Fix possible use-after-free in VerticalLayout.

If some row widgets of VerticalLayout are living
in its own lifetime() we have a use-after-free.

Because this lifetime() destroys this child row
already after ~VerticalLayout which can call back
into VerticalLayout::childHeightUpdated (the subscription
lives inside the same lifetime() as well) which
will access _rows member that was already destroyed.

Now all subscriptions die before _rows are destroyed.
This commit is contained in:
John Preston 2022-04-14 16:52:11 +04:00
parent 258cacf7c5
commit aa155db0bd
2 changed files with 3 additions and 1 deletions

View file

@ -133,7 +133,7 @@ RpWidget *VerticalLayout::insertChild(
}
}, [=] {
removeChild(weak);
}, lifetime());
}, _rowsLifetime);
return weak;
}
return nullptr;

View file

@ -82,6 +82,8 @@ private:
std::vector<Row> _rows;
bool _inResize = false;
rpl::lifetime _rowsLifetime;
};
} // namespace Ui