QStateMachine: replace a QHash key involving a QPointer

Using QPointers (or any type that makes a QPointer part of its identity) as a key
in any associative container is wrong. They get externally set to nullptr,
violating the associative container's class invariants, which could lead to
data corruption, even though bucket-based hash implementations are less susceptible
than binary trees.

To fix, write a new class that acts much like the old QPair<QPointer<>,QByteArray>,
but uses the QPointer only as a guard, not as part of its identity. To preseve
identity, also saves the naked pointer originally passed and uses that for op==
and qHash().

Change-Id: I4fa5a6bf86bad8fe7f5abe53d7c7f3ad3754d8d6
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>

1 files changed, 4 insertions, 3 deletions

diff --git a/src/corelib/statemachine/qstatemachine.cpp b/src/corelib/statemachine/qstatemachine.cpp
index 27c7b077c6..fa5e49c882 100644
--- a/src/corelib/statemachine/qstatemachine.cpp
+++ b/src/corelib/statemachine/qstatemachine.cpp
@@ -947,14 +947,15 @@ QList<QPropertyAssignment> QStateMachinePrivate::restorablesToPropertyList(const
     QList<QPropertyAssignment> result;
     QHash<RestorableId, QVariant>::const_iterator it;
     for (it = restorables.constBegin(); it != restorables.constEnd(); ++it) {
-        if (!it.key().first) {
+        const RestorableId &id = it.key();
+        if (!id.object()) {
             // Property object was deleted
             continue;
         }
 #ifdef QSTATEMACHINE_RESTORE_PROPERTIES_DEBUG
-        qDebug() << q_func() << ": restoring" << it.key().first << it.key().second << "to" << it.value();
+        qDebug() << q_func() << ": restoring" << id.object() << id.proertyName() << "to" << it.value();
 #endif
-        result.append(QPropertyAssignment(it.key().first, it.key().second, it.value(), /*explicitlySet=*/false));
+        result.append(QPropertyAssignment(id.object(), id.propertyName(), it.value(), /*explicitlySet=*/false));
     }
     return result;
 }