Correct ownership of signal handlers in state changes.

When a state uses override, we may apply the same replacesignalhandler
on top of itself. Make sure we update ownership accordingly.

Task-number: QTBUG-10523

2 files changed, 40 insertions, 0 deletions

diff --git a/tests/auto/declarative/qdeclarativestates/data/signalOverrideCrash2.qml b/tests/auto/declarative/qdeclarativestates/data/signalOverrideCrash2.qml
new file mode 100644
index 0000000..2215ee4
--- /dev/null
+++ b/tests/auto/declarative/qdeclarativestates/data/signalOverrideCrash2.qml
@@ -0,0 +1,24 @@
+import Qt 4.7
+
+Rectangle {
+    id: myRect
+    width: 400
+    height: 400
+
+    states: [
+        State {
+            name: "state1"
+            PropertyChanges {
+                target: myRect
+                onHeightChanged: console.log("Hello World")
+                color: "green"
+            }
+        },
+        State {
+            name: "state2"; extend: "state1"
+            PropertyChanges {
+                target: myRect
+                color: "red"
+        }
+    }]
+}
diff --git a/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp b/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp
index 13992ad..ea074a4 100644
--- a/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp
+++ b/tests/auto/declarative/qdeclarativestates/tst_qdeclarativestates.cpp
@@ -87,6 +87,7 @@ private slots:
     void basicBinding();
     void signalOverride();
     void signalOverrideCrash();
+    void signalOverrideCrash2();
     void parentChange();
     void parentChangeErrors();
     void anchorChanges();
@@ -449,6 +450,21 @@ void tst_qdeclarativestates::signalOverrideCrash()
     rect->doSomething();
 }
 
+void tst_qdeclarativestates::signalOverrideCrash2()
+{
+    QDeclarativeEngine engine;
+
+    QDeclarativeComponent rectComponent(&engine, SRCDIR "/data/signalOverrideCrash2.qml");
+    QDeclarativeRectangle *rect = qobject_cast<QDeclarativeRectangle*>(rectComponent.create());
+    QVERIFY(rect != 0);
+
+    QDeclarativeItemPrivate::get(rect)->setState("state1");
+    QDeclarativeItemPrivate::get(rect)->setState("state2");
+    QDeclarativeItemPrivate::get(rect)->setState("state1");
+
+    delete rect;
+}
+
 void tst_qdeclarativestates::parentChange()
 {
     QDeclarativeEngine engine;