Prevent crashes caused by nested event loops run when renaming inline

When renaming inline and starting a drag or invoking the context menu,
a nested event loop will be run. If the role editor loses focus and
emits roleEditingFinished(), we must prevent that deleteLater() is
called because this would delete the role editor inside a nested event
loop which is run from one of its own functions. We would get a crash
when returning from that event loop otherwise.

BUG: 308018
BUG: 309421
FIXED-IN: 4.9.4

1 files changed, 47 insertions, 2 deletions

diff --git a/src/kitemviews/private/kitemlistroleeditor.cpp b/src/kitemviews/private/kitemlistroleeditor.cpp
index 1e4b5fd4e..ead5b298e 100644
--- a/src/kitemviews/private/kitemlistroleeditor.cpp
+++ b/src/kitemviews/private/kitemlistroleeditor.cpp
@@ -26,7 +26,9 @@ KItemListRoleEditor::KItemListRoleEditor(QWidget *parent) :
     KTextEdit(parent),
     m_index(0),
     m_role(),
-    m_blockFinishedSignal(false)
+    m_blockFinishedSignal(false),
+    m_eventHandlingLevel(0),
+    m_deleteAfterEventHandling(false)
 {
     setHorizontalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
     setVerticalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
@@ -64,6 +66,20 @@ QByteArray KItemListRoleEditor::role() const
     return m_role;
 }
 
+void KItemListRoleEditor::deleteWhenIdle()
+{
+    if (m_eventHandlingLevel > 0) {
+        // We are handling an event at the moment. It could be that we
+        // are in a nested event loop run by contextMenuEvent() or a
+        // call of mousePressEvent() which results in drag&drop.
+        // -> do not call deleteLater() to prevent a crash when we
+        //    return from the nested event loop.
+        m_deleteAfterEventHandling = true;
+    } else {
+        deleteLater();
+    }
+}
+
 bool KItemListRoleEditor::eventFilter(QObject* watched, QEvent* event)
 {
     if (watched == parentWidget() && event->type() == QEvent::Resize) {
@@ -75,13 +91,42 @@ bool KItemListRoleEditor::eventFilter(QObject* watched, QEvent* event)
 
 bool KItemListRoleEditor::event(QEvent* event)
 {
+    ++m_eventHandlingLevel;
+
     if (event->type() == QEvent::FocusOut) {
         QFocusEvent* focusEvent = static_cast<QFocusEvent*>(event);
         if (focusEvent->reason() != Qt::PopupFocusReason) {
             emitRoleEditingFinished();
         }
     }
-    return KTextEdit::event(event);
+
+    const int result = KTextEdit::event(event);
+    --m_eventHandlingLevel;
+
+    if (m_deleteAfterEventHandling && m_eventHandlingLevel == 0) {
+        // Schedule this object for deletion and make sure that we do not try
+        // to deleteLater() again when the DeferredDelete event is received.
+        deleteLater();
+        m_deleteAfterEventHandling = false;
+    }
+
+    return result;
+}
+
+bool KItemListRoleEditor::viewportEvent(QEvent* event)
+{
+    ++m_eventHandlingLevel;
+    const bool result = KTextEdit::viewportEvent(event);
+    --m_eventHandlingLevel;
+
+    if (m_deleteAfterEventHandling && m_eventHandlingLevel == 0) {
+        // Schedule this object for deletion and make sure that we do not try
+        // to deleteLater() again when the DeferredDelete event is received.
+        deleteLater();
+        m_deleteAfterEventHandling = false;
+    }
+
+    return result;
 }
 
 void KItemListRoleEditor::keyPressEvent(QKeyEvent* event)