From 20918435b6255c119148c0d2e482aa65235ed4a1 Mon Sep 17 00:00:00 2001
From: Topi Reinio <topi.reinio@digia.com>
Date: Thu, 24 Sep 2015 15:11:16 +0200
Subject: [PATCH] qdoc: Fix write to invalid memory

Before deleting the children of an Aggregate, we must clear its
internal collections first. This prevents removeChild() (called
from ~Node) from accessing already deleted siblings.

Change-Id: Ic657b1d57fe4c766daa2bd4b791c3840099de709
Task-number: QTBUG-47751
Reviewed-by: Martin Smith <martin.smith@digia.com>
---
 src/tools/qdoc/node.cpp | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/tools/qdoc/node.cpp b/src/tools/qdoc/node.cpp
index eec08e3c72..c1cf076f47 100644
--- a/src/tools/qdoc/node.cpp
+++ b/src/tools/qdoc/node.cpp
@@ -121,10 +121,12 @@ void Node::removeRelates()
     if (!relatesTo_)
         return;
 
-    if (relatesTo_->isDocumentNode() && !relatesTo_->parent())
+    if (relatesTo_->isDocumentNode() && !relatesTo_->parent()) {
         delete relatesTo_;
-    else
+        relatesTo_ = 0;
+    } else {
         relatesTo_->removeRelated(this);
+    }
 }
 
 /*!
@@ -739,8 +741,8 @@ void Node::setLocation(const Location& t)
  */
 Aggregate::~Aggregate()
 {
-    deleteChildren();
     removeFromRelated();
+    deleteChildren();
 }
 
 /*!
@@ -1062,7 +1064,13 @@ void Aggregate::removeFromRelated()
  */
 void Aggregate::deleteChildren()
 {
-    NodeList childrenCopy = children_; // `children_` will be changed in ~Node()
+    NodeList childrenCopy = children_;
+    // Clear internal collections before deleting child nodes
+    children_.clear();
+    childMap_.clear();
+    enumChildren_.clear();
+    primaryFunctionMap_.clear();
+    secondaryFunctionMap_.clear();
     qDeleteAll(childrenCopy);
 }