Fix a crash in KDE/Plasma with QGraphicsView. TopLevel list of items

was corrupted.

This nasty bug was triggered when the index sort the top level list of
items. We forgot to set the flag topLevelSequentialOrdering to false
so when an item was removed from the top level list it was using the
sibling index which can be not valid anymore since the list is not
sorted by sequential order. So it let some dangling pointers in the
list which make processDirtyItemRecursive crash the next paint event.

Reviewed-by:bnilsen
Reviewed-by:andreas

2 files changed, 34 insertions, 1 deletions

diff --git a/src/gui/graphicsview/qgraphicsscene_p.h b/src/gui/graphicsview/qgraphicsscene_p.h
index a1d0496..69e4d5b 100644
--- a/src/gui/graphicsview/qgraphicsscene_p.h
+++ b/src/gui/graphicsview/qgraphicsscene_p.h
@@ -78,7 +78,7 @@ class QGraphicsSceneIndex;
 class QGraphicsView;
 class QGraphicsWidget;
 
-class QGraphicsScenePrivate : public QObjectPrivate
+class Q_AUTOTEST_EXPORT QGraphicsScenePrivate : public QObjectPrivate
 {
     Q_DECLARE_PUBLIC(QGraphicsScene)
 public:
@@ -265,6 +265,7 @@ public:
     {
         if (needSortTopLevelItems) {
             qSort(topLevelItems.begin(), topLevelItems.end(), qt_notclosestLeaf);
+            topLevelSequentialOrdering = false;
             needSortTopLevelItems = false;
         }
     }
diff --git a/tests/auto/qgraphicsscene/tst_qgraphicsscene.cpp b/tests/auto/qgraphicsscene/tst_qgraphicsscene.cpp
index 20d9eb8..a8017ff 100644
--- a/tests/auto/qgraphicsscene/tst_qgraphicsscene.cpp
+++ b/tests/auto/qgraphicsscene/tst_qgraphicsscene.cpp
@@ -46,6 +46,8 @@
 #endif
 
 #include <QtGui>
+#include <private/qgraphicsscene_p.h>
+#include <private/qgraphicssceneindex_p.h>
 #include <math.h>
 #include "../../shared/util.h"
 
@@ -269,6 +271,7 @@ private slots:
     void initialFocus();
     void polishItems();
     void isActive();
+    void siblingIndexAlwaysValid();
 
     // task specific tests below me
     void task139710_bspTreeCrash();
@@ -4181,6 +4184,35 @@ void tst_QGraphicsScene::isActive()
 
 }
 
+void tst_QGraphicsScene::siblingIndexAlwaysValid()
+{
+    QGraphicsScene scene;
+
+    QGraphicsWidget *parent = new QGraphicsWidget;
+    parent->setZValue(350);
+    parent->setGeometry(0, 0, 100, 100);
+    QGraphicsWidget *parent2 = new QGraphicsWidget;
+    parent2->setGeometry(10, 10, 50, 50);
+    QGraphicsWidget *child = new QGraphicsWidget(parent2);
+    child->setGeometry(15, 15, 25, 25);
+    child->setZValue(150);
+    //Both are top level
+    scene.addItem(parent);
+    scene.addItem(parent2);
+
+    //Then we make the child a top level
+    child->setParentItem(0);
+
+    //This is trigerred by a repaint...
+    QGraphicsScenePrivate::get(&scene)->index->estimateTopLevelItems(QRectF(), Qt::AscendingOrder);
+
+    delete child;
+
+    //If there are in the list that's bad, we crash...
+    QVERIFY(!QGraphicsScenePrivate::get(&scene)->topLevelItems.contains(static_cast<QGraphicsItem *>(child)));
+
+}
+
 void tst_QGraphicsScene::taskQTBUG_5904_crashWithDeviceCoordinateCache()
 {
     QGraphicsScene scene;