QComboBox on macOS: guard against destruction while native popup is open

Since showing the native popup on macOS is blocking and processes events
the QComboBox might get destroyed while the popup is open. Guard against
this by using QPointer and returning early (dismissing the scope guard
that would otherwise reset the menu's parent, writing to freed memory).

The problem is then that the native popup remains visible, as the
destructor of QComboBox calls cleanupNativeCombobox which destroys the
platform menu (i.e. the QCocoaMenu instance), but that doesn't dismiss()
the popup. Add a call to dismiss() to the QCocoaMenu destructor to make
sure that destroying the menu closes it first.

Fixes: QTBUG-116155
Pick-to: 6.6 6.5
Change-Id: If0ac19796603667f4c8e80c302710dc4c9aded50
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>

1 files changed, 9 insertions, 0 deletions

diff --git a/src/plugins/platforms/cocoa/qcocoamenu.mm b/src/plugins/platforms/cocoa/qcocoamenu.mm
index 4b66d2b610..6d2ad6f719 100644
--- a/src/plugins/platforms/cocoa/qcocoamenu.mm
+++ b/src/plugins/platforms/cocoa/qcocoamenu.mm
@@ -42,6 +42,8 @@ QCocoaMenu::~QCocoaMenu()
             item->setMenuParent(nullptr);
     }
 
+    if (isOpen())
+        dismiss();
     [m_nativeMenu release];
 }
 
@@ -320,6 +322,8 @@ void QCocoaMenu::showPopup(const QWindow *parentWindow, const QRect &targetRect,
 {
     QMacAutoReleasePool pool;
 
+    QPointer<QCocoaMenu> guard = this;
+
     QPoint pos =  QPoint(targetRect.left(), targetRect.top() + targetRect.height());
     QCocoaWindow *cocoaWindow = parentWindow ? static_cast<QCocoaWindow *>(parentWindow->handle()) : nullptr;
     NSView *view = cocoaWindow ? cocoaWindow->view() : nil;
@@ -404,6 +408,11 @@ void QCocoaMenu::showPopup(const QWindow *parentWindow, const QRect &targetRect,
         }
     }
 
+    if (!guard) {
+        menuParentGuard.dismiss();
+        return;
+    }
+
     // The calls above block, and also swallow any mouse release event,
     // so we need to clear any mouse button that triggered the menu popup.
     if (cocoaWindow && !cocoaWindow->isForeignWindow())