Fix crash when dropping URLs on the URL navigator's drop down menus

The problem was that the files were copied/moved inside the nested event
loop of the drag, which caused problems if the "File exists" dialog was
shown.

The solution is to make the copy/move operation delayed, such that it is
executed in the main event loop.

Note that dropping files on these menus does apparently not work at the
moment when using the Oxygen style (see bug 310016).

BUG: 192139
BUG: 256338
BUG: 293220
BUG: 309076
FIXED-IN: 4.11.0
REVIEW: 111273

2 files changed, 45 insertions, 2 deletions

diff --git a/src/dolphinviewcontainer.cpp b/src/dolphinviewcontainer.cpp
index 71dc5fd7b..1e9e79ae7 100644
--- a/src/dolphinviewcontainer.cpp
+++ b/src/dolphinviewcontainer.cpp
@@ -68,7 +68,9 @@ DolphinViewContainer::DolphinViewContainer(const KUrl& url, QWidget* parent) :
     m_statusBar(0),
     m_statusBarTimer(0),
     m_statusBarTimestamp(),
-    m_autoGrabFocus(true)
+    m_autoGrabFocus(true),
+    m_dropDestination(),
+    m_dropEvent(0)
 #ifdef KActivities_FOUND
     , m_activityResourceInstance(0)
 #endif
@@ -597,11 +599,37 @@ void DolphinViewContainer::slotUrlNavigatorLocationChanged(const KUrl& url)
 
 void DolphinViewContainer::dropUrls(const KUrl& destination, QDropEvent* event)
 {
+    m_dropDestination = destination;
+
+    const QMimeData* mimeData = event->mimeData();
+    QMimeData* mimeDataCopy = new QMimeData;
+    foreach (const QString& format, mimeData->formats()) {
+        mimeDataCopy->setData(format, mimeData->data(format));
+    }
+
+    m_dropEvent.reset(new QDropEvent(event->pos(),
+                                     event->possibleActions(),
+                                     mimeDataCopy,
+                                     event->mouseButtons(),
+                                     event->keyboardModifiers()));
+
+    QTimer::singleShot(0, this, SLOT(dropUrlsDelayed()));
+}
+
+void DolphinViewContainer::dropUrlsDelayed()
+{
+    if (m_dropEvent.isNull()) {
+        return;
+    }
+
     QString error;
-    DragAndDropHelper::dropUrls(KFileItem(), destination, event, error);
+    DragAndDropHelper::dropUrls(KFileItem(), m_dropDestination, m_dropEvent.data(), error);
     if (!error.isEmpty()) {
         showMessage(error, Error);
     }
+
+    delete m_dropEvent->mimeData();
+    m_dropEvent.reset();
 }
 
 void DolphinViewContainer::redirect(const KUrl& oldUrl, const KUrl& newUrl)
diff --git a/src/dolphinviewcontainer.h b/src/dolphinviewcontainer.h
index bc58531a2..e5597ccc6 100644
--- a/src/dolphinviewcontainer.h
+++ b/src/dolphinviewcontainer.h
@@ -261,10 +261,22 @@ private slots:
     /**
      * Is connected with the URL navigator and drops the URLs
      * above the destination \a destination.
+     *
+     * Creates a copy of \a event and invokes \a dropUrlsDelayed with a
+     * queued connection.
      */
     void dropUrls(const KUrl& destination, QDropEvent* event);
 
     /**
+     * Is invoked with a queued connection by \a dropUrls to prevent that the
+     * drop actions are executed in the URL navigator menu's nested event loop,
+     * which might cause a crash. Simply using a queued connection from the URL
+     * navigator to \a dropUrls would not work because the \a event pointer
+     * would be dangling then.
+     */
+    void dropUrlsDelayed();
+
+    /**
      * Is invoked when a redirection is done and changes the
      * URL of the URL navigator to \a newUrl without triggering
      * a reloading of the directory.
@@ -330,6 +342,9 @@ private:
     QElapsedTimer m_statusBarTimestamp;  // Time in ms since last update
     bool m_autoGrabFocus;
 
+    KUrl m_dropDestination;
+    QScopedPointer<QDropEvent> m_dropEvent;
+
 #ifdef KActivities_FOUND
 private:
     KActivities::ResourceInstance * m_activityResourceInstance;