From b595aca695d9bd2302c3e6921b8c63c0bbb1c8bf Mon Sep 17 00:00:00 2001
From: Volker Hilsheimer <volker.hilsheimer@qt.io>
Date: Wed, 17 Nov 2021 11:05:35 +0100
Subject: Unset the QQmlAnimationTimer pointer from unregistered jobs

Amends 4b125a5bfdd935d260118406c343535e76023200, which reset the pointer
in registered jobs when the timer was destroyed. However, if a job is
unregistered explicitly before the timer is destroyed, then the job's
m_timer pointer might still be a dangling pointer, resulting in a crash
when the job is reactivated later.

So clear the job's pointer to QQmlAnimationTimer whenever it is
unregistered from the timer. Since a running job can then have a nullptr
timer, only assert in the job's destructor if the timer is not nullptr.

Introduce a test case that reliably crashes without the fix. The test
is added to the QQuickAnimation test as it uses a Qt Quick UI.

Fixes: QTBUG-98248
Change-Id: Ief991900c50aefd480d9c79e83324968102ca29c
(cherry picked from commit 9c732286ed72afe8cc2d2062e6cedbe5f6a06447)
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
---
 .../data/cleanupWhenRenderThreadStops.qml          | 32 ++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 tests/auto/quick/qquickanimations/data/cleanupWhenRenderThreadStops.qml

(limited to 'tests/auto/quick/qquickanimations/data/cleanupWhenRenderThreadStops.qml')

diff --git a/tests/auto/quick/qquickanimations/data/cleanupWhenRenderThreadStops.qml b/tests/auto/quick/qquickanimations/data/cleanupWhenRenderThreadStops.qml
new file mode 100644
index 0000000000..4cfb59aeab
--- /dev/null
+++ b/tests/auto/quick/qquickanimations/data/cleanupWhenRenderThreadStops.qml
@@ -0,0 +1,32 @@
+//main.qml
+
+import QtQuick 2.12
+import QtQuick.Window 2.12
+
+Item {
+    id: root
+    width: 640
+    height: 480
+    visible: true
+    property bool running : false
+
+    Rectangle {
+        id: rect
+        anchors.fill: parent
+        color: "red"
+
+        Component.onCompleted: {
+            anim.start()
+            running = true
+        }
+    }
+
+    OpacityAnimator {
+        id: anim
+
+        target: rect
+        from: 1
+        to: 0
+        duration: 20000
+    }
+}
-- 
cgit v1.2.3