From f6a183bf26a07dc00c98bc0cee2577bf650578d1 Mon Sep 17 00:00:00 2001 From: xiepengfei Date: Fri, 9 Oct 2026 12:17:25 +0800 Subject: [PATCH] fix: fix crash on close after editing text in zip archive MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. Root cause: ~EditWrapper() destructor deleted m_pTextEdit before m_pWaringNotices, leaving DMessageManager with a dangling pointer to the already-freed m_pTextEdit (use-after-free, CWE-416) 2. Fix: move m_pWaringNotices cleanup before m_pTextEdit deletion so DMessageManager processes message removal while m_pTextEdit is still valid; also un-comment and restore the previously disabled m_pWaringNotices cleanup block (was commented out for bug 78042) 3. Impact: destructor cleanup order change only; no behavior change for normal edit/close workflows Log: Fix crash when closing text editor after editing a file in a zip archive Influence: 1. Test opening a text file from a zip archive, editing and saving, then closing the tab - verify no crash 2. Test file reload notification dialog appears and dismisses correctly 3. Verify normal file open/edit/close workflow has no regression fix: 修复压缩包中编辑文本文档关闭后崩溃问题 1. 根因：~EditWrapper() 析构函数中 m_pTextEdit 的 delete 早于 m_pWaringNotices，导致 DMessageManager 持有已释放的 m_pTextEdit 悬空指针，触发 use-after-free 崩溃（CWE-416） 2. 方案：将 m_pWaringNotices 的清理移至 m_pTextEdit 删除之前，使 DMessageManager 处理消息移除时 m_pTextEdit 仍然有效；同时恢复 此前因 bug 78042 被注释掉的 m_pWaringNotices 清理代码块 3. 影响：仅调整析构函数清理顺序，对正常编辑/关闭流程无行为变化 Log: 修复压缩包中打开文本文档编辑保存后关闭时文本编辑器崩溃的问题 Influence: 1. 测试从 zip 压缩包中打开文本文档，编辑保存后关闭标签页，验证不崩溃 2. 测试文件变更重载提示弹框正常显示和关闭 3. 验证正常文件打开/编辑/关闭流程无回归 PMS: BUG-378881 --- src/editor/editwrapper.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/src/editor/editwrapper.cpp b/src/editor/editwrapper.cpp index f406deb9..e511ab1e 100644 --- a/src/editor/editwrapper.cpp +++ b/src/editor/editwrapper.cpp @@ -195,6 +195,16 @@ EditWrapper::EditWrapper(Window *window, QWidget *parent) EditWrapper::~EditWrapper() { qDebug() << "EditWrapper destructor"; + // 必须在 delete m_pTextEdit 之前清理 m_pWaringNotices，避免 DMessageManager + // 持有 m_pTextEdit 悬空指针导致 use-after-free（bug 378881）。 + // 此前 bug 78042 的崩溃根因是 delete m_pWaringNotices 位于 m_pTextEdit 之后， + // DMessageManager 在处理消息移除时访问已释放的 m_pTextEdit；将删除顺序 + // 调整为先 m_pWaringNotices 后 m_pTextEdit 即可同时避免两个问题。 + if (m_pWaringNotices != nullptr) { + disconnect(m_pWaringNotices); + delete m_pWaringNotices; + m_pWaringNotices = nullptr; + } if (m_pTextEdit != nullptr) { qDebug() << "EditWrapper destructor, m_pTextEdit not nullptr"; disconnect(m_pTextEdit); @@ -207,12 +217,6 @@ EditWrapper::~EditWrapper() delete m_pBottomBar; m_pBottomBar = nullptr; } - //delete 之后，如果出现文件被修改，需要重新加载弹框，之后，点击标签关闭，闪退问题　78042 ut002764 -// if (m_pWaringNotices != nullptr) { -// disconnect(m_pWaringNotices); -// delete m_pWaringNotices; -// m_pWaringNotices = nullptr; -// } qDebug() << "EditWrapper destructor exit"; }