QML: Do not leak memory if QQmlData is manipulated from ctor

This creates another QQmlData object on the heap, which is rather
wasteful. However, we cannot really avoid it since it's all too easy to
trigger an operation like this.

If it happens, use the QQmlData it has created, and ignore the memory
we've allocated inline. While we're at it, make the memory ownership a
required argument to the ctor.

Pick-to: 6.5 6.6
Fixes: QTBUG-114186
Change-Id: I0568768c9ec13c94db79bb162c9eeb76f75f2a55
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

1 files changed, 6 insertions, 3 deletions

diff --git a/src/qmlmodels/qqmllistmodel.cpp b/src/qmlmodels/qqmllistmodel.cpp
index 14c8a6fd85..3bd180d072 100644
--- a/src/qmlmodels/qqmllistmodel.cpp
+++ b/src/qmlmodels/qqmllistmodel.cpp
@@ -319,9 +319,12 @@ QObject *ListModel::getOrCreateModelObject(QQmlListModel *model, int elementInde
         void *memory = operator new(sizeof(QObject) + sizeof(QQmlData));
         void *ddataMemory = ((char *)memory) + sizeof(QObject);
         e->m_objectCache = new (memory) QObject;
-        QQmlData *ddata = new (ddataMemory) QQmlData;
-        ddata->ownMemory = false;
-        QObjectPrivate::get(e->m_objectCache)->declarativeData = ddata;
+
+        const QAbstractDeclarativeData *old = std::exchange(
+            QObjectPrivate::get(e->m_objectCache)->declarativeData,
+            new (ddataMemory) QQmlData(QQmlData::DoesNotOwnMemory));
+        Q_ASSERT(!old); // QObject should really not manipulate QQmlData
+
         (void)new ModelNodeMetaObject(e->m_objectCache, model, elementIndex);
     }
     return e->m_objectCache;