Fix crash when QML engine warning handler feeds errors back into QML

When a QQmlEngine warning handler that's called during component
instantiation results in subsequent component instantiations, either via
the signal or via a Qt message handler like in the bug report, then we
might end up modifying the linked list of errored bindings before
returning from the QQmlEnginePrivate::warning() call. The easy fix is to
extract the QQmlError, unlink the delayed error from the linked list and
then deliver the error to the QQmlEngine.

Change-Id: I6b7be61b57b35636282595937046ff76091144a3
Task-number: QTBUG-53293
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

1 files changed, 9 insertions, 7 deletions

diff --git a/src/qml/qml/qqmljavascriptexpression_p.h b/src/qml/qml/qqmljavascriptexpression_p.h
index a028850074..bff8866011 100644
--- a/src/qml/qml/qqmljavascriptexpression_p.h
+++ b/src/qml/qml/qqmljavascriptexpression_p.h
@@ -63,16 +63,18 @@ class QQmlDelayedError
 {
 public:
     inline QQmlDelayedError() : nextError(nullptr), prevError(nullptr) {}
-    inline ~QQmlDelayedError() { removeError(); }
+    inline ~QQmlDelayedError() { (void)removeError(); }
 
     bool addError(QQmlEnginePrivate *);
 
-    inline void removeError() {
-        if (!prevError) return;
-        if (nextError) nextError->prevError = prevError;
-        *prevError = nextError;
-        nextError = nullptr;
-        prevError = nullptr;
+    Q_REQUIRED_RESULT inline QQmlError removeError() {
+        if (prevError) {
+            if (nextError) nextError->prevError = prevError;
+            *prevError = nextError;
+            nextError = nullptr;
+            prevError = nullptr;
+        }
+        return m_error;
     }
 
     inline bool isValid() const { return m_error.isValid(); }