Fix hover event crash

It was possible for a hover event to be sent to a QQuickItem that has
already been scheduled to be deleted (through deleteLater()). This
lead to an access on an already-freed object when the leave event
is generated. This change ensures that the item is part of a scene
before generating the hover enter event.

Task-number: QTBUG-32771

Change-Id: I69adb6bbd0ae52c70a6bda4e6c918b7671549a4c
Reviewed-by: Alan Alpert <aalpert@blackberry.com>

1 files changed, 8 insertions, 1 deletions

diff --git a/src/quick/items/qquickwindow.cpp b/src/quick/items/qquickwindow.cpp
index 377228e6bf..525c3d1a0e 100644
--- a/src/quick/items/qquickwindow.cpp
+++ b/src/quick/items/qquickwindow.cpp
@@ -1414,6 +1414,7 @@ void QQuickWindow::mouseMoveEvent(QMouseEvent *event)
 bool QQuickWindowPrivate::deliverHoverEvent(QQuickItem *item, const QPointF &scenePos, const QPointF &lastScenePos,
                                          Qt::KeyboardModifiers modifiers, bool &accepted)
 {
+    Q_Q(QQuickWindow);
     QQuickItemPrivate *itemPrivate = QQuickItemPrivate::get(item);
 
     if (itemPrivate->flags & QQuickItem::ItemClipsChildrenToShape) {
@@ -1463,7 +1464,13 @@ bool QQuickWindowPrivate::deliverHoverEvent(QQuickItem *item, const QPointF &sce
 
                     for (int i = startIdx; i >= 0; i--) {
                         QQuickItem *itemToHover = itemsToHover[i];
-                        if (QQuickItemPrivate::get(itemToHover)->hoverEnabled) {
+                        QQuickItemPrivate *itemToHoverPrivate = QQuickItemPrivate::get(itemToHover);
+                        // The item may be about to be deleted or reparented to another window
+                        // due to another hover event delivered in this function. If that is the
+                        // case, sending a hover event here will cause a crash or other bad
+                        // behavior when the leave event is generated. Checking
+                        // itemToHoverPrivate->window here prevents that case.
+                        if (itemToHoverPrivate->window == q && itemToHoverPrivate->hoverEnabled) {
                             hoverItems.prepend(itemToHover);
                             sendHoverEvent(QEvent::HoverEnter, itemToHover, scenePos, lastScenePos, modifiers, accepted);
                         }