qdoc: Fix write to invalid memory

Before deleting the children of an Aggregate, we must clear its
internal collections first. This prevents removeChild() (called
from ~Node) from accessing already deleted siblings.

Change-Id: Ic657b1d57fe4c766daa2bd4b791c3840099de709
Task-number: QTBUG-47751
Reviewed-by: Martin Smith <martin.smith@digia.com>

1 files changed, 12 insertions, 4 deletions

diff --git a/src/tools/qdoc/node.cpp b/src/tools/qdoc/node.cpp
index eec08e3c72..c1cf076f47 100644
--- a/src/tools/qdoc/node.cpp
+++ b/src/tools/qdoc/node.cpp
@@ -121,10 +121,12 @@ void Node::removeRelates()
     if (!relatesTo_)
         return;
 
-    if (relatesTo_->isDocumentNode() && !relatesTo_->parent())
+    if (relatesTo_->isDocumentNode() && !relatesTo_->parent()) {
         delete relatesTo_;
-    else
+        relatesTo_ = 0;
+    } else {
         relatesTo_->removeRelated(this);
+    }
 }
 
 /*!
@@ -739,8 +741,8 @@ void Node::setLocation(const Location& t)
  */
 Aggregate::~Aggregate()
 {
-    deleteChildren();
     removeFromRelated();
+    deleteChildren();
 }
 
 /*!
@@ -1062,7 +1064,13 @@ void Aggregate::removeFromRelated()
  */
 void Aggregate::deleteChildren()
 {
-    NodeList childrenCopy = children_; // `children_` will be changed in ~Node()
+    NodeList childrenCopy = children_;
+    // Clear internal collections before deleting child nodes
+    children_.clear();
+    childMap_.clear();
+    enumChildren_.clear();
+    primaryFunctionMap_.clear();
+    secondaryFunctionMap_.clear();
     qDeleteAll(childrenCopy);
 }