MediaPlayer: fix crash on pause() call in onPositionChanged handler

Once a second QMediaObjectPrivate iterates through the properties
registered with QMediaObject::addPropertyWatch call and invokes their
%propertyName%Changed signals. It does it using C++11 range-based for
loop. MediaPlayer::pause() and MediaPlayer::stop() calls led to
removePropertyWatch(“position”) call, which removed “position” property
index from notifyProperties container and invalidated iterator in the
loop.

Task-number: QTBUG-57045
Change-Id: I855aa004a30dc78b61dbd3423dae0a771e68fda4
Reviewed-by: Yoann Lopes <yoann.lopes@qt.io>

1 files changed, 7 insertions, 1 deletions

diff --git a/src/multimedia/qmediaobject.cpp b/src/multimedia/qmediaobject.cpp
index a2f0d58aa..71b2d148c 100644
--- a/src/multimedia/qmediaobject.cpp
+++ b/src/multimedia/qmediaobject.cpp
@@ -55,7 +55,13 @@ void QMediaObjectPrivate::_q_notify()
 
     const QMetaObject* m = q->metaObject();
 
-    for (int pi : qAsConst(notifyProperties)) {
+    // QTBUG-57045
+    // we create a copy of notifyProperties container to ensure that if a property is removed
+    // from the original container as a result of invoking propertyChanged signal, the iterator
+    // won't become invalidated
+    QSet<int> properties = notifyProperties;
+
+    for (int pi : qAsConst(properties)) {
         QMetaProperty p = m->property(pi);
         p.notifySignal().invoke(
             q, QGenericArgument(QMetaType::typeName(p.userType()), p.read(q).data()));