Fix possible use-after-free in VerticalLayout.
If some row widgets of VerticalLayout are living in its own lifetime() we have a use-after-free. Because this lifetime() destroys this child row already after ~VerticalLayout which can call back into VerticalLayout::childHeightUpdated (the subscription lives inside the same lifetime() as well) which will access _rows member that was already destroyed. Now all subscriptions die before _rows are destroyed.
This commit is contained in:
parent
258cacf7c5
commit
aa155db0bd
2 changed files with 3 additions and 1 deletions
|
|
@ -133,7 +133,7 @@ RpWidget *VerticalLayout::insertChild(
|
|||
}
|
||||
}, [=] {
|
||||
removeChild(weak);
|
||||
}, lifetime());
|
||||
}, _rowsLifetime);
|
||||
return weak;
|
||||
}
|
||||
return nullptr;
|
||||
|
|
|
|||
|
|
@ -82,6 +82,8 @@ private:
|
|||
std::vector<Row> _rows;
|
||||
bool _inResize = false;
|
||||
|
||||
rpl::lifetime _rowsLifetime;
|
||||
|
||||
};
|
||||
|
||||
} // namespace Ui
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue