whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QVector: fix crash on reserve(0) 

It crashed when d was equal to Data::unsharableEmpty().

Task-number: QTBUG-51758
Change-Id: If9f2a7d11892507135f4dc0aeef909f59b7478fc
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
Reviewed-by: Jędrzej Nowacki <jedrzej.nowacki@theqtcompany.com>
bb10
David Faure 2016-07-26 10:07:57 +02:00 committed by Marc Mutz
parent ebb651aa73
commit f5af4428c3
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/corelib/tools/qvector.h
View File

@ -391,7 +391,11 @@ void QVector<T>::reserve(int asize)
{
if (asize > int(d->alloc))
reallocData(d->size, asize);
if (isDetached())
if (isDetached()
#if !defined(QT_NO_UNSHARABLE_CONTAINERS)
&& d != Data::unsharableEmpty()
#endif
)
d->capacityReserved = 1;
Q_ASSERT(capacity() >= asize);
}

22
tests/auto/corelib/tools/qvector/tst_qvector.cpp
View File

@ -276,6 +276,7 @@ private slots:
void testOperators() const;
void reserve();
void reserveZero();
void reallocAfterCopy_data();
void reallocAfterCopy();
void initializeListInt();
@ -2369,13 +2370,34 @@ void tst_QVector::reserve()
{
QVector<Foo> a;
a.resize(2);
QCOMPARE(fooCtor, 2);
QVector<Foo> b(a);
b.reserve(1);
QCOMPARE(b.size(), a.size());
QCOMPARE(fooDtor, 0);
}
QCOMPARE(fooCtor, fooDtor);
}
// This is a regression test for QTBUG-51758
void tst_QVector::reserveZero()
{
QVector<int> vec;
vec.detach();
vec.reserve(0); // should not crash
QCOMPARE(vec.size(), 0);
QCOMPARE(vec.capacity(), 0);
vec.squeeze();
QCOMPARE(vec.size(), 0);
QCOMPARE(vec.capacity(), 0);
vec.reserve(-1);
QCOMPARE(vec.size(), 0);
QCOMPARE(vec.capacity(), 0);
vec.append(42);
QCOMPARE(vec.size(), 1);
QVERIFY(vec.capacity() >= 1);
}
// This is a regression test for QTBUG-11763, where memory would be reallocated
// soon after copying a QVector.
void tst_QVector::reallocAfterCopy_data()