Fix crash in QGraphicsView BSP discovered in Amarok.

Basically some items were not properly remove in the BSP which means
that if you delete one of items, the BSP tree may contain dangling pointers.
The problem was in removeItemHelper in QGraphicsScene were the child
were removed after reparenting to 0 the topmost parent. The
sceneBoundingRect for children was invalid which means that we were removing
them in the wrong position inside the BSP. Reparenting to 0 means that the
sceneBoundingRect will be the boundingRect but wasn't the case before
(for the topmost parent).

Reviewed-by:bnilsen

1 files changed, 8 insertions, 6 deletions

diff --git a/src/gui/graphicsview/qgraphicsscene.cpp b/src/gui/graphicsview/qgraphicsscene.cpp
index a624b10..03c8a97 100644
--- a/src/gui/graphicsview/qgraphicsscene.cpp
+++ b/src/gui/graphicsview/qgraphicsscene.cpp
@@ -518,6 +518,14 @@ void QGraphicsScenePrivate::removeItemHelper(QGraphicsItem *item)
 
     item->d_func()->scene = 0;
 
+    //We need to remove all children first because they might use their parent
+    //attributes (e.g. sceneTransform).
+    if (!item->d_ptr->inDestructor) {
+        // Remove all children recursively
+        for (int i = 0; i < item->d_ptr->children.size(); ++i)
+            q->removeItem(item->d_ptr->children.at(i));
+    }
+
     // Unregister focus proxy.
     item->d_ptr->resetFocusProxy();
 
@@ -564,12 +572,6 @@ void QGraphicsScenePrivate::removeItemHelper(QGraphicsItem *item)
             ++iterator;
     }
 
-    if (!item->d_ptr->inDestructor) {
-        // Remove all children recursively
-        for (int i = 0; i < item->d_ptr->children.size(); ++i)
-            q->removeItem(item->d_ptr->children.at(i));
-    }
-
     if (item->isPanel() && item->isVisible() && item->panelModality() != QGraphicsItem::NonModal)
         leaveModal(item);