Fix memory leak and crash with transform animators.

Every time initialize() was called, we would increment the ref on
an item. However, initialize is called every time the job is started,
so the ref would increase and only decrease once, leading to a leaked
helper. Change it to only increment the first time.

A different problem was that when an item was destroyed, we could run
the risk of the QQuickTransformAnimatorJob destructor being called
with the helper's item being null. This would lead to the helper not
being removed from the cache and a dangling helper would remain in the
transforms cache. Now change it so that when a target is destroyed, we
explicitly destroy the helper as well (as no animation can happen then
anyway) and reset all pointers in the job.

Change-Id: I1ce76db134bbc1871d32f1224ba5b68a4a4eeafa
Reviewed-by: Michael Brasser <michael.brasser@live.com>

1 files changed, 13 insertions, 1 deletions

diff --git a/src/quick/util/qquickanimatorjob.cpp b/src/quick/util/qquickanimatorjob.cpp
index 3725e22397..fdbffd4709 100644
--- a/src/quick/util/qquickanimatorjob.cpp
+++ b/src/quick/util/qquickanimatorjob.cpp
@@ -256,6 +256,10 @@ QQuickTransformAnimatorJob::QQuickTransformAnimatorJob()
 QQuickTransformAnimatorJob::~QQuickTransformAnimatorJob()
 {
     if (m_helper && --m_helper->ref == 0) {
+        // The only condition for not having a controller is when target was
+        // destroyed, in which case we have neither m_helper nor m_contorller.
+        Q_ASSERT(m_controller);
+        Q_ASSERT(m_helper->item);
         m_controller->m_transforms.remove(m_helper->item);
         delete m_helper;
     }
@@ -266,6 +270,7 @@ void QQuickTransformAnimatorJob::initialize(QQuickAnimatorController *controller
     QQuickAnimatorJob::initialize(controller);
 
     if (m_controller) {
+        bool newHelper = m_helper == 0;
         m_helper = m_controller->m_transforms.value(m_target);
         if (!m_helper) {
             m_helper = new Helper();
@@ -273,7 +278,8 @@ void QQuickTransformAnimatorJob::initialize(QQuickAnimatorController *controller
             m_controller->m_transforms.insert(m_target, m_helper);
             QObject::connect(m_target, SIGNAL(destroyed(QObject*)), m_controller, SLOT(itemDestroyed(QObject*)), Qt::DirectConnection);
         } else {
-            ++m_helper->ref;
+            if (newHelper) // only add reference the first time around..
+                ++m_helper->ref;
             // Make sure leftovers from previous runs are being used...
             m_helper->wasSynced = false;
         }
@@ -287,6 +293,12 @@ void QQuickTransformAnimatorJob::nodeWasDestroyed()
         m_helper->node = 0;
 }
 
+void QQuickTransformAnimatorJob::targetWasDeleted()
+{
+    m_helper = 0;
+    QQuickAnimatorJob::targetWasDeleted();
+}
+
 void QQuickTransformAnimatorJob::Helper::sync()
 {
     const quint32 mask = QQuickItemPrivate::Position