difficult to actually create the
list as soon as the MD_BLOCK_UL or MD_BLOCK_OL callback occurs, without
breaking the case fixed in 7224d0e427d71e559b928c44634839b4791c1416 (and
probably other cases).  That's because QTextCursor::insertList() creates
a list item at the same time as it creates the list itself, and also
inherits block formatting from the previous block.  We now insert empty
lists with empty items whenever the need for that is detected though,
and there's a failsafe to prevent popping in case something still goes
wrong with that logic.  We aren't strict about reproducing the original
markdown when regenerating it via toMarkdown(), but it's getting closer.

Fixes: QTBUG-78870
Change-Id: Ided194ce7aec2710c60dbac42761ee4169ed9b78
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Robert Loehning <robert.loehning@qt.io>

1 files changed, 18 insertions, 6 deletions

diff --git a/src/gui/text/qtextmarkdownimporter.cpp b/src/gui/text/qtextmarkdownimporter.cpp
index 87ade1f973..c2ad1e5612 100644
--- a/src/gui/text/qtextmarkdownimporter.cpp
+++ b/src/gui/text/qtextmarkdownimporter.cpp
@@ -216,6 +216,10 @@ int QTextMarkdownImporter::cbEnterBlock(int blockType, void *det)
         qCDebug(lcMD) << "LI";
     } break;
     case MD_BLOCK_UL: {
+        if (m_needsInsertList) // list nested in an empty list
+            m_listStack.push(m_cursor->insertList(m_listFormat));
+        else
+            m_needsInsertList = true;
         MD_BLOCK_UL_DETAIL *detail = static_cast<MD_BLOCK_UL_DETAIL *>(det);
         m_listFormat = QTextListFormat();
         m_listFormat.setIndent(m_listStack.count() + 1);
@@ -230,17 +234,19 @@ int QTextMarkdownImporter::cbEnterBlock(int blockType, void *det)
             m_listFormat.setStyle(QTextListFormat::ListDisc);
             break;
         }
-        qCDebug(lcMD, "UL %c level %d", detail->mark, m_listStack.count());
-        m_needsInsertList = true;
+        qCDebug(lcMD, "UL %c level %d", detail->mark, m_listStack.count() + 1);
     } break;
     case MD_BLOCK_OL: {
+        if (m_needsInsertList) // list nested in an empty list
+            m_listStack.push(m_cursor->insertList(m_listFormat));
+        else
+            m_needsInsertList = true;
         MD_BLOCK_OL_DETAIL *detail = static_cast<MD_BLOCK_OL_DETAIL *>(det);
         m_listFormat = QTextListFormat();
         m_listFormat.setIndent(m_listStack.count() + 1);
         m_listFormat.setNumberSuffix(QChar::fromLatin1(detail->mark_delimiter));
         m_listFormat.setStyle(QTextListFormat::ListDecimal);
-        qCDebug(lcMD, "OL xx%d level %d", detail->mark_delimiter, m_listStack.count());
-        m_needsInsertList = true;
+        qCDebug(lcMD, "OL xx%d level %d", detail->mark_delimiter, m_listStack.count() + 1);
     } break;
     case MD_BLOCK_TD: {
         MD_BLOCK_TD_DETAIL *detail = static_cast<MD_BLOCK_TD_DETAIL *>(det);
@@ -306,8 +312,14 @@ int QTextMarkdownImporter::cbLeaveBlock(int blockType, void *detail)
         break;
     case MD_BLOCK_UL:
     case MD_BLOCK_OL:
-        qCDebug(lcMD, "list at level %d ended", m_listStack.count());
-        m_listStack.pop();
+        if (Q_UNLIKELY(m_needsInsertList))
+            m_listStack.push(m_cursor->createList(m_listFormat));
+        if (Q_UNLIKELY(m_listStack.isEmpty())) {
+            qCWarning(lcMD, "list ended unexpectedly");
+        } else {
+            qCDebug(lcMD, "list at level %d ended", m_listStack.count());
+            m_listStack.pop();
+        }
         break;
     case MD_BLOCK_TR: {
         // https://github.com/mity/md4c/issues/29