From ba87568655dad3e830e692109b5e571ae78b71a0 Mon Sep 17 00:00:00 2001
From: Kent Hansen <kent.hansen@nokia.com>
Date: Mon, 2 Jul 2012 20:45:49 +0200
Subject: statemachine: Don't crash if property assignment target is deleted

Do like QPropertyAnimation and store the QObject in a QPointer.
Purge the assignments list upon state entry and property restore.

Change-Id: I54a56885a2905178ab6aa5cf292b3d25c86b7a97
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@nokia.com>
---
 src/corelib/statemachine/qstatemachine.cpp | 40 ++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 11 deletions(-)

(limited to 'src/corelib/statemachine/qstatemachine.cpp')

diff --git a/src/corelib/statemachine/qstatemachine.cpp b/src/corelib/statemachine/qstatemachine.cpp
index 3d0b1e92fd..24da4e6937 100644
--- a/src/corelib/statemachine/qstatemachine.cpp
+++ b/src/corelib/statemachine/qstatemachine.cpp
@@ -176,6 +176,10 @@ QT_BEGIN_NAMESPACE
 
 // #define QSTATEMACHINE_DEBUG
 
+template <class T>
+static uint qHash(const QPointer<T> &p)
+{ return qHash(p.data()); }
+
 QStateMachinePrivate::QStateMachinePrivate()
 {
     isMachine = true;
@@ -666,14 +670,20 @@ void QStateMachinePrivate::applyProperties(const QList<QAbstractTransition*> &tr
         if (!s)
             continue;
 
-        QList<QPropertyAssignment> assignments = QStatePrivate::get(s)->propertyAssignments;
-        for (int j = 0; j < assignments.size(); ++j) {
-            const QPropertyAssignment &assn = assignments.at(j);
-            if (globalRestorePolicy == QStateMachine::RestoreProperties) {
-                registerRestorable(assn.object, assn.propertyName);
+        {
+            QList<QPropertyAssignment> &assignments = QStatePrivate::get(s)->propertyAssignments;
+            for (int j = 0; j < assignments.size(); ++j) {
+                const QPropertyAssignment &assn = assignments.at(j);
+                if (assn.objectDeleted()) {
+                    assignments.removeAt(j--);
+                } else {
+                    if (globalRestorePolicy == QStateMachine::RestoreProperties) {
+                        registerRestorable(assn.object, assn.propertyName);
+                    }
+                    pendingRestorables.remove(RestorableId(assn.object, assn.propertyName));
+                    propertyAssignmentsForState[s].append(assn);
+                }
             }
-            pendingRestorables.remove(RestorableId(assn.object, assn.propertyName));
-            propertyAssignmentsForState[s].append(assn);
         }
 
         // Remove pending restorables for all parent states to avoid restoring properties
@@ -681,12 +691,16 @@ void QStateMachinePrivate::applyProperties(const QList<QAbstractTransition*> &tr
         // assign a property which is assigned by the parent, it inherits the parent's assignment.
         QState *parentState = s;
         while ((parentState = parentState->parentState()) != 0) {
-            assignments = QStatePrivate::get(parentState)->propertyAssignments;
+            QList<QPropertyAssignment> &assignments = QStatePrivate::get(parentState)->propertyAssignments;
             for (int j=0; j<assignments.size(); ++j) {
                 const QPropertyAssignment &assn = assignments.at(j);
-                int c = pendingRestorables.remove(RestorableId(assn.object, assn.propertyName));
-                if (c > 0)
-                    propertyAssignmentsForState[s].append(assn);                
+                if (assn.objectDeleted()) {
+                    assignments.removeAt(j--);
+                } else {
+                    int c = pendingRestorables.remove(RestorableId(assn.object, assn.propertyName));
+                    if (c > 0)
+                        propertyAssignmentsForState[s].append(assn);
+                }
             }
         }
     }
@@ -967,6 +981,10 @@ QList<QPropertyAssignment> QStateMachinePrivate::restorablesToPropertyList(const
     QHash<RestorableId, QVariant>::const_iterator it;
     for (it = restorables.constBegin(); it != restorables.constEnd(); ++it) {
 //        qDebug() << "restorable:" << it.key().first << it.key().second << it.value();
+        if (!it.key().first) {
+            // Property object was deleted
+            continue;
+        }
         result.append(QPropertyAssignment(it.key().first, it.key().second, it.value(), /*explicitlySet=*/false));
     }
     return result;
-- 
cgit v1.2.3