QWidgetWindow: don't give focus to windows that are being destroyed

In the referenced bug report, dismissing a QFileDialog while the
Qt Virtual Keyboard was in use would result in a crash.

Dismissing a file dialog created with
e.g. QFileDialog::getOpenFileName() causes it to eventually be
destroyed. When this happens, it starts deleting its children. Each
child widget's destructor calls clearFocus(). In clearFocus(), there is
a block of code that emits QWindow::focusChanged(), passing the result
of focusObject() called on that widget's window.
QWidgetWindow::focusObject() could end up using itself as a fallback
focus object if it had no other focus objects (e.g. children) to use
instead, even though it was in the process of being destroyed; as were
all of its children. The Qt Virtual Keyboard plugin would then try to
use the focus object, even though it was in an invalid state.

To fix this problem, we return early from QWidgetWindow::focusObject()
if the window is in the process of being destroyed.

Task-number: QTBUG-57193
Change-Id: I137cf9415812ce2e0419c0afe8076ce150f248cb
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
Reviewed-by: Jarkko Koivikko <jarkko.koivikko@code-q.fi>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>

1 files changed, 4 insertions, 0 deletions

diff --git a/src/widgets/kernel/qwidgetwindow.cpp b/src/widgets/kernel/qwidgetwindow.cpp
index 31f2d672bb..6741555c0c 100644
--- a/src/widgets/kernel/qwidgetwindow.cpp
+++ b/src/widgets/kernel/qwidgetwindow.cpp
@@ -152,6 +152,10 @@ QObject *QWidgetWindow::focusObject() const
     if (!windowWidget)
         return Q_NULLPTR;
 
+    // A window can't have a focus object if it's being destroyed.
+    if (QWidgetPrivate::get(windowWidget)->data.in_destructor)
+        return nullptr;
+
     QWidget *widget = windowWidget->focusWidget();
 
     if (!widget)