QQmlListModel: handle nested list models during iteration

ListElement::getProperty returns in turn a list model
The ModelObjectOwnPropertyKeyIterator should however return the concrete
values, and not some proxy object. This would cause funny return values
in the best case, and a crash in case of QTBUG-79083.

We therefore convert the nested model to a JavaScript array in
ModelObjectOwnPropertyKeyIterator::next, which avoids beforementioned
issues.

Fixes: QTBUG-79083
Change-Id: If038598ff1c3c59090e994aaba5fba94a6964224
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

1 files changed, 11 insertions, 1 deletions

diff --git a/src/qmlmodels/qqmllistmodel.cpp b/src/qmlmodels/qqmllistmodel.cpp
index 1cd089f454..d68815cbc1 100644
--- a/src/qmlmodels/qqmllistmodel.cpp
+++ b/src/qmlmodels/qqmllistmodel.cpp
@@ -1641,8 +1641,18 @@ PropertyKey ModelObjectOwnPropertyKeyIterator::next(const Object *o, Property *p
         if (attrs)
             *attrs = QV4::Attr_Data;
         if (pd) {
+
             QVariant value = that->d()->m_model->data(that->d()->elementIndex(), role.index);
-            pd->value = v4->fromVariant(value);
+            if (auto recursiveListModel = qvariant_cast<QQmlListModel*>(value)) {
+                auto size = recursiveListModel->count();
+                auto array = ScopedArrayObject{scope, v4->newArrayObject(size)};
+                for (auto i = 0; i < size; i++) {
+                    array->arrayPut(i, QJSValuePrivate::convertedToValue(v4, recursiveListModel->get(i)));
+                }
+                pd->value = array;
+            } else {
+                pd->value = v4->fromVariant(value);
+            }
         }
         return roleName->toPropertyKey();
     }