GUI: Delay deletion of child widgets when rebuilding launcher and options dialog

This is to avoid writing in deleted memory in the ButtonWidget::sendCommand
when the sent command results in the parent dialog being rebuilt.

2 files changed, 8 insertions, 2 deletions

diff --git a/gui/launcher.cpp b/gui/launcher.cpp
index f96dd17d46..f60fecf509 100644
--- a/gui/launcher.cpp
+++ b/gui/launcher.cpp
@@ -204,7 +204,10 @@ void LauncherDialog::clean() {
 	while (_firstWidget) {
 		Widget* w = _firstWidget;
 		removeWidget(w);
-		delete w;
+		// This is called from rebuild() which may result from handleCommand being called by
+		// a child widget sendCommand call. In such a case sendCommand is still being executed
+		// so we should not delete yet the child widget. Thus delay the deletion.
+		g_gui.addToTrash(w, this);
 	}
 	delete _browser;
 	delete _loadDialog;
diff --git a/gui/options.cpp b/gui/options.cpp
index 7a22a9ba3f..179fa65991 100644
--- a/gui/options.cpp
+++ b/gui/options.cpp
@@ -423,7 +423,10 @@ void OptionsDialog::clean() {
 	while (_firstWidget) {
 		Widget* w = _firstWidget;
 		removeWidget(w);
-		delete w;
+		// This is called from rebuild() which may result from handleCommand being called by
+		// a child widget sendCommand call. In such a case sendCommand is still being executed
+		// so we should not delete yet the child widget. Thus delay the deletion.
+		g_gui.addToTrash(w, this);
 	}
 	init();
 }