qquickwindow: ensure we delete the correct delayed touch event after delivery

Delivering a delayed touch event from QQuickWindow can cause the event loop
to recurse (e.g if it starts a drag'n'drop). This again can cause new touch
events to be delivered to QQuickWindow, and new delayed touch events to be
stored.

This results in the following:
    (1) Receive new touch press event in QQuickWindow, and set
        delayedTouch to be a copy of it
    (2) Deliver delayedTouch to items. This can cause an event loop
        recursion.
    (3) While inside the recursion, QQuickWindow receives another new
        touch press event. We then redeliver and delete the current
        delayedTouch event created in (1), and set delayedTouch to be
        a copy of the new event.
    (4) Later we return back from (2), and try to access
        delayedTouch (or actually a reference to the touchpoints inside
        it, qquickwindow.cpp:1958). Since the event was deleted in (3), we
        have a crash.

This patch will ensure that we set delayedTouch to 0 before delivering
it (so it cannot be redelivered), and that we safely delete it afterwards
when it goes out of scope. By converting delayedTouch to a QScopedPointer
we also ensure that the event is not leaked upon destruction.

Task-number: QTBUG-45877
Change-Id: Ic372a39a0eb127abfd12cec2d51b3743ad83194d
Reviewed-by: Simon Hausmann <simon.hausmann@theqtcompany.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/src/quick/items/qquickwindow_p.h b/src/quick/items/qquickwindow_p.h
index a61c0b0346..605a36fb1d 100644
--- a/src/quick/items/qquickwindow_p.h
+++ b/src/quick/items/qquickwindow_p.h
@@ -151,6 +151,7 @@ public:
     void deliverTouchEvent(QTouchEvent *);
     void reallyDeliverTouchEvent(QTouchEvent *);
     bool deliverTouchCancelEvent(QTouchEvent *);
+    void deliverDelayedTouchEvent();
     void flushDelayedTouchEvent();
     bool deliverHoverEvent(QQuickItem *, const QPointF &scenePos, const QPointF &lastScenePos, Qt::KeyboardModifiers modifiers, bool &accepted);
     bool deliverMatchingPointsToItem(QQuickItem *item, QTouchEvent *event, QSet<int> *acceptedNewPoints, const QSet<int> &matchingNewPoints, const QList<QTouchEvent::TouchPoint> &matchingPoints, QSet<QQuickItem*> *filtered);
@@ -219,7 +220,7 @@ public:
     QSGRenderLoop *windowManager;
     QQuickRenderControl *renderControl;
     QQuickAnimatorController *animationController;
-    QTouchEvent *delayedTouch;
+    QScopedPointer<QTouchEvent> delayedTouch;
     int touchRecursionGuard;
     QQuickCustomRenderStage *customRenderStage;