Properly protect access to pixmap reader thread with mutex

Previously, access to the data from the reader thread wasn't guarded
properly, causing a crash when the reader thread was deleted prior to
QDeclarativePixmapData (which then attempted to dereference the
thread pointer to cancel the request), or in the case where a
QDeclarativePixmapData was deleted after its QDeclarativePixmapReply
was removed from the jobs queue but prior to processing.

Reviewed-by: Martin Jones
Task-number: QTBUG-22125

2 files changed, 85 insertions, 0 deletions

diff --git a/tests/auto/declarative/qdeclarativeimage/data/qtbug_22125.qml b/tests/auto/declarative/qdeclarativeimage/data/qtbug_22125.qml
new file mode 100644
index 0000000000..8588028286
--- /dev/null
+++ b/tests/auto/declarative/qdeclarativeimage/data/qtbug_22125.qml
@@ -0,0 +1,44 @@
+import QtQuick 1.1
+
+Item {
+    id: root
+    width: 800
+    height: 800
+
+    GridView {
+        anchors.fill: parent
+        delegate: Image {
+            source: imagePath;
+            asynchronous: true
+            smooth: true
+            width: 200
+            height: 200
+        }
+        model: ListModel {
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/big256.png"
+            }
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/big256.png"
+            }
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/big256.png"
+            }
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/colors.png"
+            }
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/colors1.png"
+            }
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/big.jpeg"
+            }
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/heart.png"
+            }
+            ListElement {
+                imagePath: "http://127.0.0.1:14451/green.png"
+            }
+        }
+    }
+}
diff --git a/tests/auto/declarative/qdeclarativeimage/tst_qdeclarativeimage.cpp b/tests/auto/declarative/qdeclarativeimage/tst_qdeclarativeimage.cpp
index a35d69a135..f67c5b510c 100644
--- a/tests/auto/declarative/qdeclarativeimage/tst_qdeclarativeimage.cpp
+++ b/tests/auto/declarative/qdeclarativeimage/tst_qdeclarativeimage.cpp
@@ -94,6 +94,7 @@ private slots:
     void resetSourceSize();
     void testQtQuick11Attributes();
     void testQtQuick11Attributes_data();
+    void readerCrash_QTBUG_22125();
 
 private:
     template<typename T>
@@ -762,6 +763,46 @@ void tst_qdeclarativeimage::testQtQuick11Attributes_data()
         << ":1 \"Image.cache\" is not available in QtQuick 1.0.\n";
 }
 
+void tst_qdeclarativeimage::readerCrash_QTBUG_22125()
+{
+    {
+        TestHTTPServer server(SERVER_PORT);
+        QVERIFY(server.isValid());
+        server.serveDirectory(SRCDIR "/data/", TestHTTPServer::Delay);
+
+        {
+            QDeclarativeView view(QUrl::fromLocalFile(SRCDIR "/data/qtbug_22125.qml"));
+            view.show();
+            qApp->processEvents();
+            qApp->processEvents();
+            // shouldn't crash when the view drops out of scope due to
+            // QDeclarativePixmapData attempting to dereference a pointer to
+            // the destroyed reader.
+        }
+
+        // shouldn't crash when deleting cancelled QDeclarativePixmapReplys.
+        QTest::qWait(1000);
+        qApp->processEvents(QEventLoop::DeferredDeletion);
+    }
+
+    {
+        TestHTTPServer server(SERVER_PORT);
+        QVERIFY(server.isValid());
+        server.serveDirectory(SRCDIR "/data/");
+
+        {
+            QDeclarativeView view(QUrl::fromLocalFile(SRCDIR "/data/qtbug_22125.qml"));
+            view.show();
+            qApp->processEvents();
+            QTest::qWait(1000);
+            qApp->processEvents();
+            // shouldn't crash when the view drops out of scope due to
+            // the reader thread accessing self-deleted QDeclarativePixmapReplys.
+        }
+        qApp->processEvents();
+    }
+}
+
 /*
    Find an item with the specified objectName.  If index is supplied then the
    item must also evaluate the {index} expression equal to index