Fix cache maybe invalid while the signal is actived from queue

with default QObject::connect signal may active from next message loop. invalide cache will hit while accessibility interface is called from windows. Invalide cache will lead to a crash

Fixes: QTBUG-106653
Pick-to: 5.15 6.2 6.3 6.4
Change-Id: I5359672bcd60ed6cfb2edf238645225164cb1b88
Reviewed-by: Oliver Wolff <oliver.wolff@qt.io>

3 files changed, 8 insertions, 1 deletions

diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
index cb35ed398c..16f0a3f9a6 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
@@ -38,10 +38,13 @@ QT_BEGIN_NAMESPACE
 
 using namespace QWindowsUiAutomation;
 
+QMutex QWindowsUiaMainProvider::m_mutex;
 
 // Returns a cached instance of the provider for a specific accessible interface.
 QWindowsUiaMainProvider *QWindowsUiaMainProvider::providerForAccessible(QAccessibleInterface *accessible)
 {
+    QMutexLocker locker(&m_mutex);
+
     if (!accessible)
         return nullptr;
 
@@ -240,6 +243,8 @@ ULONG QWindowsUiaMainProvider::AddRef()
 
 ULONG STDMETHODCALLTYPE QWindowsUiaMainProvider::Release()
 {
+    QMutexLocker locker(&m_mutex);
+
     if (!--m_ref) {
         delete this;
         return 0;
diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h
index 5659a28e35..fb5069f620 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h
@@ -11,6 +11,7 @@
 
 #include <QtCore/qpointer.h>
 #include <QtCore/qsharedpointer.h>
+#include <QtCore/qmutex.h>
 #include <QtCore/qt_windows.h>
 #include <QtGui/qaccessible.h>
 
@@ -62,6 +63,7 @@ public:
 private:
     QString automationIdForAccessible(const QAccessibleInterface *accessible);
     ULONG m_ref;
+    static QMutex m_mutex;
 };
 
 QT_END_NAMESPACE
diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp b/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp
index c53b130b92..ba2a88bb4e 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp
@@ -39,7 +39,7 @@ void QWindowsUiaProviderCache::insert(QAccessible::Id id, QWindowsUiaBaseProvide
         m_providerTable[id] = provider;
         m_inverseTable[provider] = id;
         // Connects the destroyed signal to our slot, to remove deleted objects from the cache.
-        QObject::connect(provider, &QObject::destroyed, this, &QWindowsUiaProviderCache::objectDestroyed);
+        QObject::connect(provider, &QObject::destroyed, this, &QWindowsUiaProviderCache::objectDestroyed, Qt::DirectConnection);
     }
 }