[scintilla:bugs] #2495 Segfault when destroying ScintillaDocument [Qt]

[Stefan Löffler]

---

[bugs:#2495] Segfault when destroying ScintillaDocument [Qt]

Status: open
Group: Bug
Created: Sun Dec 28, 2025 10:47 AM UTC by Stefan Löffler
Last Updated: Sun Dec 28, 2025 10:47 AM UTC
Owner: nobody
Attachments:

• ScintillaDocument.patch (605 Bytes; text/x-patch)

The following test program seg-faults (GCC 15.2.0 on Ubuntu 25.10) when the ScintillaDocument is destroyed:

#include <ScintillaDocument.h>
#include <ScintillaEdit.h>
#include <QApplication>
int main(int argc, char * argv[])
{
    QApplication app(argc, argv);
    ScintillaEdit edit;
    ScintillaDocument doc;
    edit.set_doc(&doc);
    return 0;
}

Analysis: ScintillaDocument::ScintillaDocument calls Document::AddWatcher with a second argument of type IDocumentEditable *. However, ScintillaDocument::~ScintillaDocument calls Document::RemoveWatcher with second argument of type Document*. The two are related, of course (Document derives from IDocumentEditable), but the pointers differ due to different vtables. Thus, Document::RemoveWatcher fails to remove the watcher, subsequently resulting in the segfault when ~Document tries to notify the (not properly removed) watcher.

Attached is a patch that fixes the issue by using the Document* also in ScintillaDocument::ScintillaDocument

---

Sent from sourceforge.net because scintill...@googlegroups.com is subscribed to https://sourceforge.net/p/scintilla/bugs/

To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/scintilla/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.

[Neil Hodgson]

• labels: --> scintilla, Qt
• status: open --> open-fixed
• Comment:

Committed as [04be64].

---

[bugs:#2495] Segfault when destroying ScintillaDocument [Qt]

Status: open-fixed
Group: Bug
Labels: scintilla Qt