QWidget: Clean up state that depends on QWindow from ~QWidgetWindow()

We were assuming that QWidget was in full control of QWidgetWindow
destruction, via deleteTLSysExtra(), and that we could limit any
cleanups to that function.

But in some situations QWidgetWindow is destructed from other code paths,
in which case we were left with dangling pointers to the QWidgetWindow
in both QTLWExtra, as well as the backingstore.

This can happen if there's a child widget hierarchy where there is not
a 1:1 mapping between QWidgets and QWindows, for example if the window
attribute WA_DontCreateNativeAncestors has been set. In this situation
our normal recursion into children in QWidget::destroy() stops at the
first widget without a window handle. When we then delete the top level
QWindow, the QWindow destructor will delete any child QWindows, which
includes our leaf QWidgetWindow.

We should probably fix up QWidget::destroy to continue looking for
children, even if we don't destroy the current child. But independently
of that we should make sure the QWidgetWindow cleans up when it's being
deleted, regardless of how it ended up there.

There's further room to clean up the deleteTLSysExtra() function and
friends, but that's been left for a later time.

Fixes: QTBUG-120509
Pick-to: 6.7 6.6 6.6.2 6.5
Change-Id: Ib691df164d7c9c83cb464c0a6bf3bc2116e8ca43
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>

1 files changed, 27 insertions, 0 deletions

diff --git a/tests/auto/widgets/kernel/qwidget_window/tst_qwidget_window.cpp b/tests/auto/widgets/kernel/qwidget_window/tst_qwidget_window.cpp
index addcc7d321..83e6415569 100644
--- a/tests/auto/widgets/kernel/qwidget_window/tst_qwidget_window.cpp
+++ b/tests/auto/widgets/kernel/qwidget_window/tst_qwidget_window.cpp
@@ -113,6 +113,8 @@ private slots:
 
     void resetFocusObjectOnDestruction();
 
+    void cleanupOnDestruction();
+
 private:
     QSize m_testWidgetSize;
     const int m_fuzz;
@@ -1672,5 +1674,30 @@ void tst_QWidget_window::resetFocusObjectOnDestruction()
     QCOMPARE(focusObjectChangedSpy.last().last().value<QObject*>(), nullptr);
 }
 
+class CreateDestroyWidget : public QWidget
+{
+public:
+    using QWidget::create;
+    using QWidget::destroy;
+};
+
+void tst_QWidget_window::cleanupOnDestruction()
+{
+    CreateDestroyWidget widget;
+    QWidget child(&widget);
+
+    QWidget grandChild(&child);
+    // Ensure there's not a 1:1 native window hierarhcy that we could
+    // recurse during QWidget::destroy(), triggering the issue that
+    // we were failing to clean up when not destroyed via QWidget.
+    grandChild.setAttribute(Qt::WA_DontCreateNativeAncestors);
+    grandChild.winId();
+
+    widget.destroy();
+    widget.create();
+
+    widget.show();
+}
+
 QTEST_MAIN(tst_QWidget_window)
 #include "tst_qwidget_window.moc"