When clearing selected items, iterate over a copy of the QSet

Selection change handlers of the items might call a method that
implicitly recreates the selectedItems QSet, which then invalidates
the iterators of the ranged for loop, resulting in crashes.

Iterate over a copy of the set instead.

Add a test case that crashen without the fix.

Fixes: QTBUG-101651
Pick-to: 6.3 6.2
Change-Id: I6da6f4043fe1906b0186931a37283f635cb5a404
Reviewed-by: Axel Spoerl <axel.spoerl@qt.io>
Reviewed-by: Richard Moe Gustavsen <richard.gustavsen@qt.io>

1 files changed, 4 insertions, 2 deletions

diff --git a/src/widgets/graphicsview/qgraphicsscene.cpp b/src/widgets/graphicsview/qgraphicsscene.cpp
index f41ced1a38..d00d69c47c 100644
--- a/src/widgets/graphicsview/qgraphicsscene.cpp
+++ b/src/widgets/graphicsview/qgraphicsscene.cpp
@@ -2285,9 +2285,11 @@ void QGraphicsScene::clearSelection()
 
     // Disable emitting selectionChanged
     ++d->selectionChanging;
-    bool changed = !d->selectedItems.isEmpty();
+    // iterate over a copy, as clearing selection might invalidate selectedItems
+    const auto selectedItems = d->selectedItems;
+    bool changed = !selectedItems.isEmpty();
 
-    for (QGraphicsItem *item : qAsConst(d->selectedItems))
+    for (QGraphicsItem *item : selectedItems)
         item->setSelected(false);
     d->selectedItems.clear();