Canceling image download while reading causes crash

We were deleting a QObject owned by another thread, which is fine if
there are no pending events, but very bad if there are, e.g.
queued signals due to downloadProgress() updates.  Use deleteLater()
which is safe to call in any thread.
Also call QDeclarativePixmap::clear(QObject *obj) where appropriate
to remove connections and ensure we don't handle any unwanted signals
after the download is cancelled.

Change-Id: Ia8fb41a8cd004d9840e7cec35915f1afdb03ac4d
Task-number: QTBUG-18412
Reviewed-by: Aaron Kennedy

3 files changed, 7 insertions, 3 deletions

diff --git a/src/declarative/graphicsitems/qdeclarativeborderimage.cpp b/src/declarative/graphicsitems/qdeclarativeborderimage.cpp
index 8f37e90..45a03a0 100644
--- a/src/declarative/graphicsitems/qdeclarativeborderimage.cpp
+++ b/src/declarative/graphicsitems/qdeclarativeborderimage.cpp
@@ -300,7 +300,7 @@ void QDeclarativeBorderImage::load()
     }
 
     if (d->url.isEmpty()) {
-        d->pix.clear();
+        d->pix.clear(this);
         d->status = Null;
         setImplicitWidth(0);
         setImplicitHeight(0);
@@ -340,6 +340,7 @@ void QDeclarativeBorderImage::load()
                 options |= QDeclarativePixmap::Asynchronous;
             if (d->cache)
                 options |= QDeclarativePixmap::Cache;
+            d->pix.clear(this);
             d->pix.load(qmlEngine(this), d->url, options);
 
             if (d->pix.isLoading()) {
@@ -472,6 +473,7 @@ void QDeclarativeBorderImage::setGridScaledImage(const QDeclarativeGridScaledIma
             options |= QDeclarativePixmap::Asynchronous;
         if (d->cache)
             options |= QDeclarativePixmap::Cache;
+        d->pix.clear(this);
         d->pix.load(qmlEngine(this), d->sciurl, options);
 
         if (d->pix.isLoading()) {
diff --git a/src/declarative/graphicsitems/qdeclarativeimagebase.cpp b/src/declarative/graphicsitems/qdeclarativeimagebase.cpp
index 2de3ba0..8f4416f 100644
--- a/src/declarative/graphicsitems/qdeclarativeimagebase.cpp
+++ b/src/declarative/graphicsitems/qdeclarativeimagebase.cpp
@@ -176,7 +176,7 @@ void QDeclarativeImageBase::load()
     Q_D(QDeclarativeImageBase);
 
     if (d->url.isEmpty()) {
-        d->pix.clear();
+        d->pix.clear(this);
         d->status = Null;
         d->progress = 0.0;
         setImplicitWidth(0);
@@ -191,6 +191,7 @@ void QDeclarativeImageBase::load()
             options |= QDeclarativePixmap::Asynchronous;
         if (d->cache)
             options |= QDeclarativePixmap::Cache;
+        d->pix.clear(this);
         d->pix.load(qmlEngine(this), d->url, d->explicitSourceSize ? sourceSize() : QSize(), options);
 
         if (d->pix.isLoading()) {
diff --git a/src/declarative/util/qdeclarativepixmapcache.cpp b/src/declarative/util/qdeclarativepixmapcache.cpp
index 5190eab..9221d78 100644
--- a/src/declarative/util/qdeclarativepixmapcache.cpp
+++ b/src/declarative/util/qdeclarativepixmapcache.cpp
@@ -426,7 +426,8 @@ void QDeclarativePixmapReader::processJobs()
                     replies.remove(reply);
                     reply->close();
                 }
-                delete job;
+                // deleteLater, since not owned by this thread
+                job->deleteLater();
             }
             cancelled.clear();
         }