Don't use d->instanceModel after free'ing it

prevModel points to d->instanceModel and is being
used further down in the code. So reset the pointer
to 0 after freeing the old instanceModel.

Change-Id: I8854ae3e09c8b2fe50ad311f3dbc7b8ed26805e1
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

2 files changed, 3 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4arraydata.cpp b/src/qml/jsruntime/qv4arraydata.cpp
index ed2122fb89..7d76a10ad6 100644
--- a/src/qml/jsruntime/qv4arraydata.cpp
+++ b/src/qml/jsruntime/qv4arraydata.cpp
@@ -640,7 +640,7 @@ public:
     inline ArrayElementLessThan(ExecutionContext *context, ObjectRef thisObject, const ValueRef comparefn)
         : m_context(context), thisObject(thisObject), m_comparefn(comparefn) {}
 
-    bool operator()(const Value &v1, const Value &v2) const;
+    bool operator()(Value v1, Value v2) const;
 
 private:
     ExecutionContext *m_context;
@@ -649,7 +649,7 @@ private:
 };
 
 
-bool ArrayElementLessThan::operator()(const Value &v1, const Value &v2) const
+bool ArrayElementLessThan::operator()(Value v1, Value v2) const
 {
     Scope scope(m_context);
 
diff --git a/src/qml/types/qqmlinstantiator.cpp b/src/qml/types/qqmlinstantiator.cpp
index 724a76825b..7a52ad2134 100644
--- a/src/qml/types/qqmlinstantiator.cpp
+++ b/src/qml/types/qqmlinstantiator.cpp
@@ -376,6 +376,7 @@ void QQmlInstantiator::setModel(const QVariant &v)
     if (object && (vim = qobject_cast<QQmlInstanceModel *>(object))) {
         if (d->ownModel) {
             delete d->instanceModel;
+            prevModel = 0;
             d->ownModel = false;
         }
         d->instanceModel = vim;