Details
-
Bug
-
Resolution: Done
-
P2: Important
-
5.15.2
-
None
-
-
735164b5c2a2637a8d53a8803a2401e4ef477ff0
Description
In autogenerated code, I see next implementation:
qwayland-server-wayland.cpp:
void wl_region::destroy_func(struct ::wl_resource *client_resource) { Resource *resource = Resource::fromResource(client_resource); Q_ASSERT(resource); wl_region *that = resource->region_object; if (Q_LIKELY(that)) { that->m_resource_map.remove(resource->client(), resource); that->region_destroy_resource(resource); if (that->m_resource == resource)\n"); that->m_resource = nullptr;\n"); } delete resource; }
this->region_destroy_resource(resource) is defined in
qtwayland/src/compositor/wayland_wrapper/qwlregion.cpp:
void Region::region_destroy_resource(Resource *)
{
delete this;
}
The problem is in access to
that->m_resource
Actually after call region_destroy_resource(), this is access to released memory.