From d9d1917785e60274d97f54a1aa95d874982a115b Mon Sep 17 00:00:00 2001 From: Vadim Zeitlin Date: Mon, 12 Oct 2015 01:00:59 +0200 Subject: [PATCH] Fix crash when deleting items in wxTreeListCtrl An invalid pointer was dereferenced after being deleted as ToDVI(item) checked the item parent, i.e. used it, even though the item was already invalid. Closes #17198. --- docs/changes.txt | 1 + src/generic/treelist.cpp | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/changes.txt b/docs/changes.txt index ed5591ac83..aadd29d3a4 100644 --- a/docs/changes.txt +++ b/docs/changes.txt @@ -589,6 +589,7 @@ Unix: All (GUI): - Fix hang when deleting columns from wxTreeListCtrl. +- Fix crash when deleting items from wxTreeListCtrl (Rexxar). - Allow requesting modern (3.x+) OpenGL version in wxGLCanvas (Fabio Arnold). - Allow using Ctrl-dragging to add to selection in wxGrid (Knut Petter Lehre). - Fix several floating point rounding bugs in wxPropertyGrid (Artur Wieczorek). diff --git a/src/generic/treelist.cpp b/src/generic/treelist.cpp index 6c0e1e4d7c..663a17f2dc 100644 --- a/src/generic/treelist.cpp +++ b/src/generic/treelist.cpp @@ -743,7 +743,10 @@ void wxTreeListModel::DeleteItem(Node* item) previous->DeleteNext(); } - ItemDeleted(ToDVI(parent), ToDVI(item)); + // Note that the item is already deleted by now, so we can't use it in any + // way, e.g. by calling ToDVI(item) which does dereference the pointer, but + // ToNonRootDVI() that we use here does not. + ItemDeleted(ToDVI(parent), ToNonRootDVI(item)); } void wxTreeListModel::DeleteAllItems()