Fix crash when changing the source of AnimatedImage after a frame change

QMovie emits the signals updated() and frameChanged(), and restarts
right after its timer to prepare for the next frame. Since AnimatedImage
destroys its underlying QMovie when its source changes, the lines after
emit frameChanged() in QMovie will use free'd memory and will most of
the time produce a crash.

This fix delays the destruction of the underlying QMovie of
AnimatedImage using deleteLater() to prevent this kind of behavior from
happening without impact/behavior change in the code of QMovie. Unit
tests added as well to cover this situation.

This commit also fixes a similar crash when Component.onCompleted is
called and when the source changes in the associated callback.

Task-number: QTBUG-67427
Change-Id: Ic6568a1bc251e5fa2ee1cf8e5f50eaa56c3007db
Reviewed-by: VaL Doroshchuk <valentyn.doroshchuk@qt.io>
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
Reviewed-by: Louis du Verdier <louis.du.verdier@free.fr>

1 files changed, 28 insertions, 0 deletions

diff --git a/tests/auto/quick/qquickanimatedimage/tst_qquickanimatedimage.cpp b/tests/auto/quick/qquickanimatedimage/tst_qquickanimatedimage.cpp
index 3e5a054cc7..8026bafb9e 100644
--- a/tests/auto/quick/qquickanimatedimage/tst_qquickanimatedimage.cpp
+++ b/tests/auto/quick/qquickanimatedimage/tst_qquickanimatedimage.cpp
@@ -67,6 +67,7 @@ private slots:
     void progressAndStatusChanges();
     void playingAndPausedChanges();
     void noCaching();
+    void sourceChangesOnFrameChanged();
 };
 
 void tst_qquickanimatedimage::cleanup()
@@ -590,6 +591,33 @@ void tst_qquickanimatedimage::noCaching()
     }
 }
 
+void tst_qquickanimatedimage::sourceChangesOnFrameChanged()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("colors.qml"));
+    QVector<QQuickAnimatedImage*> images;
+
+    // Run multiple animations in parallel, this should be fast
+    for (int loops = 0; loops < 25; ++loops) {
+        QQuickAnimatedImage *anim = qobject_cast<QQuickAnimatedImage *>(component.create());
+
+        // QTBUG-67427: this should not produce a segfault
+        QObject::connect(anim,
+                         &QQuickAnimatedImage::frameChanged,
+                         [this, anim]() { anim->setSource(testFileUrl("hearts.gif")); });
+
+        QVERIFY(anim);
+        QVERIFY(anim->isPlaying());
+
+        images.append(anim);
+    }
+
+    for (auto *anim : images)
+        QTRY_COMPARE(anim->source(), testFileUrl("hearts.gif"));
+
+    qDeleteAll(images);
+}
+
 QTEST_MAIN(tst_qquickanimatedimage)
 
 #include "tst_qquickanimatedimage.moc"