From a86ee60887e1ef0a83931ee761b542b493673c92 Mon Sep 17 00:00:00 2001
From: Laszlo Agocs <laszlo.agocs@qt.io>
Date: Mon, 28 Mar 2022 14:50:18 +0200
Subject: [PATCH] Fix heap-use-after-free with rhi-based backingstore

Task-number: QTBUG-102030
Change-Id: I6b05007c6ae3d653197c5680b9fc5768b0e3690f
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
---
 src/gui/painting/qbackingstorerhisupport.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/gui/painting/qbackingstorerhisupport.cpp b/src/gui/painting/qbackingstorerhisupport.cpp
index 4e87eefc34..9ba060080a 100644
--- a/src/gui/painting/qbackingstorerhisupport.cpp
+++ b/src/gui/painting/qbackingstorerhisupport.cpp
@@ -219,11 +219,12 @@ bool QBackingStoreRhiSupportWindowWatcher::eventFilter(QObject *obj, QEvent *eve
         auto it = m_rhiSupport->m_swapchains.find(window);
         if (it != m_rhiSupport->m_swapchains.end()) {
             qCDebug(lcQpaBackingStore) << "SurfaceAboutToBeDestroyed received for tracked window" << window << "cleaning up swapchain";
-            it->reset();
+            auto data = *it;
             m_rhiSupport->m_swapchains.erase(it);
+            data.reset(); // deletes 'this'
         }
     }
-    return QObject::eventFilter(obj, event);
+    return false;
 }
 
 QSurface::SurfaceType QBackingStoreRhiSupport::surfaceTypeForConfig(const QPlatformBackingStoreRhiConfig &config)