Fix crash when moving items during asynchronous creation

In complicated cases where the model moves rows around while
the view is running slow (perhaps during high CPU load),
there were cases when Repeater would call
movedItem->stackBefore(deleteableItem), but deleteable items
can be null, so there was often an error
QQuickItem::stackBefore: Cannot stack before 0x0, which must be a sibling
and occasionally a crash.  Now we check both the callee and the
parameter to stackBefore to make sure neither of them are null.

Task-number: QTBUG-54859
Change-Id: I45a8b2939c16b9bbe3a802ddd348dc55f51061a7
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>

3 files changed, 85 insertions, 2 deletions

diff --git a/src/quick/items/qquickrepeater.cpp b/src/quick/items/qquickrepeater.cpp
index 6fc4c0553a..ebf6e9c5cb 100644
--- a/src/quick/items/qquickrepeater.cpp
+++ b/src/quick/items/qquickrepeater.cpp
@@ -495,8 +495,15 @@ void QQuickRepeater::modelUpdated(const QQmlChangeSet &changeSet, bool reset)
             QQuickItem *stackBefore = index + items.count() < d->deletables.count()
                     ? d->deletables.at(index + items.count())
                     : this;
-            for (int i = index; i < index + items.count(); ++i)
-                d->deletables.at(i)->stackBefore(stackBefore);
+            if (stackBefore) {
+                for (int i = index; i < index + items.count(); ++i) {
+                    if (i < d->deletables.count()) {
+                        QPointer<QQuickItem> item = d->deletables.at(i);
+                        if (item)
+                            item->stackBefore(stackBefore);
+                    }
+                }
+            }
         } else for (int i = 0; i < insert.count; ++i) {
             int modelIndex = index + i;
             ++d->itemCount;
diff --git a/tests/auto/quick/qquickrepeater/data/asynchronousMove.qml b/tests/auto/quick/qquickrepeater/data/asynchronousMove.qml
new file mode 100644
index 0000000000..02499c8531
--- /dev/null
+++ b/tests/auto/quick/qquickrepeater/data/asynchronousMove.qml
@@ -0,0 +1,51 @@
+import QtQuick 2.3
+import QtQuick.Window 2.2
+
+Item {
+    property bool finished: loader.status === Loader.Ready && loader.progress === 1
+
+    ListModel {
+        id: listModel
+        ListElement { i:0 }
+        ListElement { i:1 }
+        ListElement { i:2 }
+        ListElement { i:3 }
+    }
+
+    Timer {
+        running: true
+        interval: 1
+        repeat: count < 5
+        property int count : 0
+
+        onTriggered: {
+            listModel.move(listModel.count - 1, listModel.count - 2, 1)
+            ++count
+        }
+    }
+
+    Loader {
+        id: loader
+        asynchronous: true
+        sourceComponent: Row {
+            spacing: 4
+            Repeater {
+                model: listModel
+                delegate: Column {
+                    spacing: 4
+                    Repeater {
+                        model: 4
+                        delegate: Rectangle {
+                            width: 30
+                            height: 30
+                            color: "blue"
+                            Component.onCompleted: {
+                                ctrl.wait()
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/tests/auto/quick/qquickrepeater/tst_qquickrepeater.cpp b/tests/auto/quick/qquickrepeater/tst_qquickrepeater.cpp
index f7b04e9a30..3519c53cb7 100644
--- a/tests/auto/quick/qquickrepeater/tst_qquickrepeater.cpp
+++ b/tests/auto/quick/qquickrepeater/tst_qquickrepeater.cpp
@@ -75,6 +75,7 @@ private slots:
     void destroyCount();
     void stackingOrder();
     void objectModel();
+    void QTBUG54859_asynchronousMove();
 };
 
 class TestObject : public QObject
@@ -989,6 +990,30 @@ void tst_QQuickRepeater::objectModel()
     delete positioner;
 }
 
+class Ctrl : public QObject
+{
+    Q_OBJECT
+public:
+
+    Q_INVOKABLE void wait()
+    {
+        QTest::qWait(200);
+    }
+};
+
+void tst_QQuickRepeater::QTBUG54859_asynchronousMove()
+{
+    Ctrl ctrl;
+    QQuickView* view = createView();
+    view->rootContext()->setContextProperty("ctrl", &ctrl);
+    view->setSource(testFileUrl("asynchronousMove.qml"));
+    view->show();
+    QQuickItem* item = view->rootObject();
+
+
+    QTRY_COMPARE(item->property("finished"), QVariant(true));
+}
+
 QTEST_MAIN(tst_QQuickRepeater)
 
 #include "tst_qquickrepeater.moc"