diff options
author | Mitch Curtis <mitch.curtis@qt.io> | 2020-05-27 10:22:37 +0200 |
---|---|---|
committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2020-05-29 13:49:11 +0000 |
commit | 0924bd35dce68adf5dc1fc0514f49a978bea2a45 (patch) | |
tree | dc894860d160765228d2f02a6b6b28a67bf94df1 /tests | |
parent | d5a01cdf6e762f510e0b70e3be95998f16ebaf40 (diff) |
StackView: fix heap-use-after-free when pushing after clear
This patch extends the work done in aaec25a7 to cover all operations.
Note also that b94889f4 does a similar thing to this patch and
aaec25a7, in that it explicitly ignores operations that are done during
the removal of elements.
Fixes: QTBUG-84381
Change-Id: Id8bbbded39d8e58bcf0e8eedeb2dde794952333f
Reviewed-by: Richard Moe Gustavsen <richard.gustavsen@qt.io>
(cherry picked from commit b67cc148693de06370633cddf82a31664004e65c)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Diffstat (limited to 'tests')
-rw-r--r-- | tests/auto/controls/data/tst_stackview.qml | 38 |
1 files changed, 32 insertions, 6 deletions
diff --git a/tests/auto/controls/data/tst_stackview.qml b/tests/auto/controls/data/tst_stackview.qml index c15ce8ea..767ec818 100644 --- a/tests/auto/controls/data/tst_stackview.qml +++ b/tests/auto/controls/data/tst_stackview.qml @@ -804,7 +804,10 @@ TestCase { var item = control.push(component, StackView.Immediate) verify(item) - item.StackView.onRemoved.connect(function() { control.push(component, StackView.Immediate) } ) + item.StackView.onRemoved.connect(function() { + ignoreWarning(/.*QML StackView: cannot push while already in the process of completing a pop/) + control.push(component, StackView.Immediate) + }) // don't crash (QTBUG-62153) control.pop(StackView.Immediate) @@ -1287,7 +1290,7 @@ TestCase { control.push(container.clearUponDestructionComponent, StackView.Immediate) // Shouldn't crash. - ignoreWarning(new RegExp(".*cannot clear while already in the process of removing elements")) + ignoreWarning(/.*cannot clear while already in the process of completing a clear/) control.clear(StackView.Immediate) } @@ -1301,7 +1304,7 @@ TestCase { // Pop all items except the first, removing the second item we pushed in the process. // Shouldn't crash. - ignoreWarning(new RegExp(".*cannot clear while already in the process of removing elements")) + ignoreWarning(/.*cannot clear while already in the process of completing a pop/) control.pop(null, StackView.Immediate) } @@ -1316,7 +1319,7 @@ TestCase { control.push(container.clearUponDestructionComponent, StackView.Immediate) // Pop the top item, then pop down to the first item in response. - ignoreWarning(new RegExp(".*cannot pop while already in the process of removing elements")) + ignoreWarning(/.*cannot pop while already in the process of completing a pop/) control.pop(StackView.Immediate) } @@ -1329,7 +1332,7 @@ TestCase { control.push(container.clearUponDestructionComponent, StackView.Immediate) // Replace the top item, then clear in response. - ignoreWarning(new RegExp(".*cannot clear while already in the process of removing elements")) + ignoreWarning(/.*cannot clear while already in the process of completing a replace/) control.replace(component, StackView.Immediate) } @@ -1342,7 +1345,7 @@ TestCase { control.push(container.clearUponDestructionComponent, StackView.Immediate) // Replace the top item, then clear in response. - ignoreWarning(new RegExp(".*cannot replace while already in the process of removing elements")) + ignoreWarning(/.*cannot replace while already in the process of completing a clear/) control.clear(StackView.Immediate) } @@ -1404,4 +1407,27 @@ TestCase { tryCompare(control, "busy", false) compare(redRect.visible, true) } + + // QTBUG-84381 + function test_clearAndPushAfterDepthChange() { + var control = createTemporaryObject(stackView, testCase, { + popEnter: null, popExit: null, pushEnter: null, + pushExit: null, replaceEnter: null, replaceExit: null + }) + verify(control) + + control.depthChanged.connect(function() { + if (control.depth === 2) { + // Shouldn't assert. + ignoreWarning(/.*QML StackView: cannot clear while already in the process of completing a push/) + control.clear() + // Shouldn't crash. + ignoreWarning(/.*QML StackView: cannot push while already in the process of completing a push/) + control.push(component) + } + }) + + control.push(component) + control.push(component) + } } |