QGraphicsItem: When an item is deleted and eventfilters installed

The problem here is that we are filling the sceneEventFilters map
when we install evenfilter but we never remove the references of an
item if it has been removed from the scene or deleted. The deletion can
keep stale pointers into the map and a crash can happen.

BT:yes
Task-number:250272
Reviewed-by: bnilsen
Reviewed-by: andreas
(cherry picked from commit 0bb526f8fab33a42df56c8a60c272e2cca4cc792)

1 files changed, 19 insertions, 0 deletions

diff --git a/src/gui/graphicsview/qgraphicsscene.cpp b/src/gui/graphicsview/qgraphicsscene.cpp
index 25c8030..96710a4 100644
--- a/src/gui/graphicsview/qgraphicsscene.cpp
+++ b/src/gui/graphicsview/qgraphicsscene.cpp
@@ -740,6 +740,15 @@ void QGraphicsScenePrivate::_q_removeItemLater(QGraphicsItem *item)
     unpolishedItems.removeAll(item);
     dirtyItems.removeAll(item);
 
+    //We remove all references of item from the sceneEventFilter arrays
+    QMultiMap<QGraphicsItem*, QGraphicsItem*>::iterator iterator = sceneEventFilters.begin();
+    while (iterator != sceneEventFilters.end()) {
+        if (iterator.value() == item || iterator.key() == item)
+            iterator = sceneEventFilters.erase(iterator);
+        else
+            ++iterator;
+    }
+
     // Remove from scene transform cache
     int transformIndex = item->d_func()->sceneTransformIndex;
     if (transformIndex != -1) {
@@ -3154,6 +3163,16 @@ void QGraphicsScene::removeItem(QGraphicsItem *item)
     d->unpolishedItems.removeAll(item);
     d->dirtyItems.removeAll(item);
 
+    //We remove all references of item from the sceneEventFilter arrays
+    QMultiMap<QGraphicsItem*, QGraphicsItem*>::iterator iterator = d->sceneEventFilters.begin();
+    while (iterator != d->sceneEventFilters.end()) {
+        if (iterator.value() == item || iterator.key() == item)
+            iterator = d->sceneEventFilters.erase(iterator);
+        else
+            ++iterator;
+    }
+
+
     //Ensure dirty flag have the correct default value so the next time it will be added it will receive updates
     item->d_func()->dirty = 0;
     item->d_func()->dirtyChildren = 0;