Fixed crash on destruction of animating QDockWidget in a QMainWindow

It doesn't make sense to hold an unguarded pointer to a
QPropertyAnimation while assigning ownership of that animation to the
animated widget.

Destruction of the widget while the animation is in progress causes
the animation pointer to become dangling; then the widget is removed
from the containing QMainWindowLayout, which attempts to abort the
animation, dereferencing the invalid pointer.

The crash can be reproduced sometimes with
tst_QDockWidget::taskQTBUG_2940_resizeAfterUndocking (which is in
Qt4 only).

(cherry-picked from qtbase 33214af3784feacb2d5188bbf07da92f45f582f9)

Change-Id: Ia886f64fdb6720914a46bc7f32c71cf4fc81c28d
Reviewed-by: Andy Shaw <andy.shaw@digia.com>
Reviewed-by: Robin Burchell <robin+qt@viroteck.net>

2 files changed, 5 insertions, 2 deletions

diff --git a/src/gui/widgets/qwidgetanimator.cpp b/src/gui/widgets/qwidgetanimator.cpp
index 81d94ba..073b24c 100644
--- a/src/gui/widgets/qwidgetanimator.cpp
+++ b/src/gui/widgets/qwidgetanimator.cpp
@@ -59,7 +59,9 @@ void QWidgetAnimator::abort(QWidget *w)
         return;
     QPropertyAnimation *anim = *it;
     m_animation_map.erase(it);
-    anim->stop();
+    if (anim) {
+        anim->stop();
+    }
 #ifndef QT_NO_MAINWINDOW
     m_mainWindowLayout->animationFinished(w);
 #endif
diff --git a/src/gui/widgets/qwidgetanimator_p.h b/src/gui/widgets/qwidgetanimator_p.h
index c3d4c0d..9528415 100644
--- a/src/gui/widgets/qwidgetanimator_p.h
+++ b/src/gui/widgets/qwidgetanimator_p.h
@@ -55,6 +55,7 @@
 
 #include <qobject.h>
 #include <qmap.h>
+#include <qpointer.h>
 
 QT_BEGIN_NAMESPACE
 
@@ -79,7 +80,7 @@ private Q_SLOTS:
 #endif
 
 private:
-    typedef QMap<QWidget*, QPropertyAnimation*> AnimationMap;
+    typedef QMap<QWidget*, QPointer<QPropertyAnimation> > AnimationMap;
     AnimationMap m_animation_map;
     QMainWindowLayout *m_mainWindowLayout;
 };