[crash] QContactManager is accessed after deletion

[Matthias Gehre]

If QContactManager is freed before it completed doing whatever it does for initialization, it crashes. Valgrind output and sample application is attached.

-- Valgrind output
valgrind --track-origins=yes --num-callers=40 --db-attach=yes --read-var-info=yes ./contact_crash
==2464== Memcheck, a memory error detector
==2464== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==2464== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==2464== Command: ./contact_crash
==2464==
Creating a new folks engine
==2464== Invalid read of size 8
==2464== at 0x4E785AC: QtContacts::QContactManagerEngine::managerUri() const (in /usr/lib/x86_64-linux-gnu/libQt5Contacts.so.5.0.0)
==2464== by 0x95BB28A: Folks::ManagerEngine::addIndividual(_FolksIndividual*) (in /usr/lib/x86_64-linux-gnu/qt5/plugins/contacts/libqtcontacts_folks.so)
==2464== by 0x95BB075: Folks::ManagerEngine::individualsChangedCb(_FolksIndividualAggregator*, _GeeSet*, _GeeSet*, char*, _FolksPersona*, FolksGroupDetailsChangeReason) (in /usr/lib/x86_64-linux-gnu/qt5/plugins/contacts/libqtcontacts_folks.so)
==2464== by 0x95C5666: Folks::ManagerEngine::_static_callback_individualsChangedCb(_FolksIndividualAggregator*, _GeeSet*, _GeeSet*, char*, _FolksPersona*, FolksGroupDetailsChangeReason, Folks::ManagerEngine*) (in /usr/lib/x86_64-linux-gnu/qt5/plugins/contacts/libqtcontacts_folks.so)
==2464== by 0x9834E92: g_cclosure_user_marshal_VOID__OBJECT_OBJECT_STRING_OBJECT_ENUM (individual-aggregator.c:8067)
==2464== by 0xA0E913F: g_closure_invoke (gclosure.c:777)
==2464== by 0xA0FA54F: signal_emit_unlocked_R (gsignal.c:3551)
==2464== by 0xA1024AE: g_signal_emit_valist (gsignal.c:3300)
==2464== by 0xA102B4F: g_signal_emit_by_name (gsignal.c:3393)
==2464== by 0x9837136: _folks_individual_aggregator_emit_individuals_changed.constprop.17 (individual-aggregator.c:3297)
==2464== by 0x9839ACB: _folks_individual_aggregator_personas_changed_cb.isra.7 (individual-aggregator.c:5248)
==2464== by 0x9841632: g_cclosure_user_marshal_VOID__OBJECT_OBJECT_STRING_OBJECT_ENUM (persona-store.c:757)
==2464== by 0xA0E913F: g_closure_invoke (gclosure.c:777)
==2464== by 0xA0FA54F: signal_emit_unlocked_R (gsignal.c:3551)
==2464== by 0xA1024AE: g_signal_emit_valist (gsignal.c:3300)
==2464== by 0xA102B4F: g_signal_emit_by_name (gsignal.c:3393)
==2464== by 0x98419E6: _folks_persona_store_emit_personas_changed (persona-store.c:445)
==2464== by 0xA33F729: _tpf_persona_store_self_contact_changed_cb.isra.17 (tpf-persona-store.c:3632)
==2464== by 0xA3420A1: _tpf_persona_store_notify_connection_cb_async_co (tpf-persona-store.c:2752)
==2464== by 0xA5C4F56: g_simple_async_result_complete (gsimpleasyncresult.c:775)
==2464== by 0xA34BB46: connection_get_alias_flags_cb (tp-lowlevel.c:52)
==2464== by 0x9D8D7B1: ??? (in /usr/lib/x86_64-linux-gnu/libtelepathy-glib.so.0.78.0)
==2464== by 0x9E067CF: ??? (in /usr/lib/x86_64-linux-gnu/libtelepathy-glib.so.0.78.0)
==2464== by 0x6F37AB4: g_main_context_dispatch (gmain.c:2715)
==2464== by 0x6F37DE7: g_main_context_iterate.isra.24 (gmain.c:3290)
==2464== by 0x6F37EA3: g_main_context_iteration (gmain.c:3351)
==2464== by 0x52DD3CB: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x5294C4A: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x529802F: QCoreApplication::exec() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x40125A: main (in /home/mgehre/Projects/whosthere/contact_crash/contact_crash)
==2464== Address 0x8abd960 is 0 bytes inside a block of size 56 free'd
==2464== at 0x4C2A44B: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==2464== by 0x95B7AD3: Folks::ManagerEngine::~ManagerEngine() (in /usr/lib/x86_64-linux-gnu/qt5/plugins/contacts/libqtcontacts_folks.so)
==2464== by 0x4E76555: QtContacts::QContactManager::~QContactManager() (in /usr/lib/x86_64-linux-gnu/libQt5Contacts.so.5.0.0)
==2464== by 0x40140F: Task::run() (in /home/mgehre/Projects/whosthere/contact_crash/contact_crash)
==2464== by 0x52BB75D: QObject::event(QEvent*) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x5295FCC: QCoreApplication::notify(QObject*, QEvent*) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x5295CCD: QCoreApplication::notifyInternal(QObject*, QEvent*) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x5297985: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x52DD242: ??? (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x6F37AB4: g_main_context_dispatch (gmain.c:2715)
==2464== by 0x6F37DE7: g_main_context_iterate.isra.24 (gmain.c:3290)
==2464== by 0x6F37EA3: g_main_context_iteration (gmain.c:3351)
==2464== by 0x52DD3CB: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x5294C4A: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x529802F: QCoreApplication::exec() (in /usr/lib/x86_64-linux-gnu/libQt5Core.so.5.0.0)
==2464== by 0x40125A: main (in /home/mgehre/Projects/whosthere/contact_crash/contact_crash)

---- main.cpp:
#include <QCoreApplication>
#include <QObject>
#include <QTimer>
#include <QContactManager>
#include "main.h"

void Task::run() {
    QtContacts::QContactManager manager;
}

int main(int argc, char* argv[])
{
    QCoreApplication a(argc, argv);

    QTimer::singleShot(0, new Task(), SLOT(run()));
    return a.exec();
}

---- main.h:
#include <QObject>
class Task : public QObject
{
    Q_OBJECT
public slots:
    void run();
};

--- contact_crash.pro
QT += contacts

SOURCES += main.cpp
HEADERS += main.h