4 files changed, 31 insertions, 3 deletions
diff --git a/src/quick/scenegraph/coreapi/qsgrenderer.cpp b/src/quick/scenegraph/coreapi/qsgrenderer.cpp
index 67bd265801..3ae79a933f 100644
--- a/src/quick/scenegraph/coreapi/qsgrenderer.cpp
+++ b/src/quick/scenegraph/coreapi/qsgrenderer.cpp
@@ -136,6 +136,7 @@ QSGRenderer::QSGRenderer(QSGRenderContext *context)
     , m_bindable(0)
     , m_changed_emitted(false)
     , m_is_rendering(false)
+    , m_is_preprocessing(false)
 {
 }
 
@@ -191,7 +192,7 @@ void QSGRenderer::renderScene(uint fboId)
         class B : public QSGBindable
         {
         public:
-            void bind() const { QOpenGLFramebufferObject::bindDefault(); }
+            void bind() const override { QOpenGLFramebufferObject::bindDefault(); }
         } bindable;
         renderScene(bindable);
     }
@@ -289,6 +290,8 @@ void QSGRenderer::nodeChanged(QSGNode *node, QSGNode::DirtyState state)
 
 void QSGRenderer::preprocess()
 {
+    m_is_preprocessing = true;
+
     QSGRootNode *root = rootNode();
     Q_ASSERT(root);
 
@@ -300,6 +303,11 @@ void QSGRenderer::preprocess()
     for (QSet<QSGNode *>::const_iterator it = items.constBegin();
          it != items.constEnd(); ++it) {
         QSGNode *n = *it;
+
+        // If we are currently preprocessing, check this node hasn't been
+        // deleted or something. we don't want a use-after-free!
+        if (m_nodes_dont_preprocess.contains(n)) // skip
+            continue;
         if (!nodeUpdater()->isNodeBlocked(n, root)) {
             n->preprocess();
         }
@@ -317,8 +325,13 @@ void QSGRenderer::preprocess()
         updatePassTime = frameTimer.nsecsElapsed();
     Q_QUICK_SG_PROFILE_RECORD(QQuickProfiler::SceneGraphRendererFrame,
                               QQuickProfiler::SceneGraphRendererUpdate);
+
+    m_is_preprocessing = false;
+    m_nodes_dont_preprocess.clear();
 }
 
+
+
 void QSGRenderer::addNodesToPreprocess(QSGNode *node)
 {
     for (QSGNode *c = node->firstChild(); c; c = c->nextSibling())
@@ -331,8 +344,13 @@ void QSGRenderer::removeNodesToPreprocess(QSGNode *node)
 {
     for (QSGNode *c = node->firstChild(); c; c = c->nextSibling())
         removeNodesToPreprocess(c);
-    if (node->flags() & QSGNode::UsePreprocess)
+    if (node->flags() & QSGNode::UsePreprocess) {
         m_nodes_to_preprocess.remove(node);
+
+        // If preprocessing *now*, mark the node as gone.
+        if (m_is_preprocessing)
+            m_nodes_dont_preprocess.insert(node);
+    }
 }
 
 
diff --git a/src/quick/scenegraph/coreapi/qsgrenderer_p.h b/src/quick/scenegraph/coreapi/qsgrenderer_p.h
index d96d893ca5..1cb4c56316 100644
--- a/src/quick/scenegraph/coreapi/qsgrenderer_p.h
+++ b/src/quick/scenegraph/coreapi/qsgrenderer_p.h
@@ -119,11 +119,13 @@ private:
     QSGNodeUpdater *m_node_updater;
 
     QSet<QSGNode *> m_nodes_to_preprocess;
+    QSet<QSGNode *> m_nodes_dont_preprocess;
 
     const QSGBindable *m_bindable;
 
     uint m_changed_emitted : 1;
     uint m_is_rendering : 1;
+    uint m_is_preprocessing : 1;
 };
 
 class Q_QUICK_PRIVATE_EXPORT QSGBindable
diff --git a/src/quick/scenegraph/coreapi/qsgrendernode.cpp b/src/quick/scenegraph/coreapi/qsgrendernode.cpp
index 1bc0210b72..a8954848d6 100644
--- a/src/quick/scenegraph/coreapi/qsgrendernode.cpp
+++ b/src/quick/scenegraph/coreapi/qsgrendernode.cpp
@@ -267,6 +267,10 @@ QSGRenderNode::RenderingFlags QSGRenderNode::flags() const
     For rendernodes covering the entire area of a corresponding QQuickItem the
     return value will be (0, 0, item->width(), item->height()).
 
+    \note Nodes are also free to render outside the boundaries specified by the
+    item's width and height, since the scenegraph nodes are not bounded by the
+    QQuickItem geometry, as long as this is reported correctly from this function.
+
     \sa flags()
 */
 QRectF QSGRenderNode::rect() const
@@ -359,7 +363,10 @@ QSGRenderNode::RenderState::~RenderState()
     of the render state is not in use. However, the clip region that can be set
     on the QPainter still has to be communicated since reconstructing this
     manually in render() is not reasonable. It can therefore be queried via
-    this function.
+    this function. The region is in world coordinates and can be passed
+    to QPainter::setClipRegion() with Qt::ReplaceClip. This must be done before
+    calling QPainter::setTransform() since the clip region is already mapped to
+    the transform provided in QSGRenderNode::matrix().
  */
 
 /*!
diff --git a/src/quick/scenegraph/coreapi/qsgshaderrewriter.cpp b/src/quick/scenegraph/coreapi/qsgshaderrewriter.cpp
index 2b70139b37..1fdc1720f7 100644
--- a/src/quick/scenegraph/coreapi/qsgshaderrewriter.cpp
+++ b/src/quick/scenegraph/coreapi/qsgshaderrewriter.cpp
@@ -38,6 +38,7 @@
 ****************************************************************************/
 
 #include <QtCore/QByteArray>
+#include <QtCore/QString>
 #include <QtGui/QSurfaceFormat>
 
 // Duct Tape tokenizer for the purpose of parsing and rewriting