From 957183ef476f18d972450603c994cea2016bdc07 Mon Sep 17 00:00:00 2001
From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Sun, 5 Jul 2020 23:19:36 +0200
Subject: [PATCH] Associate the window with the sizer in wxSizer::Replace()

If wxSizerItem passed to Replace() contains a window, the window must be
associated with the sizer to ensure that it is uncoupled from it when it
is destroyed.

Add a simple test which resulted in a use-after-free before but passes
now.
---
 src/common/sizer.cpp      | 3 +++
 tests/sizers/boxsizer.cpp | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/src/common/sizer.cpp b/src/common/sizer.cpp
index e1fbee369a..a0b1768ea1 100644
--- a/src/common/sizer.cpp
+++ b/src/common/sizer.cpp
@@ -883,6 +883,9 @@ bool wxSizer::Replace( size_t old, wxSizerItem *newitem )
 
     delete item;
 
+    if (wxWindow* const w = newitem->GetWindow())
+        w->SetContainingSizer(this);
+
     return true;
 }
 
diff --git a/tests/sizers/boxsizer.cpp b/tests/sizers/boxsizer.cpp
index 3bf4d6aba9..69d271b724 100644
--- a/tests/sizers/boxsizer.cpp
+++ b/tests/sizers/boxsizer.cpp
@@ -444,3 +444,9 @@ TEST_CASE_METHOD(BoxSizerTestCase, "BoxSizer::IncompatibleFlags", "[sizer]")
 #undef ASSERT_SIZER_INCOMPATIBLE_FLAGS
 #undef ASSERT_SIZER_INVALID_FLAGS
 }
+
+TEST_CASE_METHOD(BoxSizerTestCase, "BoxSizer::Replace", "[sizer]")
+{
+    m_sizer->AddSpacer(1);
+    m_sizer->Replace(0, new wxSizerItem(new wxWindow(m_win, wxID_ANY)));
+}