QGraphicsItem: When an item is deleted and eventfilters installed

The problem here is that we are filling the sceneEventFilters map
when we install evenfilter but we never remove the references of an
item if it has been removed from the scene or deleted. The deletion can
keep stale pointers into the map and a crash can happen.

BT:yes
Task-number:250272
Reviewed-by: bnilsen
Reviewed-by: andreas

1 files changed, 19 insertions, 0 deletions

diff --git a/src/gui/graphicsview/qgraphicsscene.cpp b/src/gui/graphicsview/qgraphicsscene.cpp
index a5fec69..9881960 100644
--- a/src/gui/graphicsview/qgraphicsscene.cpp
+++ b/src/gui/graphicsview/qgraphicsscene.cpp
@@ -746,6 +746,15 @@ void QGraphicsScenePrivate::_q_removeItemLater(QGraphicsItem *item)
     unpolishedItems.removeAll(item);
     dirtyItems.removeAll(item);
 
+    //We remove all references of item from the sceneEventFilter arrays
+    QMultiMap<QGraphicsItem*, QGraphicsItem*>::iterator iterator = sceneEventFilters.begin();
+    while (iterator != sceneEventFilters.end()) {
+        if (iterator.value() == item || iterator.key() == item)
+            iterator = sceneEventFilters.erase(iterator);
+        else
+            ++iterator;
+    }
+
     // Remove from scene transform cache
     int transformIndex = item->d_func()->sceneTransformIndex;
     if (transformIndex != -1) {
@@ -3293,6 +3302,16 @@ void QGraphicsScene::removeItem(QGraphicsItem *item)
     d->unpolishedItems.removeAll(item);
     d->dirtyItems.removeAll(item);
 
+    //We remove all references of item from the sceneEventFilter arrays
+    QMultiMap<QGraphicsItem*, QGraphicsItem*>::iterator iterator = d->sceneEventFilters.begin();
+    while (iterator != d->sceneEventFilters.end()) {
+        if (iterator.value() == item || iterator.key() == item)
+            iterator = d->sceneEventFilters.erase(iterator);
+        else
+            ++iterator;
+    }
+
+
     //Ensure dirty flag have the correct default value so the next time it will be added it will receive updates
     item->d_func()->dirty = 0;
     item->d_func()->dirtyChildren = 0;