diff options
author | Kari Oikarinen <kari.oikarinen@qt.io> | 2018-02-21 14:44:27 +0200 |
---|---|---|
committer | Kari Oikarinen <kari.oikarinen@qt.io> | 2018-02-21 15:16:40 +0000 |
commit | ec495c98189f1d849e793108b09b5af0ce2c8984 (patch) | |
tree | 13ddf7350666951a8fede2de4f0a3093f40ed395 | |
parent | fd9fec4fc7f43fb939e8e5a946c7858390bbd9d3 (diff) | |
download | qtwayland-ec495c98189f1d849e793108b09b5af0ce2c8984.tar.gz |
Fix use after free in tst_WaylandClient::dontCrashOnMultipleCommitsv5.11.0-beta1
QBackingStore had a pointer to TestWindow window, but it was destroyed only
after the TestWindow was already deleted.
Change-Id: Id8fe38277cf843d532f2d8c2fdbe1f69d0309a7f
Reviewed-by: Johan Helsing <johan.helsing@qt.io>
-rw-r--r-- | tests/auto/client/client/tst_client.cpp | 26 |
1 files changed, 14 insertions, 12 deletions
diff --git a/tests/auto/client/client/tst_client.cpp b/tests/auto/client/client/tst_client.cpp index e244de7f..eb99b2e2 100644 --- a/tests/auto/client/client/tst_client.cpp +++ b/tests/auto/client/client/tst_client.cpp @@ -487,19 +487,21 @@ void tst_WaylandClient::dontCrashOnMultipleCommits() QRect rect(QPoint(), window->size()); - QBackingStore backingStore(window); - backingStore.resize(rect.size()); - backingStore.beginPaint(rect); - QPainter p(backingStore.paintDevice()); - p.fillRect(rect, Qt::magenta); - p.end(); - backingStore.endPaint(); - - backingStore.flush(rect); - backingStore.flush(rect); - backingStore.flush(rect); + { + QBackingStore backingStore(window); + backingStore.resize(rect.size()); + backingStore.beginPaint(rect); + QPainter p(backingStore.paintDevice()); + p.fillRect(rect, Qt::magenta); + p.end(); + backingStore.endPaint(); + + backingStore.flush(rect); + backingStore.flush(rect); + backingStore.flush(rect); - compositor->processWaylandEvents(); + compositor->processWaylandEvents(); + } delete window; |