Fix crash on exit when centering Popup within Overlay in StackView item

If a Popup is centered within an Overlay, and that Overlay is destroyed
before the Popup, we must make sure centerIn is cleared so we don't try
to access a dangling pointer.

Fixes: QTBUG-84579
Change-Id: Icb2750f847f9d5710725bedc4d1c92bf4c122c03
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
(cherry picked from commit 04901b170e009d844232067446fdd56f270d155d)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

4 files changed, 128 insertions, 1 deletions

diff --git a/src/quicktemplates2/qquickpopupanchors.cpp b/src/quicktemplates2/qquickpopupanchors.cpp
index 5acc2934..c7ac038d 100644
--- a/src/quicktemplates2/qquickpopupanchors.cpp
+++ b/src/quicktemplates2/qquickpopupanchors.cpp
@@ -47,6 +47,15 @@ QQuickPopupAnchors::QQuickPopupAnchors(QQuickPopup *popup)
     d->popup = popup;
 }
 
+QQuickPopupAnchors::~QQuickPopupAnchors()
+{
+    Q_D(const QQuickPopupAnchors);
+    if (d->centerIn) {
+        auto centerInPrivate = QQuickItemPrivate::get(d->centerIn);
+        centerInPrivate->removeItemChangeListener(this, QQuickItemPrivate::Destroyed);
+    }
+}
+
 QQuickItem *QQuickPopupAnchors::centerIn() const
 {
     Q_D(const QQuickPopupAnchors);
@@ -59,8 +68,20 @@ void QQuickPopupAnchors::setCenterIn(QQuickItem *item)
     if (item == d->centerIn)
         return;
 
+    if (d->centerIn) {
+        auto centerInPrivate = QQuickItemPrivate::get(d->centerIn);
+        centerInPrivate->removeItemChangeListener(this, QQuickItemPrivate::Destroyed);
+    }
+
     d->centerIn = item;
+
+    if (d->centerIn) {
+        auto centerInPrivate = QQuickItemPrivate::get(d->centerIn);
+        centerInPrivate->addItemChangeListener(this, QQuickItemPrivate::Destroyed);
+    }
+
     QQuickPopupPrivate::get(d->popup)->reposition();
+
     emit centerInChanged();
 }
 
@@ -69,4 +90,9 @@ void QQuickPopupAnchors::resetCenterIn()
     setCenterIn(nullptr);
 }
 
+void QQuickPopupAnchors::itemDestroyed(QQuickItem *)
+{
+    resetCenterIn();
+}
+
 QT_END_NAMESPACE
diff --git a/src/quicktemplates2/qquickpopupanchors_p.h b/src/quicktemplates2/qquickpopupanchors_p.h
index 531c494e..eff4e23d 100644
--- a/src/quicktemplates2/qquickpopupanchors_p.h
+++ b/src/quicktemplates2/qquickpopupanchors_p.h
@@ -50,6 +50,7 @@
 
 #include <QtCore/qobject.h>
 #include <QtQml/qqml.h>
+#include <QtQuick/private/qquickitem_p.h>
 #include <QtQuickTemplates2/private/qtquicktemplates2global_p.h>
 
 QT_BEGIN_NAMESPACE
@@ -58,13 +59,14 @@ class QQuickItem;
 class QQuickPopupAnchorsPrivate;
 class QQuickPopup;
 
-class Q_QUICKTEMPLATES2_PRIVATE_EXPORT QQuickPopupAnchors : public QObject
+class Q_QUICKTEMPLATES2_PRIVATE_EXPORT QQuickPopupAnchors : public QObject, public QQuickItemChangeListener
 {
     Q_OBJECT
     Q_PROPERTY(QQuickItem *centerIn READ centerIn WRITE setCenterIn RESET resetCenterIn NOTIFY centerInChanged)
 
 public:
     explicit QQuickPopupAnchors(QQuickPopup *popup);
+    ~QQuickPopupAnchors();
 
     QQuickItem *centerIn() const;
     void setCenterIn(QQuickItem *item);
@@ -74,6 +76,8 @@ Q_SIGNALS:
     void centerInChanged();
 
 private:
+    void itemDestroyed(QQuickItem *item) override;
+
     Q_DISABLE_COPY(QQuickPopupAnchors)
     Q_DECLARE_PRIVATE(QQuickPopupAnchors)
 };
diff --git a/tests/auto/qquickpopup/data/centerInOverlayWithinStackViewItem.qml b/tests/auto/qquickpopup/data/centerInOverlayWithinStackViewItem.qml
new file mode 100644
index 00000000..076e2230
--- /dev/null
+++ b/tests/auto/qquickpopup/data/centerInOverlayWithinStackViewItem.qml
@@ -0,0 +1,80 @@
+/****************************************************************************
+**
+** Copyright (C) 2020 The Qt Company Ltd.
+** Contact: https://www.qt.io/licensing/
+**
+** This file is part of the test suite of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:BSD$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and The Qt Company. For licensing terms
+** and conditions see https://www.qt.io/terms-conditions. For further
+** information use the contact form at https://www.qt.io/contact-us.
+**
+** BSD License Usage
+** Alternatively, you may use this file under the terms of the BSD license
+** as follows:
+**
+** "Redistribution and use in source and binary forms, with or without
+** modification, are permitted provided that the following conditions are
+** met:
+**   * Redistributions of source code must retain the above copyright
+**     notice, this list of conditions and the following disclaimer.
+**   * Redistributions in binary form must reproduce the above copyright
+**     notice, this list of conditions and the following disclaimer in
+**     the documentation and/or other materials provided with the
+**     distribution.
+**   * Neither the name of The Qt Company Ltd nor the names of its
+**     contributors may be used to endorse or promote products derived
+**     from this software without specific prior written permission.
+**
+**
+** THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+** "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+** LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+** A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+** OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+** SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+** LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+** DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+** THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+** (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+** OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+import QtQuick 2.15
+import QtQuick.Controls 2.15
+
+ApplicationWindow {
+    width: 400
+    height: 400
+
+    property Popup popup: stackView.currentItem.popup
+
+    StackView {
+        id: stackView
+        objectName: "stackView"
+        anchors.fill: parent
+
+        initialItem: Rectangle {
+            objectName: "rectangle"
+
+            property alias popup: popup
+
+            Popup {
+                id: popup
+                objectName: "popup"
+                width: 100
+                height: 100
+                visible: true
+                anchors.centerIn: Overlay.overlay
+            }
+        }
+    }
+}
diff --git a/tests/auto/qquickpopup/tst_qquickpopup.cpp b/tests/auto/qquickpopup/tst_qquickpopup.cpp
index a1765ead..22e6df5d 100644
--- a/tests/auto/qquickpopup/tst_qquickpopup.cpp
+++ b/tests/auto/qquickpopup/tst_qquickpopup.cpp
@@ -95,6 +95,7 @@ private slots:
     void setOverlayParentToNull();
     void tabFence();
     void invisibleToolTipOpen();
+    void centerInOverlayWithinStackViewItem();
 };
 
 void tst_QQuickPopup::initTestCase()
@@ -1410,6 +1411,22 @@ void tst_QQuickPopup::invisibleToolTipOpen()
     QTRY_VERIFY(mouseArea->property("isToolTipVisible").toBool());
 }
 
+void tst_QQuickPopup::centerInOverlayWithinStackViewItem()
+{
+    QQuickApplicationHelper helper(this, "centerInOverlayWithinStackViewItem.qml");
+    QVERIFY2(helper.ready, helper.failureMessage());
+
+    QQuickWindow *window = helper.window;
+    window->show();
+    QVERIFY(QTest::qWaitForWindowExposed(window));
+
+    QQuickPopup *popup = window->property("popup").value<QQuickPopup*>();
+    QVERIFY(popup);
+    QTRY_COMPARE(popup->isVisible(), true);
+
+    // Shouldn't crash on exit.
+}
+
 QTEST_QUICKCONTROLS_MAIN(tst_QQuickPopup)
 
 #include "tst_qquickpopup.moc"