Android: Fix crashes due to concurrency issues

BroadcastReceiver.onReceive() is executed in the main thread whereas
the Qt classes are in a different thread. This created issues whereby
Java's qtObject pointer was reset by the Qt classes/thread but
onReceive still trying to access the same object later on.

In most cases the Qt classes using BroadcastReceiver were half way
through their object tear down. This patch fixes the problem by
guarding qtObject against concurrent thread access and ensures that
the qtObject pointer is reset before the object tear down starts.

Change-Id: Iab97b0af8e10686d97419ac8504f2fe69e9536f3
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@digia.com>

1 files changed, 12 insertions, 2 deletions

diff --git a/src/bluetooth/qbluetoothservicediscoveryagent_android.cpp b/src/bluetooth/qbluetoothservicediscoveryagent_android.cpp
index e0e17c14..7b081e04 100644
--- a/src/bluetooth/qbluetoothservicediscoveryagent_android.cpp
+++ b/src/bluetooth/qbluetoothservicediscoveryagent_android.cpp
@@ -98,8 +98,14 @@ QBluetoothServiceDiscoveryAgentPrivate::QBluetoothServiceDiscoveryAgentPrivate(
 
 QBluetoothServiceDiscoveryAgentPrivate::~QBluetoothServiceDiscoveryAgentPrivate()
 {
-    delete receiver;
-    delete localDeviceReceiver;
+    if (receiver) {
+        receiver->unregisterReceiver();
+        delete receiver;
+    }
+    if (localDeviceReceiver) {
+        localDeviceReceiver->unregisterReceiver();
+        delete localDeviceReceiver;
+    }
 }
 
 void QBluetoothServiceDiscoveryAgentPrivate::start(const QBluetoothAddress &address)
@@ -209,6 +215,7 @@ void QBluetoothServiceDiscoveryAgentPrivate::start(const QBluetoothAddress &addr
         jboolean result = remoteDevice.callMethod<jboolean>("fetchUuidsWithSdp");
         if (!result) {
             //kill receiver to limit load of signals
+            receiver->unregisterReceiver();
             receiver->deleteLater();
             receiver = 0;
             qCWarning(QT_BT_ANDROID) << "Cannot start dynamic fetch.";
@@ -223,6 +230,7 @@ void QBluetoothServiceDiscoveryAgentPrivate::stop()
     discoveredDevices.clear();
 
     //kill receiver to limit load of signals
+    receiver->unregisterReceiver();
     receiver->deleteLater();
     receiver = 0;
 
@@ -493,6 +501,7 @@ void QBluetoothServiceDiscoveryAgentPrivate::_q_fetchUuidsTimeout()
     Q_ASSERT(sdpCache.isEmpty());
 
     //kill receiver to limit load of signals
+    receiver->unregisterReceiver();
     receiver->deleteLater();
     receiver = 0;
     _q_serviceDiscoveryFinished();
@@ -509,6 +518,7 @@ void QBluetoothServiceDiscoveryAgentPrivate::_q_hostModeStateChanged(QBluetoothL
         errorString = QBluetoothServiceDiscoveryAgent::tr("Device is powered off");
 
         //kill receiver to limit load of signals
+        receiver->unregisterReceiver();
         receiver->deleteLater();
         receiver = 0;