The text input handler has a pointer to the currently focused widget in FlTextInputHandler::widget:
|
// The widget with input focus. |
|
GtkWidget* widget; |
That raw pointer is updated when focus moves to another view:
|
// Implements GtkWidget::key_press_event. |
|
static gboolean fl_view_focus_in_event(GtkWidget* widget, |
|
GdkEventFocus* event) { |
|
FlView* self = FL_VIEW(widget); |
|
fl_text_input_handler_set_widget( |
|
fl_engine_get_text_input_handler(self->engine), widget); |
|
return FALSE; |
|
} |
If that view's window is closed, its corresponding FlView is disposed and finalized, while the FlEngine and its FlTextInputHandler persist. Because the view's fl_view_dispose does not notify or clear the handler's dangling widget pointer, and because there is no focus_out_event override to clear it on focus loss, the raw pointer can point to freed memory:
|
static void fl_view_dispose(GObject* object) { |
|
FlView* self = FL_VIEW(object); |
|
|
|
g_cancellable_cancel(self->cancellable); |
|
|
|
g_clear_object(&self->zoom_gesture); |
|
g_clear_object(&self->rotate_gesture); |
|
if (self->engine != nullptr) { |
|
// Release the view ID from the engine. |
|
fl_engine_remove_view(self->engine, self->view_id, nullptr, nullptr, |
|
nullptr); |
|
} |
|
|
|
g_clear_object(&self->engine); |
|
g_clear_object(&self->window_state_monitor); |
|
g_clear_object(&self->scrolling_manager); |
|
g_clear_object(&self->pointer_manager); |
|
g_clear_object(&self->touch_manager); |
|
g_clear_object(&self->view_accessible); |
|
g_clear_object(&self->cancellable); |
|
|
|
G_OBJECT_CLASS(fl_view_parent_class)->dispose(object); |
|
} |
Internal bug link: b/525523757
The text input handler has a pointer to the currently focused widget in
FlTextInputHandler::widget:flutter/engine/src/flutter/shell/platform/linux/fl_text_input_handler.cc
Lines 24 to 25 in 62e0b8a
That raw pointer is updated when focus moves to another view:
flutter/engine/src/flutter/shell/platform/linux/fl_view.cc
Lines 539 to 546 in 62e0b8a
If that view's window is closed, its corresponding
FlViewis disposed and finalized, while theFlEngineand itsFlTextInputHandlerpersist. Because the view'sfl_view_disposedoes not notify or clear the handler's dangling widget pointer, and because there is nofocus_out_eventoverride to clear it on focus loss, the raw pointer can point to freed memory:flutter/engine/src/flutter/shell/platform/linux/fl_view.cc
Lines 469 to 491 in 62e0b8a
Internal bug link: b/525523757