C++: Fix crash after triggering completion and closing editor

Fix use-after-free for the following case:
  1. Open an editor
  2. Trigger a long processing completion
     (e.g. simulate with QThread::msleep in
      CppCompletionAssistInterface::getCppSpecifics)
  3. ...and immediately close the editor (e.g. with Ctrl+W)
  4. Wait until it crashes.

The completion thread relied on the BuiltinEditorDocumentParser object,
which is deleted once the editor is closed. Fixed by sharing the
ownership of that object between the *EditorDocumentProcessor and the
completion assist interface.

This case came up when doing tests for the bug report below.

Task-number: QTCREATORBUG-14991
Change-Id: I0b009229e68fc6b7838740858cdc41a32403fe6f
Reviewed-by: David Schulz <david.schulz@theqtcompany.com>
This commit is contained in:
Nikolai Kosjar
2015-09-01 17:34:07 +02:00
parent c504e56d0c
commit 169556db2f
17 changed files with 49 additions and 50 deletions

View File

@@ -89,7 +89,6 @@ public:
virtual bool eventFilter(QObject *o, QEvent *e);
private:
void finalizeRequest();
void proposalComputed();
void processProposalItem(AssistProposalItem *proposalItem);
void handlePrefixExpansion(const QString &newPrefix);
@@ -251,7 +250,7 @@ void CodeAssistantPrivate::requestProposal(AssistReason reason,
connect(m_requestRunner, &ProcessorRunner::finished,
this, &CodeAssistantPrivate::proposalComputed);
connect(m_requestRunner, &ProcessorRunner::finished,
this, &CodeAssistantPrivate::finalizeRequest);
m_requestRunner, &QObject::deleteLater);
connect(m_requestRunner, &ProcessorRunner::finished,
q, &CodeAssistant::finished);
assistInterface->prepareForAsyncUse();
@@ -383,12 +382,6 @@ void CodeAssistantPrivate::handlePrefixExpansion(const QString &newPrefix)
notifyChange();
}
void CodeAssistantPrivate::finalizeRequest()
{
if (ProcessorRunner *runner = qobject_cast<ProcessorRunner *>(sender()))
delete runner;
}
void CodeAssistantPrivate::finalizeProposal()
{
stopAutomaticProposalTimer();