From 62b5dfcd574fae67852a9dbd0754b13317bfc17c Mon Sep 17 00:00:00 2001 From: WindSnowLi <61129607+WindSnowLi@users.noreply.github.com> Date: Tue, 4 Aug 2026 16:20:16 +0800 Subject: [PATCH] fix use-after-free in updateTabs queued call The tab may be destroyed with the layout before the queued ensureWidgetVisible runs; guard it with QPointer and skip if gone. --- src/DockAreaTabBar.cpp | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/DockAreaTabBar.cpp b/src/DockAreaTabBar.cpp index 8de254c40..ee5999a1a 100644 --- a/src/DockAreaTabBar.cpp +++ b/src/DockAreaTabBar.cpp @@ -37,6 +37,7 @@ #include #include #include +#include #include "FloatingDockContainer.h" #include "DockAreaWidget.h" @@ -111,9 +112,11 @@ void DockAreaTabBarPrivate::updateTabs() // Sometimes the synchronous calculation of the rectangular area fails // Therefore we use QTimer::singleShot here to execute the call // within the event loop - see #520 - QTimer::singleShot(0, _this, [&, TabWidget] - { - _this->ensureWidgetVisible(TabWidget); + // The tab may be destroyed with the layout before this queued call runs. + QTimer::singleShot(0, _this, [this, TabWidget = QPointer(TabWidget)] { + if (TabWidget) { + _this->ensureWidgetVisible(TabWidget); + } }); } else