QtQml: Clean up VME and interceptor metaobjects on destruction

The dynamically created meta object is stored in the QObject private
until the very end of the object's destruction. It takes precedence in
the moc-generated QObject::metaObject implementation, essentially
side-tracking virtual dispatch during object destruction. If we don't
clean it up this allows qobject_cast'ing down the class tree when the
object is already partially destroyed, even though it shouldn't.

Done-with: Ulf Hermann <ulf.hermann@qt.io>
Change-Id: I64f6533747bb99b977702c050e5dc78a7c6428a5
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

1 files changed, 8 insertions, 1 deletions

diff --git a/src/qml/qml/qqmlengine.cpp b/src/qml/qml/qqmlengine.cpp
index 54ec5e1dcd..d5a8371c7f 100644
--- a/src/qml/qml/qqmlengine.cpp
+++ b/src/qml/qml/qqmlengine.cpp
@@ -213,7 +213,8 @@ QQmlEnginePrivate::~QQmlEnginePrivate()
 
 void QQmlPrivate::qdeclarativeelement_destructor(QObject *o)
 {
-    if (QQmlData *d = QQmlData::get(o)) {
+    QObjectPrivate *p = QObjectPrivate::get(o);
+    if (QQmlData *d = QQmlData::get(p)) {
         if (d->ownContext) {
             for (QQmlRefPointer<QQmlContextData> lc = d->ownContext->linkedContext(); lc;
                  lc = lc->linkedContext()) {
@@ -231,6 +232,12 @@ void QQmlPrivate::qdeclarativeelement_destructor(QObject *o)
         if (d->outerContext && d->outerContext->contextObject() == o)
             d->outerContext->setContextObject(nullptr);
 
+        if (d->hasVMEMetaObject || d->hasInterceptorMetaObject) {
+            p->metaObject->objectDestroyed(o);
+            p->metaObject = nullptr;
+            d->hasVMEMetaObject = d->hasInterceptorMetaObject = false;
+        }
+
         // Mark this object as in the process of deletion to
         // prevent it resolving in bindings
         QQmlData::markAsDeleted(o);