Avoid use-after-free in QQuickPathView

When releasing an item we always need to unregister the change listener,
even if the model is already gone. The model is a public property and a
QPointer. Anything can happen to it behind our back.

Furthermore, we apparently don't own items and itemCache. Therefore, we
have to listen to their "destroy" events and remove them from the list
when those are triggered. Otherwise we operate on dangling pointers
when we later releaseItem() from the dtor.

Change-Id: I662b0d70b8b06d15b504c6fe1fc33384b1ae12d9
Reviewed-by: Mitch Curtis <mitch.curtis@qt.io>
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
(cherry picked from commit 1b8109fc1476e255d1fdb571da884215d9791cec)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/src/quick/items/qquickpathview_p_p.h b/src/quick/items/qquickpathview_p_p.h
index 6c964bcb83..b245c6b5ee 100644
--- a/src/quick/items/qquickpathview_p_p.h
+++ b/src/quick/items/qquickpathview_p_p.h
@@ -88,6 +88,12 @@ public:
         }
     }
 
+    void itemDestroyed(QQuickItem *item) override
+    {
+        if (!items.removeOne(item))
+            itemCache.removeOne(item);
+    }
+
     void scheduleLayout() {
         Q_Q(QQuickPathView);
         if (!layoutScheduled) {