Set geometry property in QXcbWindow after checking minimum size

QXcbWindow::create() bound the window's size to windowMinimumSize(),
after its size had been inherited from parent().
QPlatformWindow::setGeometry() was called before that sanity check.

When a fullscreen window is re-mapped from a deactivated screen to the
remaining screen, the call to QPlatformWindow::setGeometry() assigns
an invalid QRect to QPlatformWindowPrivate::rect
The negative int values x2 and/or y2 cause
QXcbBackingStoreImage::flushPixmap to address unmapped memory and
crash.

This patch moves the call to QPlatformWindow::setGeometry() from
before to after bounding to a minimum value. That assures a valid
rectangle to be assigned in all cases.

Fixes: QTBUG-109226
Pick-to: 6.4 6.2 5.15
Change-Id: I349a0f3c721059a9013a275de5b4cb147fbdd7a1
Reviewed-by: Liang Qi <liang.qi@qt.io>

1 files changed, 5 insertions, 5 deletions

diff --git a/src/plugins/platforms/xcb/qxcbwindow.cpp b/src/plugins/platforms/xcb/qxcbwindow.cpp
index 1040ddfb2e..dd260fe10a 100644
--- a/src/plugins/platforms/xcb/qxcbwindow.cpp
+++ b/src/plugins/platforms/xcb/qxcbwindow.cpp
@@ -255,11 +255,6 @@ void QXcbWindow::create()
         return;
     }
 
-    QPlatformWindow::setGeometry(rect);
-
-    if (platformScreen != currentScreen)
-        QWindowSystemInterface::handleWindowScreenChanged(window(), platformScreen->QPlatformScreen::screen());
-
     const QSize minimumSize = windowMinimumSize();
     if (rect.width() > 0 || rect.height() > 0) {
         rect.setWidth(qBound(1, rect.width(), XCOORD_MAX));
@@ -271,6 +266,11 @@ void QXcbWindow::create()
         rect.setHeight(QHighDpi::toNativePixels(int(defaultWindowHeight), platformScreen->QPlatformScreen::screen()));
     }
 
+    QPlatformWindow::setGeometry(rect);
+
+    if (platformScreen != currentScreen)
+        QWindowSystemInterface::handleWindowScreenChanged(window(), platformScreen->QPlatformScreen::screen());
+
     xcb_window_t xcb_parent_id = platformScreen->root();
     if (parent()) {
         xcb_parent_id = static_cast<QXcbWindow *>(parent())->xcb_window();