Prevent crashes caused by nested event loops run when renaming inline

When renaming inline and starting a drag or invoking the context menu,
a nested event loop will be run. If the role editor loses focus and
emits roleEditingFinished(), we must prevent that deleteLater() is
called because this would delete the role editor inside a nested event
loop which is run from one of its own functions. We would get a crash
when returning from that event loop otherwise.

BUG: 308018
BUG: 309421
FIXED-IN: 4.9.4

1 files changed, 12 insertions, 0 deletions

diff --git a/src/kitemviews/private/kitemlistroleeditor.h b/src/kitemviews/private/kitemlistroleeditor.h
index aa2c97754..a2f705808 100644
--- a/src/kitemviews/private/kitemlistroleeditor.h
+++ b/src/kitemviews/private/kitemlistroleeditor.h
@@ -47,6 +47,15 @@ public:
     void setRole(const QByteArray& role);
     QByteArray role() const;
 
+    /**
+     * Calls deleteLater() if no event is being handled at the moment.
+     * Otherwise, the deletion is deferred until the event handling is
+     * finished. This prevents that the deletion happens inside a nested
+     * event loop which might be run in contextMenuEvent() or
+     * mouseMoveEvent() because this would probably cause a crash.
+     */
+    void deleteWhenIdle();
+
     virtual bool eventFilter(QObject* watched, QEvent* event);
 
 signals:
@@ -55,6 +64,7 @@ signals:
 
 protected:
     virtual bool event(QEvent* event);
+    virtual bool viewportEvent(QEvent* event);
     virtual void keyPressEvent(QKeyEvent* event);
 
 private slots:
@@ -75,6 +85,8 @@ private:
     int m_index;
     QByteArray m_role;
     bool m_blockFinishedSignal;
+    int m_eventHandlingLevel;
+    bool m_deleteAfterEventHandling;
 };
 
 #endif