https://bugs.kde.org/show_bug.cgi?id=418316

--- Comment #6 from Oded Arbel <o...@geek.co.il> ---
Created attachment 126603
  --> https://bugs.kde.org/attachment.cgi?id=126603&action=edit
Defensive programming patch

This looks like some kind of "use after free":
1. PlasmaQuick::Dialog registers PlasmaQuick::DialogPrivate::updateInputShape()
as the slot for QWindow::visibleChanged(bool).
2. QWindow d'tor calls QWindowPrivate::setVisible(false) (through
QWindowPrivate::destroy()), which will in turn signal
QWindow::visibleChanged(bool).
3. PlasmaQuick::DialogPrivate::updateInputShape() gets called after
PlasmaQuick::Dialog had already run and released the DialogPrivate reference
(and apparently zeroed it out?) and calls back into
PlasmaQuick::Dialog::isVisible()
4. When isVisible() tries to access DialogPrivate back, the pointer is already
zero and we get SIGSEGVED

The attached defensive patch works around the problem for me (a bit - I did get
one crash after it, but I didn't get a stack trace - so it may not be the
same).

This is obviously not the correct approach. Maybe unregister from the signals
during d'tor?

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to