Fix a race condition when the main window is being destructed.

During the destructor of QWidget, we delete the
layout. If the layout is not set to 0 afterwards,
a check on the layout might turn true, but any access
will end with a segfault.

Reviewed-by: João Abecasis
(cherry picked from commit abc5a632942c23496d75c49b3b0b4a674cdafdf8)

diff --git a/src/gui/kernel/qwidget.cpp b/src/gui/kernel/qwidget.cpp
index 5705214..758ccce 100644 (file)
--- a/src/gui/kernel/qwidget.cpp
+++ b/src/gui/kernel/qwidget.cpp
@@ -1588,6 +1588,7 @@ QWidget::~QWidget()
 
     // delete layout while we still are a valid widget
     delete d->layout;
+    d->layout = 0;
     // Remove myself from focus list
 
     Q_ASSERT(d->focus_next->d_func()->focus_prev == this);

diff --git a/src/gui/painting/qunifiedtoolbarsurface_mac.cpp b/src/gui/painting/qunifiedtoolbarsurface_mac.cpp
index 3876c3d..2fda6b9 100644 (file)
--- a/src/gui/painting/qunifiedtoolbarsurface_mac.cpp
+++ b/src/gui/painting/qunifiedtoolbarsurface_mac.cpp
@@ -152,7 +152,8 @@ void QUnifiedToolbarSurface::beginPaint(const QRegion &rgn)
 void QUnifiedToolbarSurface::updateToolbarOffset(QWidget *widget)
 {
     QMainWindowLayout *mlayout = qobject_cast<QMainWindowLayout*> (widget->window()->layout());
-    mlayout->updateUnifiedToolbarOffset();
+    if (mlayout)
+        mlayout->updateUnifiedToolbarOffset();
 }
 
 void QUnifiedToolbarSurface::flush(QWidget *widget, const QRegion &region, const QPoint &offset)