Fix possible use-after-free in VerticalLayout.
If some row widgets of VerticalLayout are living in its own lifetime() we have a use-after-free. Because this lifetime() destroys this child row already after ~VerticalLayout which can call back into VerticalLayout::childHeightUpdated (the subscription lives inside the same lifetime() as well) which will access _rows member that was already destroyed. Now all subscriptions die before _rows are destroyed.
This commit is contained in:
parent
258cacf7c5
commit
aa155db0bd
2 changed files with 3 additions and 1 deletions
|
|
@ -133,7 +133,7 @@ RpWidget *VerticalLayout::insertChild(
|
||||||
}
|
}
|
||||||
}, [=] {
|
}, [=] {
|
||||||
removeChild(weak);
|
removeChild(weak);
|
||||||
}, lifetime());
|
}, _rowsLifetime);
|
||||||
return weak;
|
return weak;
|
||||||
}
|
}
|
||||||
return nullptr;
|
return nullptr;
|
||||||
|
|
|
||||||
|
|
@ -82,6 +82,8 @@ private:
|
||||||
std::vector<Row> _rows;
|
std::vector<Row> _rows;
|
||||||
bool _inResize = false;
|
bool _inResize = false;
|
||||||
|
|
||||||
|
rpl::lifetime _rowsLifetime;
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
} // namespace Ui
|
} // namespace Ui
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue