Fixed crash on destruction of animating QDockWidget in a QMainWindow

It doesn't make sense to hold an unguarded pointer to a
QPropertyAnimation while assigning ownership of that animation to the
animated widget.

Destruction of the widget while the animation is in progress causes
the animation pointer to become dangling; then the widget is removed
from the containing QMainWindowLayout, which attempts to abort the
animation, dereferencing the invalid pointer.

The crash can be reproduced sometimes with
tst_QDockWidget::taskQTBUG_2940_resizeAfterUndocking (which is in
Qt4 only).

Change-Id: I758bf7193b2ea39cd4d8e87197d8ff957d3368eb
Reviewed-by: Robin Burchell <robin+qt@viroteck.net>
Reviewed-by: Andy Shaw <andy.shaw@digia.com>

2 files changed, 5 insertions, 2 deletions

diff --git a/src/widgets/widgets/qwidgetanimator.cpp b/src/widgets/widgets/qwidgetanimator.cpp
index edd9d63081..aef967bd65 100644
--- a/src/widgets/widgets/qwidgetanimator.cpp
+++ b/src/widgets/widgets/qwidgetanimator.cpp
@@ -59,7 +59,9 @@ void QWidgetAnimator::abort(QWidget *w)
         return;
     QPropertyAnimation *anim = *it;
     m_animation_map.erase(it);
-    anim->stop();
+    if (anim) {
+        anim->stop();
+    }
 #ifndef QT_NO_MAINWINDOW
     m_mainWindowLayout->animationFinished(w);
 #endif
diff --git a/src/widgets/widgets/qwidgetanimator_p.h b/src/widgets/widgets/qwidgetanimator_p.h
index 5649488c13..98963ce0bc 100644
--- a/src/widgets/widgets/qwidgetanimator_p.h
+++ b/src/widgets/widgets/qwidgetanimator_p.h
@@ -55,6 +55,7 @@
 
 #include <qobject.h>
 #include <qhash.h>
+#include <qpointer.h>
 
 QT_BEGIN_NAMESPACE
 
@@ -79,7 +80,7 @@ private Q_SLOTS:
 #endif
 
 private:
-    typedef QHash<QWidget*, QPropertyAnimation*> AnimationMap;
+    typedef QHash<QWidget*, QPointer<QPropertyAnimation> > AnimationMap;
     AnimationMap m_animation_map;
     QMainWindowLayout *m_mainWindowLayout;
 };