[krfb] [Bug 521894] Crash in MainWindow::aboutConnectionAddress when closing address details window

https://bugs.kde.org/show_bug.cgi?id=521894

--- Comment #2 from Wehrwolfmann <[email protected]> ---
This is the same crash as bug 523039, which is filed against plasma-integration
rather than krfb. Nothing here is krfb-specific: any Qt application on Plasma
>= 6.7 that shows a message box and then destroys it while the native helper is
still visible runs into it.

KDEPlatformMessageDialogHelper creates its own QMessageBox and gives it
Qt::WA_DeleteOnClose, so the box deletes itself as soon as it is closed while
the helper stays alive. m_box is a raw pointer and hide() dereferences it
without a check:

    void KDEPlatformMessageDialogHelper::hide() { m_box->hide(); }

Qt calls hide() from QDialogPrivate::setNativeDialogVisible(false) while the
application's dialog is being torn down, which is the path in the backtrace
above (QDialog::~QDialog -> QMessageBox::~QMessageBox -> QWidget::hide), so the
call goes through freed memory. That also explains why closing with the window
decoration button crashes while pressing OK does not: the two paths differ in
whether the helper's box is destroyed before or after the application's dialog.

It reproduces without any clicking: show a QMessageBox with open(), close the
box the helper created, then destroy the application's dialog. On Plasma 6.7,
Qt 6.11, Wayland that segfaults on the first run.

plasma-integration merge request 238 has had a fix pending since 14 July — it
drops WA_DeleteOnClose and lets the helper own the box. Until that lands,
applications can avoid the helper entirely by setting
QMessageBox::Option::DontUseNativeDialog on their message boxes.

-- 
You are receiving this mail because:
You are watching all bug changes.