Prevent crashes caused by nested event loops run when renaming inline

When renaming inline and starting a drag or invoking the context menu,
a nested event loop will be run. If the role editor loses focus and
emits roleEditingFinished(), we must prevent that deleteLater() is
called because this would delete the role editor inside a nested event
loop which is run from one of its own functions. We would get a crash
when returning from that event loop otherwise.

BUG: 308018
BUG: 309421
FIXED-IN: 4.9.4

1 files changed, 9 insertions, 2 deletions

diff --git a/src/kitemviews/kstandarditemlistwidget.cpp b/src/kitemviews/kstandarditemlistwidget.cpp
index bdc2859c0..f92cab50f 100644
--- a/src/kitemviews/kstandarditemlistwidget.cpp
+++ b/src/kitemviews/kstandarditemlistwidget.cpp
@@ -609,7 +609,10 @@ void KStandardItemListWidget::editedRoleChanged(const QByteArray& current, const
                        this, SLOT(slotRoleEditingCanceled(int,QByteArray,QVariant)));
             disconnect(m_roleEditor, SIGNAL(roleEditingFinished(int,QByteArray,QVariant)),
                        this, SLOT(slotRoleEditingFinished(int,QByteArray,QVariant)));
-            m_roleEditor->deleteLater();
+            // Do not delete the role editor using deleteLater() because we might be
+            // inside a nested event loop which has been started by one of its event
+            // handlers (contextMenuEvent() or drag&drop inside mouseMoveEvent()).
+            m_roleEditor->deleteWhenIdle();
             m_roleEditor = 0;
         }
         return;
@@ -1274,7 +1277,11 @@ void KStandardItemListWidget::closeRoleEditor()
                this, SLOT(slotRoleEditingCanceled(int,QByteArray,QVariant)));
     disconnect(m_roleEditor, SIGNAL(roleEditingFinished(int,QByteArray,QVariant)),
                this, SLOT(slotRoleEditingFinished(int,QByteArray,QVariant)));
-    m_roleEditor->deleteLater();
+
+    // Do not delete the role editor using deleteLater() because we might be
+    // inside a nested event loop which has been started by one of its event
+    // handlers (contextMenuEvent() or drag&drop inside mouseMoveEvent()).
+    m_roleEditor->deleteWhenIdle();
     m_roleEditor = 0;
 }