Fix crash in QQmlDelegateModel

It can happen that when the QQmlDelegateModel goes away some of the
QQmlDelegateModelItem from d->m_cache are still incubating, this
means that isReferenced() will return true and we will not delete them.

This also means that when these QQDMIncubationTask finish they may end
up calling QQDMIncubationTask::statusChanged which will try to access
the delegate model that is already gone.

This commit makes sure we set vdm to 0 in these orphaned
QQDMIncubationTask so  in QQDMIncubationTask::statusChanged we know
no one cares about us anymore and don't reference the already gone
delegate model

Task-number:  QTBUG-30928

Change-Id: Ief6176cec151d861dad09ca2498ca27e17ee6385
Reviewed-by: Andrew den Exter <andrew.den.exter@qinetic.com.au>

diff --git a/src/qml/types/qqmldelegatemodel.cpp b/src/qml/types/qqmldelegatemodel.cpp
index 16572c4..5e36be1 100644 (file)
--- a/src/qml/types/qqmldelegatemodel.cpp
+++ b/src/qml/types/qqmldelegatemodel.cpp
@@ -230,6 +230,8 @@ QQmlDelegateModel::~QQmlDelegateModel()
         cacheItem->objectRef = 0;
         if (!cacheItem->isReferenced())
             delete cacheItem;
+        else if (cacheItem->incubationTask)
+            cacheItem->incubationTask->vdm = 0;
     }
 }
 
@@ -780,7 +782,21 @@ void QQmlDelegateModelPrivate::emitDestroyingPackage(QQuickPackage *package)
 
 void QQDMIncubationTask::statusChanged(Status status)
 {
-    vdm->incubatorStatusChanged(this, status);
+    if (vdm) {
+        vdm->incubatorStatusChanged(this, status);
+    } else if (status == QQmlIncubator::Ready || status == QQmlIncubator::Error) {
+        Q_ASSERT(incubating);
+        // The model was deleted from under our feet, cleanup ourselves
+        if (incubating->object) {
+            delete incubating->object;
+
+            incubating->object = 0;
+            incubating->contextData->destroy();
+            incubating->contextData = 0;
+        }
+        incubating->scriptRef = 0;
+        incubating->deleteLater();
+    }
 }
 
 void QQmlDelegateModelPrivate::releaseIncubator(QQDMIncubationTask *incubationTask)
@@ -1766,8 +1782,12 @@ QQmlDelegateModelItem::~QQmlDelegateModelItem()
     Q_ASSERT(objectRef == 0);
     Q_ASSERT(!object);
 
-    if (incubationTask && metaType->model)
-        QQmlDelegateModelPrivate::get(metaType->model)->releaseIncubator(incubationTask);
+    if (incubationTask) {
+        if (metaType->model)
+            QQmlDelegateModelPrivate::get(metaType->model)->releaseIncubator(incubationTask);
+        else
+            delete incubationTask;
+    }
 
     metaType->release();