Fix crash on exit when overriding signal handlers in states.

Cherry-picked from 93c64e1be3a2d68eb504d7c4f7c60f66ce1ff650 in 4.7.

Task-number: QTBUG-21617
Change-Id: I99ce8292d53954f5229867a384f47bedf7fad315
Reviewed-by: Martin Jones <martin.jones@nokia.com>

6 files changed, 94 insertions, 4 deletions

diff --git a/src/declarative/util/qdeclarativepropertychanges.cpp b/src/declarative/util/qdeclarativepropertychanges.cpp
index 0ad601914e..72add5621f 100644
--- a/src/declarative/util/qdeclarativepropertychanges.cpp
+++ b/src/declarative/util/qdeclarativepropertychanges.cpp
@@ -170,7 +170,8 @@ public:
         reverseExpression = rewindExpression;
     }
 
-    /*virtual void copyOriginals(QDeclarativeActionEvent *other)
+    virtual bool needsCopy() { return true; }
+    virtual void copyOriginals(QDeclarativeActionEvent *other)
     {
         QDeclarativeReplaceSignalHandler *rsh = static_cast<QDeclarativeReplaceSignalHandler*>(other);
         saveCurrentValues();
@@ -181,7 +182,7 @@ public:
             ownedExpression = rsh->ownedExpression;
             rsh->ownedExpression = 0;
         }
-    }*/
+    }
 
     virtual void rewind() {
         ownedExpression = QDeclarativePropertyPrivate::setSignalExpression(property, rewindExpression);
diff --git a/src/qtquick1/util/qdeclarativepropertychanges.cpp b/src/qtquick1/util/qdeclarativepropertychanges.cpp
index 692d7bbb60..3ea22e83fc 100644
--- a/src/qtquick1/util/qdeclarativepropertychanges.cpp
+++ b/src/qtquick1/util/qdeclarativepropertychanges.cpp
@@ -174,7 +174,8 @@ public:
         reverseExpression = rewindExpression;
     }
 
-    /*virtual void copyOriginals(QDeclarative1ActionEvent *other)
+    virtual bool needsCopy() { return true; }
+    virtual void copyOriginals(QDeclarative1ActionEvent *other)
     {
         QDeclarative1ReplaceSignalHandler *rsh = static_cast<QDeclarative1ReplaceSignalHandler*>(other);
         saveCurrentValues();
@@ -185,7 +186,7 @@ public:
             ownedExpression = rsh->ownedExpression;
             rsh->ownedExpression = 0;
         }
-    }*/
+    }
 
     virtual void rewind() {
         ownedExpression = QDeclarativePropertyPrivate::setSignalExpression(property, rewindExpression);
diff --git a/tests/auto/declarative/qdeclarativestates/data/signalOverrideCrash3.qml b/tests/auto/declarative/qdeclarativestates/data/signalOverrideCrash3.qml
new file mode 100644
index 0000000000..98d4c57219
--- /dev/null
+++ b/tests/auto/declarative/qdeclarativestates/data/signalOverrideCrash3.qml
@@ -0,0 +1,27 @@
+import QtQuick 2.0
+
+Rectangle {
+    id: myRect
+    width: 400
+    height: 400
+
+    onHeightChanged:  console.log("base state")
+
+    states: [
+        State {
+            name: "state1"
+            PropertyChanges {
+                target: myRect
+                onHeightChanged: console.log("state1")
+                color: "green"
+            }
+        },
+        State {
+            name: "state2";
+            PropertyChanges {
+                target: myRect
+                onHeightChanged: console.log("state2")
+                color: "red"
+        }
+    }]
+}
diff --git a/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp b/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp
index f6ab6526aa..05975aa9b1 100644
--- a/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp
+++ b/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp
@@ -111,6 +111,7 @@ private slots:
     void signalOverride();
     void signalOverrideCrash();
     void signalOverrideCrash2();
+    void signalOverrideCrash3();
     void parentChange();
     void parentChangeErrors();
     void anchorChanges();
@@ -519,6 +520,22 @@ void tst_qdeclarativestates::signalOverrideCrash2()
     delete rect;
 }
 
+void tst_qdeclarativestates::signalOverrideCrash3()
+{
+    QDeclarativeEngine engine;
+
+    QDeclarativeComponent rectComponent(&engine, TESTDATA("signalOverrideCrash3.qml"));
+    QQuickRectangle *rect = qobject_cast<QQuickRectangle*>(rectComponent.create());
+    QVERIFY(rect != 0);
+
+    QQuickItemPrivate::get(rect)->setState("state1");
+    QQuickItemPrivate::get(rect)->setState("");
+    QQuickItemPrivate::get(rect)->setState("state2");
+    QQuickItemPrivate::get(rect)->setState("");
+
+    delete rect;
+}
+
 void tst_qdeclarativestates::parentChange()
 {
     QDeclarativeEngine engine;
diff --git a/tests/auto/qtquick1/qdeclarativestates/data/signalOverrideCrash3.qml b/tests/auto/qtquick1/qdeclarativestates/data/signalOverrideCrash3.qml
new file mode 100644
index 0000000000..ed1f22f39a
--- /dev/null
+++ b/tests/auto/qtquick1/qdeclarativestates/data/signalOverrideCrash3.qml
@@ -0,0 +1,27 @@
+import QtQuick 1.0
+
+Rectangle {
+    id: myRect
+    width: 400
+    height: 400
+
+    onHeightChanged:  console.log("base state")
+
+    states: [
+        State {
+            name: "state1"
+            PropertyChanges {
+                target: myRect
+                onHeightChanged: console.log("state1")
+                color: "green"
+            }
+        },
+        State {
+            name: "state2";
+            PropertyChanges {
+                target: myRect
+                onHeightChanged: console.log("state2")
+                color: "red"
+        }
+    }]
+}
diff --git a/tests/auto/qtquick1/qdeclarativestates/tst_qdeclarativestates.cpp b/tests/auto/qtquick1/qdeclarativestates/tst_qdeclarativestates.cpp
index 809d9ca65c..ba4177e7ff 100644
--- a/tests/auto/qtquick1/qdeclarativestates/tst_qdeclarativestates.cpp
+++ b/tests/auto/qtquick1/qdeclarativestates/tst_qdeclarativestates.cpp
@@ -108,6 +108,7 @@ private slots:
     void signalOverride();
     void signalOverrideCrash();
     void signalOverrideCrash2();
+    void signalOverrideCrash3();
     void parentChange();
     void parentChangeErrors();
     void anchorChanges();
@@ -515,6 +516,22 @@ void tst_qdeclarativestates::signalOverrideCrash2()
     delete rect;
 }
 
+void tst_qdeclarativestates::signalOverrideCrash3()
+{
+    QDeclarativeEngine engine;
+
+    QDeclarativeComponent rectComponent(&engine, SRCDIR "/data/signalOverrideCrash3.qml");
+    QDeclarative1Rectangle *rect = qobject_cast<QDeclarative1Rectangle*>(rectComponent.create());
+    QVERIFY(rect != 0);
+
+    QDeclarativeItemPrivate::get(rect)->setState("state1");
+    QDeclarativeItemPrivate::get(rect)->setState("");
+    QDeclarativeItemPrivate::get(rect)->setState("state2");
+    QDeclarativeItemPrivate::get(rect)->setState("");
+
+    delete rect;
+}
+
 void tst_qdeclarativestates::parentChange()
 {
     QDeclarativeEngine engine;