Fix crash in QQuickAnimatedImage

Check d->_movie pointer before dereferencing

Task-number: QTBUG-62380
Change-Id: I62314c7c0d4a7e41fa6f8c4629d16f30d6036156
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
Reviewed-by: Frederik Gladhorn <frederik.gladhorn@qt.io>
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
(cherry-picked from fc3ecd2522deb3f6d8d48b66dbd89402e1ab4b53)

2 files changed, 44 insertions, 1 deletions

diff --git a/src/quick/items/qquickanimatedimage.cpp b/src/quick/items/qquickanimatedimage.cpp
index 11dad5b001..1b2f5352b1 100644
--- a/src/quick/items/qquickanimatedimage.cpp
+++ b/src/quick/items/qquickanimatedimage.cpp
@@ -355,7 +355,7 @@ void QQuickAnimatedImage::movieRequestFinished()
         d->_movie = new QMovie(d->reply);
     }
 
-    if (!d->_movie->isValid()) {
+    if (!d->_movie || !d->_movie->isValid()) {
         qmlInfo(this) << "Error Reading Animated Image File " << d->url.toString();
         delete d->_movie;
         d->_movie = 0;
diff --git a/tests/auto/qmltest/animatedimage/tst_animatedimage.qml b/tests/auto/qmltest/animatedimage/tst_animatedimage.qml
index 6ddd0e3024..c7e0aa2711 100644
--- a/tests/auto/qmltest/animatedimage/tst_animatedimage.qml
+++ b/tests/auto/qmltest/animatedimage/tst_animatedimage.qml
@@ -114,6 +114,44 @@ Item {
         fillMode: AnimatedImage.TileHorizontally
     }
 
+    Loader {
+        id: raceConditionLoader
+        active: false
+        anchors.fill: parent
+
+        sourceComponent: ListView {
+            anchors.fill: parent
+            model: 5000
+            delegate: Item {
+                height: 10
+                width: parent.width
+                Text {
+                    anchors.fill: parent
+                    text: index
+                }
+                AnimatedImage {
+                    anchors.fill: parent
+                    source: "http://127.0.0.1/some-image-url.gif"
+                    Component.onCompleted: source = "";
+                }
+            }
+
+            function scrollToNext() {
+                currentIndex = currentIndex + 30 < model ? currentIndex + 30 : model;
+                positionViewAtIndex(currentIndex, ListView.Beginning);
+                if (currentIndex >= model)
+                    raceConditionLoader.active = false;
+            }
+
+            property Timer timer: Timer {
+                interval: 10
+                repeat: true
+                onTriggered: parent.scrollToNext()
+                Component.onCompleted: start()
+            }
+        }
+    }
+
     TestCase {
         name: "AnimatedImage"
 
@@ -216,5 +254,10 @@ Item {
             compare(tileModes3.fillMode, AnimatedImage.TileHorizontally)
         }
 
+        function test_crashRaceCondition_replyFinished() {
+            raceConditionLoader.active = true;
+            tryCompare(raceConditionLoader, "active", false);
+        }
+
     }
 }