Don't crash when passive grabber deleted before exclusive gr. released

In this scenario, a DragHandler is inside an Item in a Loader, under
a MouseArea, which unloads the loader on press.  So on press, the
DragHandler acquires a passive grab, then the MouseArea acquires the
exclusive grab, then the DragHandler is destroyed along with its parent
when the Loader is unloaded.  On release,
QQuickEventPoint::setGrabberItem(nullptr) was sending an
onGrabChanged(passiveGrabber, OverrideGrabPassive, this) notification.
That was questionable: the handler was not just then getting its grab
overridden, but rather un-overridden, because the exclusive grab
was being released.  It's also a good idea to check for null pointers,
since m_passiveGrabbers is a collection of QPointers already,
so we can tell when a passive grabber is deleted dynamically.

It can also be reproduced with MultiPointTouchArea just as with
MouseArea, so the test is written that way for convenience, because
we have tst_multipointtoucharea_interop already.  It doesn't really
matter which handler has the passive grab, or which item has the
exclusive grab that's being relinquished.

Fixes: QTBUG-73819
Change-Id: Ic605efa2143a1d849be095dcb88d6c38d7d2ee19
Reviewed-by: Jan Arve Sæther <jan-arve.saether@qt.io>

1 files changed, 5 insertions, 2 deletions

diff --git a/src/quick/items/qquickevents.cpp b/src/quick/items/qquickevents.cpp
index 2eaab164a0..c43eab6b8a 100644
--- a/src/quick/items/qquickevents.cpp
+++ b/src/quick/items/qquickevents.cpp
@@ -864,8 +864,11 @@ void QQuickEventPoint::setGrabberItem(QQuickItem *grabber)
             QQuickWindowPrivate *windowPriv = QQuickWindowPrivate::get(grabber->window());
             windowPriv->sendUngrabEvent(oldGrabberItem, windowPriv->isDeliveringTouchAsMouse());
         }
-        for (QPointer<QQuickPointerHandler> passiveGrabber : m_passiveGrabbers)
-            passiveGrabber->onGrabChanged(passiveGrabber, OverrideGrabPassive, this);
+        if (grabber) {
+            for (QPointer<QQuickPointerHandler> passiveGrabber : m_passiveGrabbers)
+                if (passiveGrabber)
+                    passiveGrabber->onGrabChanged(passiveGrabber, OverrideGrabPassive, this);
+        }
     }
 }