Fix crash when cancelling a QFuture that has continuation with context

To support cancellation of continuations attached via the parent future,
we store a pointer to continuation future's data in parent. This
requires preserving the lifetime of continuation future's data while the
parent is still alive (see 24dedaeaa1a94bfe9ade2da2a2c9aa112241b07a).
This is achieved by capturing the promise in the continuation's lambda,
which is only cleaned up after the parent's data is destroyed. This is
already the case for continuations without context, but was overlooked
for continuations with context: they transfer the ownership of the
continuation promise to lambda passed to QMetaObject::invokeMethod(),
which destroys the lambda's context after it's run. As a result, the
continuation's promise (and data, if there are no other copies of it)
is also destroyed, leaving the parent pointing to deleted continuation
data.

To fix this, capture a copy of continuation future's ref-counted data in
the continuation's lambda. This will guarantee that the continuation
data remains alive until the parent is destroyed and the continuation
is cleaned up.

Fixes: QTBUG-108790
Pick-to: 6.5 6.4 6.2
Change-Id: Ief4b37f31e652988d13b03499505ac65c7889226
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>

0 files changed, 0 insertions, 0 deletions