Fix proxy-data handling

This addresses two different issues:
- Firstly, we were casting the resolved binding data pointer to
  QPropertyProxyBindingData, instead of the d_ptr of
  QPropertyBindingData. Fix this by introducing a helper function,
  and consistently using it to access the proxy data.
- Secondly, we were not resetting the originalBindingData when the
  pointed to object was destoyed. Fix that, too.

Pick-to: 6.5 6.4 6.2
Task-number: QTBUG-110899
Change-Id: I7691c9df5cc26e761f6b0e5f16d152f7f2183208
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

1 files changed, 6 insertions, 1 deletions

diff --git a/src/corelib/kernel/qpropertyprivate.h b/src/corelib/kernel/qpropertyprivate.h
index 4387f0fbeb..aca6d14c96 100644
--- a/src/corelib/kernel/qpropertyprivate.h
+++ b/src/corelib/kernel/qpropertyprivate.h
@@ -303,10 +303,15 @@ private:
     {
         quintptr &d = d_ptr;
         if (isNotificationDelayed())
-            return reinterpret_cast<QPropertyProxyBindingData *>(d_ptr & ~(BindingBit|DelayedNotificationBit))->d_ptr;
+            return proxyData()->d_ptr;
         return d;
     }
     quintptr d() const { return d_ref(); }
+    QPropertyProxyBindingData *proxyData() const
+    {
+        Q_ASSERT(isNotificationDelayed());
+        return reinterpret_cast<QPropertyProxyBindingData *>(d_ptr & ~(BindingBit|DelayedNotificationBit));
+    }
     void registerWithCurrentlyEvaluatingBinding_helper(BindingEvaluationState *currentBinding) const;
     void removeBinding_helper();