QQmlApplicationEngine: Fix using invalid pointers

When a root object was deleted before QQmlApplicationEngine the
invalid pointers stayed in the list of root objects leading to crashes
when destructing QQmlApplicationEngine. Root objects are watched for
destruction and removed from the list.

Change-Id: I1babab54dbb7d7b16ed883ada5b3e420ca8690cb
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

2 files changed, 28 insertions, 2 deletions

diff --git a/src/qml/qml/qqmlapplicationengine.cpp b/src/qml/qml/qqmlapplicationengine.cpp
index a10dda166c..faab8bf926 100644
--- a/src/qml/qml/qqmlapplicationengine.cpp
+++ b/src/qml/qml/qqmlapplicationengine.cpp
@@ -57,6 +57,10 @@ QQmlApplicationEnginePrivate::~QQmlApplicationEnginePrivate()
 
 void QQmlApplicationEnginePrivate::cleanUp()
 {
+    Q_Q(QQmlApplicationEngine);
+    for (auto obj : qAsConst(objects))
+        obj->disconnect(q);
+
     qDeleteAll(objects);
 #if QT_CONFIG(translation)
     qDeleteAll(translators);
@@ -126,9 +130,12 @@ void QQmlApplicationEnginePrivate::finishLoad(QQmlComponent *c)
         qWarning() << qPrintable(c->errorString());
         q->objectCreated(0, c->url());
         break;
-    case QQmlComponent::Ready:
-        objects << c->create();
+    case QQmlComponent::Ready: {
+        auto newObj = c->create();
+        objects << newObj;
+        QObject::connect(newObj, &QObject::destroyed, q, [&](QObject *obj) { objects.removeAll(obj); });
         q->objectCreated(objects.constLast(), c->url());
+        }
         break;
     case QQmlComponent::Loading:
     case QQmlComponent::Null:
diff --git a/tests/auto/qml/qqmlapplicationengine/tst_qqmlapplicationengine.cpp b/tests/auto/qml/qqmlapplicationengine/tst_qqmlapplicationengine.cpp
index f7748b2da9..daeb9b5455 100644
--- a/tests/auto/qml/qqmlapplicationengine/tst_qqmlapplicationengine.cpp
+++ b/tests/auto/qml/qqmlapplicationengine/tst_qqmlapplicationengine.cpp
@@ -28,6 +28,7 @@
 
 #include "../../shared/util.h"
 #include <QQmlApplicationEngine>
+#include <QScopedPointer>
 #include <QSignalSpy>
 #if QT_CONFIG(process)
 #include <QProcess>
@@ -47,6 +48,7 @@ private slots:
     void testNonResolvedPath();
     void application();
     void applicationProperties();
+    void removeObjectsWhenDestroyed();
 private:
     QString buildDir;
     QString srcDir;
@@ -201,6 +203,23 @@ void tst_qqmlapplicationengine::applicationProperties()
     delete test;
 }
 
+void tst_qqmlapplicationengine::removeObjectsWhenDestroyed()
+{
+    QScopedPointer<QQmlApplicationEngine> test(new QQmlApplicationEngine);
+    QVERIFY(test->rootObjects().isEmpty());
+
+    QSignalSpy objectCreated(test.data(), SIGNAL(objectCreated(QObject*,QUrl)));
+    test->load(testFileUrl("basicTest.qml"));
+    QCOMPARE(objectCreated.count(), 1);
+
+    QSignalSpy objectDestroyed(test->rootObjects().first(), SIGNAL(destroyed()));
+    test->rootObjects().first()->deleteLater();
+    objectDestroyed.wait();
+    QCOMPARE(objectDestroyed.count(), 1);
+    QCOMPARE(test->rootObjects().size(), 0);
+}
+
+
 QTEST_MAIN(tst_qqmlapplicationengine)
 
 #include "tst_qqmlapplicationengine.moc"