From 29c61f83c98c269c1c862a668c0a91a1027ee2d2 Mon Sep 17 00:00:00 2001
From: Tom Scheler <dd-tom@web.de>
Date: Sun, 19 May 2019 18:16:34 +0200
Subject: Fix read access violation when using KeyNavigation attached property

Setting the KeyNavigation.up property of an item to another item will
implicitly set the reverse (KeyNavigation.down) property on that other
item pointing back to the item. Once the item is destroyed, you will
have an invalid pointer stored in the other item pointing to the
destroyed item.

Using QPointer<> instead of raw pointers fixes that issue, because
they will become null on QObject's destruction.

Added QQuickItem test that verifies the issue is solved.

Fixes: QTBUG-75399
Change-Id: Ibb3e976c4eb9fcd81604bcc2eb757257d3653930
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
---
 src/quick/items/qquickitem_p.h | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

(limited to 'src/quick')

diff --git a/src/quick/items/qquickitem_p.h b/src/quick/items/qquickitem_p.h
index 771228914b..f618bcf1c3 100644
--- a/src/quick/items/qquickitem_p.h
+++ b/src/quick/items/qquickitem_p.h
@@ -75,6 +75,7 @@
 #include <QtCore/qlist.h>
 #include <QtCore/qdebug.h>
 #include <QtCore/qelapsedtimer.h>
+#include <QtCore/qpointer.h>
 
 #if QT_CONFIG(quick_shadereffect)
 #include <QtQuick/private/qquickshadereffectsource_p.h>
@@ -682,12 +683,12 @@ public:
         : leftSet(false), rightSet(false), upSet(false), downSet(false),
           tabSet(false), backtabSet(false) {}
 
-    QQuickItem *left = nullptr;
-    QQuickItem *right = nullptr;
-    QQuickItem *up = nullptr;
-    QQuickItem *down = nullptr;
-    QQuickItem *tab = nullptr;
-    QQuickItem *backtab = nullptr;
+    QPointer<QQuickItem> left;
+    QPointer<QQuickItem> right;
+    QPointer<QQuickItem> up;
+    QPointer<QQuickItem> down;
+    QPointer<QQuickItem> tab;
+    QPointer<QQuickItem> backtab;
     bool leftSet : 1;
     bool rightSet : 1;
     bool upSet : 1;
-- 
cgit v1.2.3