4 files changed, 27 insertions, 1 deletions
diff --git a/src/quick/scenegraph/coreapi/qsgmaterial.cpp b/src/quick/scenegraph/coreapi/qsgmaterial.cpp
index 8d666d3d0b..07dc87a643 100644
--- a/src/quick/scenegraph/coreapi/qsgmaterial.cpp
+++ b/src/quick/scenegraph/coreapi/qsgmaterial.cpp
@@ -419,6 +419,10 @@ void QSGMaterialShader::compile()
     \value DirtyMatrix Used to indicate that the matrix has changed and must be updated.
 
     \value DirtyOpacity Used to indicate that the opacity has changed and must be updated.
+
+    \value DirtyCachedMaterialData Used to indicate that the cached material data have changed and must be updated.
+
+    \value DirtyAll Used to indicate that everything needs to be updated.
  */
 
 
diff --git a/src/quick/scenegraph/coreapi/qsgnode.cpp b/src/quick/scenegraph/coreapi/qsgnode.cpp
index 7ef75d4b4c..7ac3914023 100644
--- a/src/quick/scenegraph/coreapi/qsgnode.cpp
+++ b/src/quick/scenegraph/coreapi/qsgnode.cpp
@@ -112,6 +112,7 @@ static void qt_print_node_count()
     \value DirtyGeometry The geometry of a QSGGeometryNode has changed.
     \value DirtyMaterial The material of a QSGGeometryNode has changed.
     \value DirtyOpacity The opacity of a QSGOpacityNode has changed.
+    \value DirtySubtreeBlocked The subtree has been blocked.
 
     \sa QSGNode::markDirty()
  */
@@ -146,6 +147,7 @@ static void qt_print_node_count()
     \value TransformNodeType The type of QSGTransformNode
     \value ClipNodeType The type of QSGClipNode
     \value OpacityNodeType The type of QSGOpacityNode
+    \value RenderNodeType The type of QSGRenderNode
 
     \sa type()
  */
diff --git a/src/quick/scenegraph/coreapi/qsgrenderer.cpp b/src/quick/scenegraph/coreapi/qsgrenderer.cpp
index 9207fdbc55..bb2671f6c3 100644
--- a/src/quick/scenegraph/coreapi/qsgrenderer.cpp
+++ b/src/quick/scenegraph/coreapi/qsgrenderer.cpp
@@ -134,6 +134,7 @@ QSGRenderer::QSGRenderer(QSGRenderContext *context)
     , m_bindable(0)
     , m_changed_emitted(false)
     , m_is_rendering(false)
+    , m_is_preprocessing(false)
 {
 }
 
@@ -287,6 +288,8 @@ void QSGRenderer::nodeChanged(QSGNode *node, QSGNode::DirtyState state)
 
 void QSGRenderer::preprocess()
 {
+    m_is_preprocessing = true;
+
     QSGRootNode *root = rootNode();
     Q_ASSERT(root);
 
@@ -298,6 +301,11 @@ void QSGRenderer::preprocess()
     for (QSet<QSGNode *>::const_iterator it = items.constBegin();
          it != items.constEnd(); ++it) {
         QSGNode *n = *it;
+
+        // If we are currently preprocessing, check this node hasn't been
+        // deleted or something. we don't want a use-after-free!
+        if (m_nodes_dont_preprocess.contains(n)) // skip
+            continue;
         if (!nodeUpdater()->isNodeBlocked(n, root)) {
             n->preprocess();
         }
@@ -315,8 +323,13 @@ void QSGRenderer::preprocess()
         updatePassTime = frameTimer.nsecsElapsed();
     Q_QUICK_SG_PROFILE_RECORD(QQuickProfiler::SceneGraphRendererFrame,
                               QQuickProfiler::SceneGraphRendererUpdate);
+
+    m_is_preprocessing = false;
+    m_nodes_dont_preprocess.clear();
 }
 
+
+
 void QSGRenderer::addNodesToPreprocess(QSGNode *node)
 {
     for (QSGNode *c = node->firstChild(); c; c = c->nextSibling())
@@ -329,8 +342,13 @@ void QSGRenderer::removeNodesToPreprocess(QSGNode *node)
 {
     for (QSGNode *c = node->firstChild(); c; c = c->nextSibling())
         removeNodesToPreprocess(c);
-    if (node->flags() & QSGNode::UsePreprocess)
+    if (node->flags() & QSGNode::UsePreprocess) {
         m_nodes_to_preprocess.remove(node);
+
+        // If preprocessing *now*, mark the node as gone.
+        if (m_is_preprocessing)
+            m_nodes_dont_preprocess.insert(node);
+    }
 }
 
 
diff --git a/src/quick/scenegraph/coreapi/qsgrenderer_p.h b/src/quick/scenegraph/coreapi/qsgrenderer_p.h
index 4589685765..1ea2775e6f 100644
--- a/src/quick/scenegraph/coreapi/qsgrenderer_p.h
+++ b/src/quick/scenegraph/coreapi/qsgrenderer_p.h
@@ -118,11 +118,13 @@ private:
     QSGNodeUpdater *m_node_updater;
 
     QSet<QSGNode *> m_nodes_to_preprocess;
+    QSet<QSGNode *> m_nodes_dont_preprocess;
 
     const QSGBindable *m_bindable;
 
     uint m_changed_emitted : 1;
     uint m_is_rendering : 1;
+    uint m_is_preprocessing : 1;
 };
 
 class Q_QUICK_PRIVATE_EXPORT QSGBindable