QComboBox: fix crash on setEditable(false) called from editTextChanged()

QLineEdit::setText() emits QLineEdit::textChanged(), which is
connected to QComboBox::editTextChanged(). When a user slot
connected to editTextChanged() sets QComboBox::editable to
false, the line edit will be deleted in setEditable() and
when control returns to QComboBoxPrivate::setCurrentIndex(),
the formerly non-null 'lineEdit' has changed to nullptr,
leading to a nullptr dereference when attempting to set the
completionPrefix on lineEdit->completer().

Fix by re-checking 'lineEdit' after returning from the
QLineEdit::setText() call.

Add a test.

Task-number: QTBUG-54191
Change-Id: I94154796cfde73fb490f8471c48b9d6f62825a92
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>

1 files changed, 25 insertions, 0 deletions

diff --git a/tests/auto/widgets/widgets/qcombobox/tst_qcombobox.cpp b/tests/auto/widgets/widgets/qcombobox/tst_qcombobox.cpp
index ae516639a6..15bf686699 100644
--- a/tests/auto/widgets/widgets/qcombobox/tst_qcombobox.cpp
+++ b/tests/auto/widgets/widgets/qcombobox/tst_qcombobox.cpp
@@ -161,6 +161,7 @@ private slots:
     void itemData();
     void task_QTBUG_31146_popupCompletion();
     void task_QTBUG_41288_completerChangesCurrentIndex();
+    void task_QTBUG_54191_slotOnEditTextChangedSetsComboBoxToReadOnly();
     void keyboardSelection();
     void setCustomModelAndView();
     void updateDelegateOnEditableChange();
@@ -3124,6 +3125,30 @@ void tst_QComboBox::task_QTBUG_41288_completerChangesCurrentIndex()
     }
 }
 
+namespace {
+    struct SetReadOnly {
+        QComboBox *cb;
+        explicit SetReadOnly(QComboBox *cb) : cb(cb) {}
+        void operator()() const
+        { cb->setEditable(false); }
+    };
+}
+
+void tst_QComboBox::task_QTBUG_54191_slotOnEditTextChangedSetsComboBoxToReadOnly()
+{
+    QComboBox cb;
+    cb.addItems(QStringList() << "one" << "two");
+    cb.setEditable(true);
+    cb.setCurrentIndex(0);
+
+    connect(&cb, &QComboBox::editTextChanged,
+            SetReadOnly(&cb));
+
+    cb.setCurrentIndex(1);
+    // the real test is that it didn't crash...
+    QCOMPARE(cb.currentIndex(), 1);
+}
+
 void tst_QComboBox::keyboardSelection()
 {
     QComboBox comboBox;