Project

General

Profile

Actions

Bug #11890

closed

Accessing destructed object when Wt::WPopupWidget is deleted inside hidden handler

Added by Dries Mys over 1 year ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Target version:
Start date:
08/18/2023
Due date:
% Done:

100%

Estimated time:

Description

According to the Wt::WPopupWidget documentation, a Wt::WPopupWidget may be destructed inside the event handler connected to the Wt::WPopupWidget::hidden signal:

popupWidget_->hidden().connect([this](){ popupWidget_.reset(); });

However Wt still tries to access the (deleted) WPopupWidget after the hidden signal is emitted inside WPopupWidget::setHidden.

Minimal example

std::unique_ptr<Wt::WPopupWidget> popup = std::make_unique<Wt::WPopupWidget>(std::make_unique<Wt::WContainerWidget>());
popup->hidden().connect([&popup](){
    popup.reset(); 
});
popup->show();
popup->hide();

Side note

The documentation of the Wt::WPopupWidget::hidden and Wt::WPopupWidget::show aren't consistent with the implementation. Those signals are also called when show/hide/setHidden is called programmatically.

Actions #1

Updated by Matthias Van Ceulebroeck about 1 year ago

  • Status changed from New to InProgress
  • Assignee set to Matthias Van Ceulebroeck
  • Target version set to 4.10.2

Hi Dries,

there indeed is a use-after-free issue here. Where the hidden().emit() happens, but after it, the WPopupWidget::setHidden() still uses the implementation.

Actions #2

Updated by Matthias Van Ceulebroeck about 1 year ago

  • Status changed from InProgress to Review
  • Assignee deleted (Matthias Van Ceulebroeck)
Actions #3

Updated by Korneel Dumon about 1 year ago

  • Status changed from Review to Implemented @Emweb
  • Assignee set to Matthias Van Ceulebroeck
Actions #4

Updated by Korneel Dumon about 1 year ago

  • Status changed from Implemented @Emweb to InProgress
Actions #5

Updated by Korneel Dumon about 1 year ago

  • Status changed from InProgress to Review
  • Assignee changed from Matthias Van Ceulebroeck to Korneel Dumon
Actions #6

Updated by Korneel Dumon about 1 year ago

  • Status changed from Review to Resolved
  • Assignee changed from Korneel Dumon to Matthias Van Ceulebroeck
Actions #7

Updated by Matthias Van Ceulebroeck about 1 year ago

  • Status changed from Resolved to Implemented @Emweb
  • % Done changed from 0 to 100
Actions #8

Updated by Matthias Van Ceulebroeck about 1 year ago

  • Status changed from Implemented @Emweb to Closed
Actions

Also available in: Atom PDF