Fix bug when destruction fields in QWizard

Maintain the consistency of QWizardPrivate's two members:
    QVector<QWizardField> fields;
    QMap<QString, int> fieldIndexMap;
during and after calls to QWizardPrivate's
void _q_handleFieldObjectDestroyed(QObject *)
member function.  The failure to maintain this consistency
caused an out of bounds access and core dump in
QWizard's field(const QString &name) member function.

QWizard's field(const QString &name) member function expects
the values in the QMap fieldIndexMap to be indexes into the
QVector fields.  Prior to this change
_q_handleFieldObjectDestroyed only removed the appropriate
entry from the map and erased it from the vector.  It did
not decrement by one all the indexes greater than the index
that was removed from the map and erased from the vector
in the rest of the map.

For example ...
So if initially have the following mapping ...
"field0" -> 0,
"field1" -> 1, and
"field2" -> 2
with fields of size 3. After destruction of "field1" have ...
"field0" -> 0, and
"field2" -> 2
with fields of size 2.
Now attempts to look up "field2" using QWizard::field will
have an out of bounds error and possibly core dump or trigger
an internal Qt assert because an attempt to access
this->fields[2] will be made.   It should be accessing
this->fields[1], but does not because the map is no longer
consistent with the vector.

This change adds a decrement by one for all the indexes
greater than the index that was removed from the map and
erased from the vector.

Task-number: QTBUG-25691
Change-Id: Ia2a41027628a65faec4ecdd5da235ddd19746a57
Reviewed-by: Shane Kearns <shane.kearns@accenture.com>
Reviewed-by: Lars Knoll <lars.knoll@nokia.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/tests/auto/widgets/dialogs/qwizard/tst_qwizard.cpp b/tests/auto/widgets/dialogs/qwizard/tst_qwizard.cpp
index 9d9b55cafd..c11e47903d 100644
--- a/tests/auto/widgets/dialogs/qwizard/tst_qwizard.cpp
+++ b/tests/auto/widgets/dialogs/qwizard/tst_qwizard.cpp
@@ -111,6 +111,7 @@ private slots:
     void task177022_setFixedSize();
     void task248107_backButton();
     void task255350_fieldObjectDestroyed();
+    void taskQTBUG_25691_fieldObjectDestroyed2();
 
     /*
         Things that could be added:
@@ -2643,5 +2644,15 @@ void tst_QWizard::task255350_fieldObjectDestroyed()
     delete page;
 }
 
+// Global taskQTBUG_25691_fieldObjectDestroyed2 is defined in
+// tst_qwizard_2.cpp to avoid cluttering up this file with
+// the QWizardPage subclasses, etc. required to complete this
+// test.
+void taskQTBUG_25691_fieldObjectDestroyed2(void);
+void tst_QWizard::taskQTBUG_25691_fieldObjectDestroyed2()
+{
+    ::taskQTBUG_25691_fieldObjectDestroyed2();
+}
+
 QTEST_MAIN(tst_QWizard)
 #include "tst_qwizard.moc"