Fix network request completion crashing on a canceled pixmap request

Task-number: QT-3957
reviewed-by: Aaron Kennedy

2 files changed, 29 insertions, 3 deletions

diff --git a/src/declarative/util/qdeclarativepixmapcache.cpp b/src/declarative/util/qdeclarativepixmapcache.cpp
index 4fc52f5..a07b1bb 100644
--- a/src/declarative/util/qdeclarativepixmapcache.cpp
+++ b/src/declarative/util/qdeclarativepixmapcache.cpp
@@ -93,6 +93,7 @@ public:
 
     QDeclarativePixmapData *data;
     QDeclarativePixmapReader *reader;
+    QSize requestSize;
 
     bool loading;
     int redirectCount;
@@ -366,7 +367,7 @@ void QDeclarativePixmapReader::networkRequestDone(QNetworkReply *reply)
             QByteArray all = reply->readAll();
             QBuffer buff(&all);
             buff.open(QIODevice::ReadOnly);
-            if (!readImage(reply->url(), &buff, &image, &errorString, &readSize, job->data->requestSize)) {
+            if (!readImage(reply->url(), &buff, &image, &errorString, &readSize, job->requestSize)) {
                 error = QDeclarativePixmapReply::Decoding;
             }
         }
@@ -683,7 +684,7 @@ void QDeclarativePixmapStore::timerEvent(QTimerEvent *)
 }
 
 QDeclarativePixmapReply::QDeclarativePixmapReply(QDeclarativePixmapData *d)
-: data(d), reader(0), loading(false), redirectCount(0)
+: data(d), reader(0), loading(false), redirectCount(0), requestSize(d->requestSize)
 {
     if (finishedIndex == -1) {
         finishedIndex = QDeclarativePixmapReply::staticMetaObject.indexOfSignal("finished()");
diff --git a/tests/auto/declarative/qdeclarativepixmapcache/tst_qdeclarativepixmapcache.cpp b/tests/auto/declarative/qdeclarativepixmapcache/tst_qdeclarativepixmapcache.cpp
index b20d8ec..50d0731 100644
--- a/tests/auto/declarative/qdeclarativepixmapcache/tst_qdeclarativepixmapcache.cpp
+++ b/tests/auto/declarative/qdeclarativepixmapcache/tst_qdeclarativepixmapcache.cpp
@@ -74,7 +74,7 @@ private slots:
     void massive();
     void cancelcrash();
     void shrinkcache();
-
+    void networkCrash();
 private:
     QDeclarativeEngine engine;
     QUrl thisfile;
@@ -335,6 +335,7 @@ public:
     : QDeclarativeImageProvider(Pixmap) {}
 
     virtual QPixmap requestPixmap(const QString &d, QSize *, const QSize &) {
+        Q_UNUSED(d)
         QPixmap pix(800, 600);
         pix.fill(Qt::red);
         return pix;
@@ -353,6 +354,30 @@ void tst_qdeclarativepixmapcache::shrinkcache()
     }
 }
 
+void createNetworkServer()
+{
+   QEventLoop eventLoop;
+   TestHTTPServer server(14453);
+   server.serveDirectory(SRCDIR "/data/http");
+   QTimer::singleShot(100, &eventLoop, SLOT(quit()));
+   eventLoop.exec();
+}
+
+// QT-3957
+void tst_qdeclarativepixmapcache::networkCrash()
+{
+    QFuture<void> future = QtConcurrent::run(createNetworkServer);
+    QDeclarativeEngine engine;
+    for (int ii = 0; ii < 100 ; ++ii) {
+        QDeclarativePixmap* pixmap = new QDeclarativePixmap;
+        pixmap->load(&engine,  QUrl(QString("http://127.0.0.1:14453/exists.png")));
+        QTest::qSleep(1);
+        pixmap->clear();
+        delete pixmap;
+    }
+    future.cancel();
+}
+
 QTEST_MAIN(tst_qdeclarativepixmapcache)
 
 #include "tst_qdeclarativepixmapcache.moc"