QQmlMetaType: Clear property caches on qmlClearTypeRegistrations

Otherwise we may retain dangling pointers referencing invalid property
caches. Some metaobjects are created on the heap. If the memory manager
decides to re-use the heap space for new metaobjects, we can retrieve
the invalid property caches.

Task-number: QTBUG-110933
Change-Id: Ic00bb852151bcf58ba6ae798a6bf2cea686a9e10
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
(cherry picked from commit 6937f2e50dd60c58350a464eb83ba9d11c7146f9)

2 files changed, 24 insertions, 0 deletions

diff --git a/src/qml/qml/qqmlmetatype.cpp b/src/qml/qml/qqmlmetatype.cpp
index a4ed418548..4b73984636 100644
--- a/src/qml/qml/qqmlmetatype.cpp
+++ b/src/qml/qml/qqmlmetatype.cpp
@@ -337,6 +337,10 @@ void QQmlMetaType::clearTypeRegistrations()
     data->urlToNonFileImportType.clear();
     data->metaObjectToType.clear();
     data->undeletableTypes.clear();
+
+    for (auto it = data->propertyCaches.begin(), end = data->propertyCaches.end(); it != end; ++it)
+        (*it)->release();
+    data->propertyCaches.clear();
 }
 
 int QQmlMetaType::registerAutoParentFunction(const QQmlPrivate::RegisterAutoParent &function)
diff --git a/tests/auto/qml/qqmlmetatype/tst_qqmlmetatype.cpp b/tests/auto/qml/qqmlmetatype/tst_qqmlmetatype.cpp
index be493484ee..f726855727 100644
--- a/tests/auto/qml/qqmlmetatype/tst_qqmlmetatype.cpp
+++ b/tests/auto/qml/qqmlmetatype/tst_qqmlmetatype.cpp
@@ -72,6 +72,8 @@ private slots:
 
     void enumsInRecursiveImport_data();
     void enumsInRecursiveImport();
+
+    void clearPropertyCaches();
 };
 
 class TestType : public QObject
@@ -734,6 +736,24 @@ void tst_qqmlmetatype::enumsInRecursiveImport()
     QTRY_COMPARE(obj->property("color").toString(), QString("green"));
 }
 
+void tst_qqmlmetatype::clearPropertyCaches()
+{
+    qmlClearTypeRegistrations();
+    qmlRegisterType<TestType>("ClearPropertyCaches", 1, 0, "A");
+
+    QQmlRefPointer<QQmlPropertyCache> oldCache(
+                QQmlMetaType::propertyCache(&TestType::staticMetaObject));
+    QVERIFY(oldCache);
+
+    qmlClearTypeRegistrations();
+    qmlRegisterType<TestType>("ClearPropertyCaches", 1, 0, "B");
+    QQmlRefPointer<QQmlPropertyCache> newCache(
+                QQmlMetaType::propertyCache(&TestType::staticMetaObject));
+    QVERIFY(newCache);
+
+    QVERIFY(oldCache.data() != newCache.data());
+}
+
 QTEST_MAIN(tst_qqmlmetatype)
 
 #include "tst_qqmlmetatype.moc"