Fix crash in KPackageKit

QTreeViewPrivate::itemHeight() may refer to an invalid QModelIndex
after calling QTreeView::indexRowSizeHint().

Same thing inside QTreeView::indexRowSizeHint(), since
QHeaderView::count() will call
QAbstractItemViewPrivate::executePostedLayout() which may invalidate
all the QModelIndex.

Reviewed-by: Olivier
Task-number: QTBUG-16292

1 files changed, 6 insertions, 5 deletions

diff --git a/src/gui/itemviews/qtreeview.cpp b/src/gui/itemviews/qtreeview.cpp
index f1f32360bb..c0573bb0c7 100644
--- a/src/gui/itemviews/qtreeview.cpp
+++ b/src/gui/itemviews/qtreeview.cpp
@@ -2753,6 +2753,7 @@ int QTreeView::indexRowSizeHint(const QModelIndex &index) const
 
     int start = -1;
     int end = -1;
+    int indexRow = index.row();
     int count = d->header->count();
     bool emptyHeader = (count == 0);
     QModelIndex parent = index.parent();
@@ -2789,7 +2790,7 @@ int QTreeView::indexRowSizeHint(const QModelIndex &index) const
         int logicalColumn = emptyHeader ? column : d->header->logicalIndex(column);
         if (d->header->isSectionHidden(logicalColumn))
             continue;
-        QModelIndex idx = d->model->index(index.row(), logicalColumn, parent);
+        QModelIndex idx = d->model->index(indexRow, logicalColumn, parent);
         if (idx.isValid()) {
             QWidget *editor = d->editorForIndex(idx).editor;
             if (editor && d->persistent.contains(editor)) {
@@ -3224,14 +3225,14 @@ int QTreeViewPrivate::itemHeight(int item) const
     if (viewItems.isEmpty())
         return 0;
     const QModelIndex &index = viewItems.at(item).index;
+    if (!index.isValid())
+        return 0;
     int height = viewItems.at(item).height;
-    if (height <= 0 && index.isValid()) {
+    if (height <= 0) {
         height = q_func()->indexRowSizeHint(index);
         viewItems[item].height = height;
     }
-    if (!index.isValid() || height < 0)
-        return 0;
-    return height;
+    return qMax(height, 0);
 }