From 56a167d30c48e163f6abd089b68edda3ed9d5be1 Mon Sep 17 00:00:00 2001 From: Oliver Wolff Date: Thu, 24 Nov 2016 15:44:57 +0100 Subject: [PATCH] winrt: Check for removed timers after sending events After all the check makes sense here. If a timer was removed as a result of sendEvent and it was not at the end of the list the list is not shrunk but the timer info's id is just set to INVALID_TIMER_ID. Additionally the timer's object should be fetched before we unlock the locker as timerIdToObject is changed in removeTimer and we might access a nullptr if the timer has been removed. Reverts c83ba01f7bc542368973f3f24dfb59c6052dd78a Task-number: QTBUG-56756 Change-Id: Ib1a04c02fbfcf4c939b4891d42f954dc9e87149e (cherry picked from commit 8f2088db171a6941feb1903a2912a8b7fdf3a9ec) Reviewed-by: Maurice Kalinowski --- src/corelib/kernel/qeventdispatcher_winrt.cpp | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/corelib/kernel/qeventdispatcher_winrt.cpp b/src/corelib/kernel/qeventdispatcher_winrt.cpp index ff397fc750..33753ed507 100644 --- a/src/corelib/kernel/qeventdispatcher_winrt.cpp +++ b/src/corelib/kernel/qeventdispatcher_winrt.cpp @@ -166,7 +166,7 @@ private: timerIdToHandle.insert(id, handle); timerIdToCancelHandle.insert(id, cancelHandle); } - timerIdToObject.insert(id, obj); + const quint64 targetTime = qt_msectime() + interval; const WinRTTimerInfo info(id, interval, type, obj, targetTime); QMutexLocker locker(&timerInfoLock); @@ -587,15 +587,18 @@ bool QEventDispatcherWinRT::event(QEvent *e) break; info.inEvent = true; + QObject *timerObj = d->timerIdToObject.value(id); locker.unlock(); QTimerEvent te(id); - QCoreApplication::sendEvent(d->timerIdToObject.value(id), &te); + QCoreApplication::sendEvent(timerObj, &te); locker.relock(); - // The timer might have been removed in the meanwhile - if (id >= d->timerInfos.size()) + // The timer might have been removed in the meanwhile. If the timer was + // the last one in the list, id is bigger than the list's size. + // Otherwise, the id will just be set to INVALID_TIMER_ID. + if (id >= d->timerInfos.size() || info.timerId == INVALID_TIMER_ID) break; if (info.interval == 0 && info.inEvent) {