winrt: Check for removed timers after sending events

After all the check makes sense here. If a timer was removed as a result
of sendEvent and it was not at the end of the list the list is not
shrunk but the timer info's id is just set to INVALID_TIMER_ID.

Additionally the timer's object should be fetched before we unlock the
locker as timerIdToObject is changed in removeTimer and we might access
a nullptr if the timer has been removed.

Reverts c83ba01f7bc542368973f3f24dfb59c6052dd78a

Task-number: QTBUG-56756
Change-Id: Ib1a04c02fbfcf4c939b4891d42f954dc9e87149e
(cherry picked from commit 8f2088db171a6941feb1903a2912a8b7fdf3a9ec)
Reviewed-by: Maurice Kalinowski <maurice.kalinowski@qt.io>

1 files changed, 7 insertions, 4 deletions

diff --git a/src/corelib/kernel/qeventdispatcher_winrt.cpp b/src/corelib/kernel/qeventdispatcher_winrt.cpp
index ff397fc750..33753ed507 100644
--- a/src/corelib/kernel/qeventdispatcher_winrt.cpp
+++ b/src/corelib/kernel/qeventdispatcher_winrt.cpp
@@ -166,7 +166,7 @@ private:
             timerIdToHandle.insert(id, handle);
             timerIdToCancelHandle.insert(id, cancelHandle);
         }
-        timerIdToObject.insert(id, obj);
+
         const quint64 targetTime = qt_msectime() + interval;
         const WinRTTimerInfo info(id, interval, type, obj, targetTime);
         QMutexLocker locker(&timerInfoLock);
@@ -587,15 +587,18 @@ bool QEventDispatcherWinRT::event(QEvent *e)
             break;
         info.inEvent = true;
 
+        QObject *timerObj = d->timerIdToObject.value(id);
         locker.unlock();
 
         QTimerEvent te(id);
-        QCoreApplication::sendEvent(d->timerIdToObject.value(id), &te);
+        QCoreApplication::sendEvent(timerObj, &te);
 
         locker.relock();
 
-        // The timer might have been removed in the meanwhile
-        if (id >= d->timerInfos.size())
+        // The timer might have been removed in the meanwhile. If the timer was
+        // the last one in the list, id is bigger than the list's size.
+        // Otherwise, the id will just be set to INVALID_TIMER_ID.
+        if (id >= d->timerInfos.size() || info.timerId == INVALID_TIMER_ID)
             break;
 
         if (info.interval == 0 && info.inEvent) {