From 6a9226b430d2bca99a20deed9a45eade930e270b Mon Sep 17 00:00:00 2001
From: Jannis Xiong <fly2xj@msn.com>
Date: Fri, 16 Sep 2022 11:29:49 +0800
Subject: Fix cache maybe invalid while the signal is actived from queue

with default QObject::connect signal may active from next message loop. invalide cache will hit while accessibility interface is called from windows. Invalide cache will lead to a crash

Fixes: QTBUG-106653
Change-Id: I5359672bcd60ed6cfb2edf238645225164cb1b88
Reviewed-by: Oliver Wolff <oliver.wolff@qt.io>
(cherry picked from commit 80f44954f6872afb5aa37e6737c3e1ac68ad3577)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
---
 .../platforms/windows/uiautomation/qwindowsuiamainprovider.cpp       | 5 +++++
 src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h | 2 ++
 .../platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp      | 2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
index fb3026e49d..f2416ff40c 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
@@ -74,10 +74,13 @@ QT_BEGIN_NAMESPACE
 
 using namespace QWindowsUiAutomation;
 
+QMutex QWindowsUiaMainProvider::m_mutex;
 
 // Returns a cached instance of the provider for a specific accessible interface.
 QWindowsUiaMainProvider *QWindowsUiaMainProvider::providerForAccessible(QAccessibleInterface *accessible)
 {
+    QMutexLocker locker(&m_mutex);
+
     if (!accessible)
         return nullptr;
 
@@ -275,6 +278,8 @@ ULONG QWindowsUiaMainProvider::AddRef()
 
 ULONG STDMETHODCALLTYPE QWindowsUiaMainProvider::Release()
 {
+    QMutexLocker locker(&m_mutex);
+
     if (!--m_ref) {
         delete this;
         return 0;
diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h
index f7320388f7..8aadabd227 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.h
@@ -47,6 +47,7 @@
 
 #include <QtCore/qpointer.h>
 #include <QtCore/qsharedpointer.h>
+#include <QtCore/qmutex.h>
 #include <QtCore/qt_windows.h>
 #include <QtGui/qaccessible.h>
 
@@ -98,6 +99,7 @@ public:
 private:
     QString automationIdForAccessible(const QAccessibleInterface *accessible);
     ULONG m_ref;
+    static QMutex m_mutex;
 };
 
 QT_END_NAMESPACE
diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp b/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp
index c55e827a46..0483cf4263 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiaprovidercache.cpp
@@ -75,7 +75,7 @@ void QWindowsUiaProviderCache::insert(QAccessible::Id id, QWindowsUiaBaseProvide
         m_providerTable[id] = provider;
         m_inverseTable[provider] = id;
         // Connects the destroyed signal to our slot, to remove deleted objects from the cache.
-        QObject::connect(provider, &QObject::destroyed, this, &QWindowsUiaProviderCache::objectDestroyed);
+        QObject::connect(provider, &QObject::destroyed, this, &QWindowsUiaProviderCache::objectDestroyed, Qt::DirectConnection);
     }
 }
 
-- 
cgit v1.2.3