Explorar o código

LibGUI: Fix crash in GML Playground auto-completing SpinBox props

Crash was caused by deferred invocation of a lambda on the SpinBox's
TextEditor widget's on_change. The lambda referenced the SpinBox ptr,
but in GML Playground the SpinBox was free'd before the deferred
lambda could run, causing a use-after-free error. Fixed by using
a weak ptr to detect if the SpinBox was free'd.
Andrew Smith %!s(int64=3) %!d(string=hai) anos
pai
achega
31a2ac94c7
Modificáronse 1 ficheiros con 4 adicións e 1 borrados
  1. 4 1
      Userland/Libraries/LibGUI/SpinBox.cpp

+ 4 - 1
Userland/Libraries/LibGUI/SpinBox.cpp

@@ -18,7 +18,10 @@ SpinBox::SpinBox()
     set_fixed_height(22);
     set_fixed_height(22);
     m_editor = add<TextBox>();
     m_editor = add<TextBox>();
     m_editor->set_text("0");
     m_editor->set_text("0");
-    m_editor->on_change = [this] {
+    m_editor->on_change = [this, weak_this = make_weak_ptr()] {
+        if (!weak_this)
+            return;
+
         auto value = m_editor->text().to_uint();
         auto value = m_editor->text().to_uint();
         if (value.has_value())
         if (value.has_value())
             set_value(value.value());
             set_value(value.value());