diff options
| author | Daniel Vrátil <dvratil@kde.org> | 2015-01-28 19:09:04 +0100 |
|---|---|---|
| committer | Daniel Vrátil <dvratil@kde.org> | 2015-02-02 12:01:16 +0000 |
| commit | 5df747fc5300f9c7e1da0fb86bab68209c921c9c (patch) | |
| tree | d085a89d1f15a8805bfd2815b845487ef28aa70b | |
| parent | 9230cb14ba383e0e2633725ade6a64f8b20bac41 (diff) | |
Fix possible crash when removing items from QQmlDelegateModel
When iterating over the cache in QQmlDelegateModel::_q_itemsRemoved(), removing
of some of the items can trigger layout change in the view, which might in turn
remove a QQmlDelegateModelItem from the cache, causing us to dereference an
already deleted pointer.
To prevent crash, we always check whether the item is still valid in the original
cache and skip it if it has been removed in the meanwhile.
Task-number: QTBUG-34351
Change-Id: Ib91a0544e11dbd7bf6d82fa4dc4400cac9d0b5f7
Reviewed-by: Alan Alpert (Personal) <416365416c@gmail.com>
| -rw-r--r-- | src/qml/types/qqmldelegatemodel.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/qml/types/qqmldelegatemodel.cpp b/src/qml/types/qqmldelegatemodel.cpp index 8b65373133..79f150ce05 100644 --- a/src/qml/types/qqmldelegatemodel.cpp +++ b/src/qml/types/qqmldelegatemodel.cpp @@ -1335,6 +1335,11 @@ void QQmlDelegateModel::_q_itemsRemoved(int index, int count) const QList<QQmlDelegateModelItem *> cache = d->m_cache; for (int i = 0, c = cache.count(); i < c; ++i) { QQmlDelegateModelItem *item = cache.at(i); + // layout change triggered by removal of a previous item might have + // already invalidated this item in d->m_cache and deleted it + if (!d->m_cache.contains(item)) + continue; + if (item->modelIndex() >= index + count) item->setModelIndex(item->modelIndex() - count); else if (item->modelIndex() >= index) |