Fixed a QTimer::singleShot() crash when a functor callback is used

If QTimer::singleShot() is used with a functor callback and a context
object with different thread affinity than the caller, a crash can
occur. If the context object's thread is scheduled before
connecting to QCoreApplication::aboutToQuit(), the timer has a change
to fire and QSingleShotTimer::timerEvent() will delete the
QSingleShotTimer object making the this pointer used in the
connection invalid. This can occur relatively often if an interval
of 0 is used.

Making the moveToThread() call the last thing in the constructor
ensures that the constructor gets to run to completion before the
timer has a chance to fire.

Task-number: QTBUG-48700
Change-Id: Iab73d02933635821b8d1ca1ff3d53e92eca85834
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>

1 files changed, 24 insertions, 0 deletions

diff --git a/tests/auto/corelib/kernel/qtimer/tst_qtimer.cpp b/tests/auto/corelib/kernel/qtimer/tst_qtimer.cpp
index 1dc358bd97..b34a3a6beb 100644
--- a/tests/auto/corelib/kernel/qtimer/tst_qtimer.cpp
+++ b/tests/auto/corelib/kernel/qtimer/tst_qtimer.cpp
@@ -72,6 +72,7 @@ private slots:
     void singleShotStaticFunctionZeroTimeout();
     void recurseOnTimeoutAndStopTimer();
     void singleShotToFunctors();
+    void crossThreadSingleShotToFunctor();
 
     void dontBlockEvents();
     void postedEventsShouldNotStarveTimers();
@@ -877,5 +878,28 @@ void tst_QTimer::postedEventsShouldNotStarveTimers()
     QVERIFY(timerHelper.count > 5);
 }
 
+struct DummyFunctor {
+    void operator()() {}
+};
+
+void tst_QTimer::crossThreadSingleShotToFunctor()
+{
+    // We're testing for crashes here, so the test simply running to
+    // completion is considered a success
+    QThread t;
+    t.start();
+
+    QObject* o = new QObject();
+    o->moveToThread(&t);
+
+    for (int i = 0; i < 10000; i++) {
+        QTimer::singleShot(0, o, DummyFunctor());
+    }
+
+    t.quit();
+    t.wait();
+    delete o;
+}
+
 QTEST_MAIN(tst_QTimer)
 #include "tst_qtimer.moc"