Prevented QWizard from crashing upon removing a page after deleting a field object.

QWizard crashed when removing a page after deleting an object
that was already registered as a field for the page. This patch
prevents such a crash by doing the necessary cleanup immediately
when the object is deleted. QWizard::removePage() will then see a
consistent state in this case.

Reviewed-by: janarve
Task-number: 255350

3 files changed, 48 insertions, 0 deletions

diff --git a/src/gui/dialogs/qwizard.cpp b/src/gui/dialogs/qwizard.cpp
index 2387134..6859fc9 100644
--- a/src/gui/dialogs/qwizard.cpp
+++ b/src/gui/dialogs/qwizard.cpp
@@ -560,6 +560,7 @@ public:
     void enableUpdates();
     void _q_emitCustomButtonClicked();
     void _q_updateButtonStates();
+    void _q_handleFieldObjectDestroyed(QObject *);
     void setStyle(QStyle *style);
 #ifdef Q_WS_MAC
     static QPixmap findDefaultBackgroundPixmap();
@@ -731,6 +732,8 @@ void QWizardPrivate::cleanupPagesNotInHistory()
 
 void QWizardPrivate::addField(const QWizardField &field)
 {
+    Q_Q(QWizard);
+
     QWizardField myField = field;
     myField.resolve(defaultPropertyTable);
 
@@ -744,15 +747,23 @@ void QWizardPrivate::addField(const QWizardField &field)
     if (myField.mandatory && !myField.changedSignal.isEmpty())
         QObject::connect(myField.object, myField.changedSignal,
                          myField.page, SLOT(_q_maybeEmitCompleteChanged()));
+    QObject::connect(
+        myField.object, SIGNAL(destroyed(QObject *)), q,
+        SLOT(_q_handleFieldObjectDestroyed(QObject *)));
 }
 
 void QWizardPrivate::removeFieldAt(int index)
 {
+    Q_Q(QWizard);
+
     const QWizardField &field = fields.at(index);
     fieldIndexMap.remove(field.name);
     if (field.mandatory && !field.changedSignal.isEmpty())
         QObject::disconnect(field.object, field.changedSignal,
                             field.page, SLOT(_q_maybeEmitCompleteChanged()));
+    QObject::disconnect(
+        field.object, SIGNAL(destroyed(QObject *)), q,
+        SLOT(_q_handleFieldObjectDestroyed(QObject *)));
     fields.remove(index);
 }
 
@@ -1591,6 +1602,20 @@ void QWizardPrivate::_q_updateButtonStates()
     enableUpdates();
 }
 
+void QWizardPrivate::_q_handleFieldObjectDestroyed(QObject *object)
+{
+    QVector<QWizardField>::iterator it = fields.begin();
+    while (it != fields.end()) {
+        const QWizardField &field = *it;
+        if (field.object == object) {
+            fieldIndexMap.remove(field.name);
+            it = fields.erase(it);
+        } else {
+            ++it;
+        }
+    }
+}
+
 void QWizardPrivate::setStyle(QStyle *style)
 {
     for (int i = 0; i < QWizard::NButtons; i++)
diff --git a/src/gui/dialogs/qwizard.h b/src/gui/dialogs/qwizard.h
index 1d1a9b5..d1f9cf7 100644
--- a/src/gui/dialogs/qwizard.h
+++ b/src/gui/dialogs/qwizard.h
@@ -197,6 +197,7 @@ private:
     Q_DECLARE_PRIVATE(QWizard)
     Q_PRIVATE_SLOT(d_func(), void _q_emitCustomButtonClicked())
     Q_PRIVATE_SLOT(d_func(), void _q_updateButtonStates())
+    Q_PRIVATE_SLOT(d_func(), void _q_handleFieldObjectDestroyed(QObject *))
 
     friend class QWizardPage;
 };
diff --git a/tests/auto/qwizard/tst_qwizard.cpp b/tests/auto/qwizard/tst_qwizard.cpp
index 71e1c3e..e5074b3 100644
--- a/tests/auto/qwizard/tst_qwizard.cpp
+++ b/tests/auto/qwizard/tst_qwizard.cpp
@@ -112,6 +112,7 @@ private slots:
     void task161658_alignments();
     void task177022_setFixedSize();
     void task248107_backButton();
+    void task255350_fieldObjectDestroyed();
 
     /*
         Things that could be added:
@@ -2517,5 +2518,26 @@ void tst_QWizard::task248107_backButton()
     QCOMPARE(wizard.currentPage(), &page1);
 }
 
+class WizardPage_task255350 : public QWizardPage
+{
+public:
+    QLineEdit *lineEdit;
+    WizardPage_task255350()
+        : lineEdit(new QLineEdit)
+    {
+        registerField("dummy*", lineEdit);
+    }
+};
+
+void tst_QWizard::task255350_fieldObjectDestroyed()
+{
+    QWizard wizard;
+    WizardPage_task255350 *page = new WizardPage_task255350;
+    int id = wizard.addPage(page);
+    delete page->lineEdit;
+    wizard.removePage(id); // don't crash!
+    delete page;
+}
+
 QTEST_MAIN(tst_QWizard)
 #include "tst_qwizard.moc"