summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKari Oikarinen <kari.oikarinen@qt.io>2018-02-21 14:44:27 +0200
committerKari Oikarinen <kari.oikarinen@qt.io>2018-02-21 15:16:40 +0000
commitec495c98189f1d849e793108b09b5af0ce2c8984 (patch)
tree13ddf7350666951a8fede2de4f0a3093f40ed395
parentfd9fec4fc7f43fb939e8e5a946c7858390bbd9d3 (diff)
Fix use after free in tst_WaylandClient::dontCrashOnMultipleCommitsv5.11.0-beta1
QBackingStore had a pointer to TestWindow window, but it was destroyed only after the TestWindow was already deleted. Change-Id: Id8fe38277cf843d532f2d8c2fdbe1f69d0309a7f Reviewed-by: Johan Helsing <johan.helsing@qt.io>
-rw-r--r--tests/auto/client/client/tst_client.cpp26
1 files changed, 14 insertions, 12 deletions
diff --git a/tests/auto/client/client/tst_client.cpp b/tests/auto/client/client/tst_client.cpp
index e244de7f..eb99b2e2 100644
--- a/tests/auto/client/client/tst_client.cpp
+++ b/tests/auto/client/client/tst_client.cpp
@@ -487,19 +487,21 @@ void tst_WaylandClient::dontCrashOnMultipleCommits()
QRect rect(QPoint(), window->size());
- QBackingStore backingStore(window);
- backingStore.resize(rect.size());
- backingStore.beginPaint(rect);
- QPainter p(backingStore.paintDevice());
- p.fillRect(rect, Qt::magenta);
- p.end();
- backingStore.endPaint();
-
- backingStore.flush(rect);
- backingStore.flush(rect);
- backingStore.flush(rect);
+ {
+ QBackingStore backingStore(window);
+ backingStore.resize(rect.size());
+ backingStore.beginPaint(rect);
+ QPainter p(backingStore.paintDevice());
+ p.fillRect(rect, Qt::magenta);
+ p.end();
+ backingStore.endPaint();
+
+ backingStore.flush(rect);
+ backingStore.flush(rect);
+ backingStore.flush(rect);
- compositor->processWaylandEvents();
+ compositor->processWaylandEvents();
+ }
delete window;