Actions
Bug #11890
closedAccessing destructed object when Wt::WPopupWidget is deleted inside hidden handler
Start date:
08/18/2023
Due date:
% Done:
100%
Estimated time:
Description
According to the Wt::WPopupWidget
documentation, a Wt::WPopupWidget
may be destructed inside the event handler connected to the Wt::WPopupWidget::hidden
signal:
popupWidget_->hidden().connect([this](){ popupWidget_.reset(); });
However Wt still tries to access the (deleted) WPopupWidget
after the hidden
signal is emitted inside WPopupWidget::setHidden
.
Minimal example
std::unique_ptr<Wt::WPopupWidget> popup = std::make_unique<Wt::WPopupWidget>(std::make_unique<Wt::WContainerWidget>());
popup->hidden().connect([&popup](){
popup.reset();
});
popup->show();
popup->hide();
Side note
The documentation of the Wt::WPopupWidget::hidden
and Wt::WPopupWidget::show
aren't consistent with the implementation. Those signals are also called when show/hide/setHidden is called programmatically.
Updated by Matthias Van Ceulebroeck about 1 year ago
- Status changed from New to InProgress
- Assignee set to Matthias Van Ceulebroeck
- Target version set to 4.10.2
Hi Dries,
there indeed is a use-after-free issue here. Where the hidden().emit()
happens, but after it, the WPopupWidget::setHidden()
still uses the implementation.
Updated by Matthias Van Ceulebroeck about 1 year ago
- Status changed from InProgress to Review
- Assignee deleted (
Matthias Van Ceulebroeck)
Updated by Korneel Dumon about 1 year ago
- Status changed from Review to Implemented @Emweb
- Assignee set to Matthias Van Ceulebroeck
Updated by Korneel Dumon about 1 year ago
- Status changed from Implemented @Emweb to InProgress
Updated by Korneel Dumon about 1 year ago
- Status changed from InProgress to Review
- Assignee changed from Matthias Van Ceulebroeck to Korneel Dumon
Updated by Korneel Dumon about 1 year ago
- Status changed from Review to Resolved
- Assignee changed from Korneel Dumon to Matthias Van Ceulebroeck
Updated by Matthias Van Ceulebroeck about 1 year ago
- Status changed from Resolved to Implemented @Emweb
- % Done changed from 0 to 100
Updated by Matthias Van Ceulebroeck about 1 year ago
- Status changed from Implemented @Emweb to Closed
Actions