Fixed a QQuickListView crash

When an ObjectModel item is removed and destroyed.

Task-number: QTBUG-46798
Change-Id: Ia41dd359d9f3ec5b7af85498dc798f7ab55dca3c
Reviewed-by: J-P Nurmi <jpnurmi@theqtcompany.com>
Reviewed-by: Alan Alpert <aalpert@blackberry.com>

3 files changed, 47 insertions, 34 deletions

diff --git a/src/quick/items/qquickitemview.cpp b/src/quick/items/qquickitemview.cpp
index af47aa837b..7a55bd6e0a 100644
--- a/src/quick/items/qquickitemview.cpp
+++ b/src/quick/items/qquickitemview.cpp
@@ -71,19 +71,19 @@ FxViewItem::~FxViewItem()
 
 qreal FxViewItem::itemX() const
 {
-    return transitionableItem ? transitionableItem->itemX() : item->x();
+    return transitionableItem ? transitionableItem->itemX() : (item ? item->x() : 0);
 }
 
 qreal FxViewItem::itemY() const
 {
-    return transitionableItem ? transitionableItem->itemY() : item->y();
+    return transitionableItem ? transitionableItem->itemY() : (item ? item->y() : 0);
 }
 
 void FxViewItem::moveTo(const QPointF &pos, bool immediate)
 {
     if (transitionableItem)
         transitionableItem->moveTo(pos, immediate);
-    else
+    else if (item)
         item->setPosition(pos);
 }
 
@@ -91,21 +91,26 @@ void FxViewItem::setVisible(bool visible)
 {
     if (!visible && transitionableItem && transitionableItem->transitionScheduledOrRunning())
         return;
-    QQuickItemPrivate::get(item)->setCulled(!visible);
+    if (item)
+        QQuickItemPrivate::get(item)->setCulled(!visible);
 }
 
 void FxViewItem::trackGeometry(bool track)
 {
     if (track) {
         if (!trackGeom) {
-            QQuickItemPrivate *itemPrivate = QQuickItemPrivate::get(item);
-            itemPrivate->addItemChangeListener(QQuickItemViewPrivate::get(view), QQuickItemPrivate::Geometry);
+            if (item) {
+                QQuickItemPrivate *itemPrivate = QQuickItemPrivate::get(item);
+                itemPrivate->addItemChangeListener(QQuickItemViewPrivate::get(view), QQuickItemPrivate::Geometry);
+            }
             trackGeom = true;
         }
     } else {
         if (trackGeom) {
-            QQuickItemPrivate *itemPrivate = QQuickItemPrivate::get(item);
-            itemPrivate->removeItemChangeListener(QQuickItemViewPrivate::get(view), QQuickItemPrivate::Geometry);
+            if (item) {
+                QQuickItemPrivate *itemPrivate = QQuickItemPrivate::get(item);
+                itemPrivate->removeItemChangeListener(QQuickItemViewPrivate::get(view), QQuickItemPrivate::Geometry);
+            }
             trackGeom = false;
         }
     }
@@ -2044,8 +2049,9 @@ bool QQuickItemViewPrivate::applyModelChanges(ChangeResult *totalInsertionResult
     currentChanges.removedItems.clear();
 
     if (currentChanges.currentChanged) {
-        if (currentChanges.currentRemoved && currentItem && currentItem->attached) {
-            currentItem->attached->setIsCurrentItem(false);
+        if (currentChanges.currentRemoved && currentItem) {
+            if (currentItem->item && currentItem->attached)
+                currentItem->attached->setIsCurrentItem(false);
             releaseItem(currentItem);
             currentItem = 0;
         }
@@ -2097,10 +2103,10 @@ bool QQuickItemViewPrivate::applyRemovalChange(const QQmlChangeSet::Change &remo
         } else {
             // removed item
             visibleAffected = true;
-            if (!removal.isMove() && item->attached)
+            if (!removal.isMove() && item->item && item->attached)
                 item->attached->emitRemove();
 
-            if (item->attached && item->attached->delayRemove() && !removal.isMove()) {
+            if (item->item && item->attached && item->attached->delayRemove() && !removal.isMove()) {
                 item->index = -1;
                 QObject::connect(item->attached, SIGNAL(delayRemoveChanged()), q, SLOT(destroyRemoved()), Qt::QueuedConnection);
                 ++it;
@@ -2357,12 +2363,14 @@ bool QQuickItemViewPrivate::releaseItem(FxViewItem *item)
     item->trackGeometry(false);
 
     QQmlInstanceModel::ReleaseFlags flags = model->release(item->item);
-    if (flags == 0) {
-        // item was not destroyed, and we no longer reference it.
-        QQuickItemPrivate::get(item->item)->setCulled(true);
-        unrequestedItems.insert(item->item, model->indexOf(item->item, q));
-    } else if (flags & QQmlInstanceModel::Destroyed) {
-        item->item->setParentItem(0);
+    if (item->item) {
+        if (flags == 0) {
+            // item was not destroyed, and we no longer reference it.
+            QQuickItemPrivate::get(item->item)->setCulled(true);
+            unrequestedItems.insert(item->item, model->indexOf(item->item, q));
+        } else if (flags & QQmlInstanceModel::Destroyed) {
+            item->item->setParentItem(0);
+        }
     }
     delete item;
     return flags != QQmlInstanceModel::Referenced;
diff --git a/src/quick/items/qquickitemview_p_p.h b/src/quick/items/qquickitemview_p_p.h
index 5ac88a7585..67ef413d31 100644
--- a/src/quick/items/qquickitemview_p_p.h
+++ b/src/quick/items/qquickitemview_p_p.h
@@ -53,6 +53,8 @@ public:
 
     qreal itemX() const;
     qreal itemY() const;
+    inline qreal itemWidth() const { return item ? item->width() : 0; }
+    inline qreal itemHeight() const { return item ? item->height() : 0; }
 
     void moveTo(const QPointF &pos, bool immediate);
     void setVisible(bool visible);
@@ -75,7 +77,7 @@ public:
 
     virtual bool contains(qreal x, qreal y) const = 0;
 
-    QQuickItem *item;
+    QPointer<QQuickItem> item;
     QQuickItemView *view;
     QQuickItemViewTransitionableItem *transitionableItem;
     QQuickItemViewAttached *attached;
diff --git a/src/quick/items/qquicklistview.cpp b/src/quick/items/qquicklistview.cpp
index eec36b59c8..c0287168f3 100644
--- a/src/quick/items/qquicklistview.cpp
+++ b/src/quick/items/qquicklistview.cpp
@@ -267,18 +267,18 @@ public:
     }
     qreal itemPosition() const {
         if (view->orientation() == QQuickListView::Vertical)
-            return (view->verticalLayoutDirection() == QQuickItemView::BottomToTop ? -item->height()-itemY() : itemY());
+            return (view->verticalLayoutDirection() == QQuickItemView::BottomToTop ? -itemHeight()-itemY() : itemY());
         else
-            return (view->effectiveLayoutDirection() == Qt::RightToLeft ? -item->width()-itemX() : itemX());
+            return (view->effectiveLayoutDirection() == Qt::RightToLeft ? -itemWidth()-itemX() : itemX());
     }
     qreal size() const {
         if (section())
-            return (view->orientation() == QQuickListView::Vertical ? item->height()+section()->height() : item->width()+section()->width());
+            return (view->orientation() == QQuickListView::Vertical ? itemHeight()+section()->height() : itemWidth()+section()->width());
         else
-            return (view->orientation() == QQuickListView::Vertical ? item->height() : item->width());
+            return (view->orientation() == QQuickListView::Vertical ? itemHeight() : itemWidth());
     }
     qreal itemSize() const {
-        return (view->orientation() == QQuickListView::Vertical ? item->height() : item->width());
+        return (view->orientation() == QQuickListView::Vertical ? itemHeight() : itemWidth());
     }
     qreal sectionSize() const {
         if (section())
@@ -289,11 +289,11 @@ public:
         if (view->orientation() == QQuickListView::Vertical) {
             return (view->verticalLayoutDirection() == QQuickItemView::BottomToTop
                     ? -itemY()
-                    : itemY() + item->height());
+                    : itemY() + itemHeight());
         } else {
             return (view->effectiveLayoutDirection() == Qt::RightToLeft
                     ? -itemX()
-                    : itemX() + item->width());
+                    : itemX() + itemWidth());
         }
     }
     void setPosition(qreal pos, bool immediate = false) {
@@ -320,8 +320,8 @@ public:
             item->setWidth(size);
     }
     bool contains(qreal x, qreal y) const Q_DECL_OVERRIDE {
-        return (x >= itemX() && x < itemX() + item->width() &&
-                y >= itemY() && y < itemY() + item->height());
+        return (x >= itemX() && x < itemX() + itemWidth() &&
+                y >= itemY() && y < itemY() + itemHeight());
     }
 
     QQuickListView *view;
@@ -332,7 +332,7 @@ private:
             if (view->verticalLayoutDirection() == QQuickItemView::BottomToTop) {
                 if (section())
                     pos += section()->height();
-                return QPointF(itemX(), -item->height() - pos);
+                return QPointF(itemX(), -itemHeight() - pos);
             } else {
                 if (section())
                     pos += section()->height();
@@ -342,7 +342,7 @@ private:
             if (view->effectiveLayoutDirection() == Qt::RightToLeft) {
                 if (section())
                     pos += section()->width();
-                return QPointF(-item->width() - pos, itemY());
+                return QPointF(-itemWidth() - pos, itemY());
             } else {
                 if (section())
                     pos += section()->width();
@@ -612,7 +612,7 @@ bool QQuickListViewPrivate::releaseItem(FxViewItem *item)
     QQuickListViewAttached *att = static_cast<QQuickListViewAttached*>(item->attached);
 
     bool released = QQuickItemViewPrivate::releaseItem(item);
-    if (released && att && att->m_sectionItem) {
+    if (released && item->item && att && att->m_sectionItem) {
         // We hold no more references to this item
         int i = 0;
         do {
@@ -670,7 +670,8 @@ bool QQuickListViewPrivate::addVisibleItems(qreal fillFrom, qreal fillTo, qreal
         qCDebug(lcItemViewDelegateLifecycle) << "refill: append item" << modelIndex << "pos" << pos << "buffer" << doBuffer << "item" << item->item->objectName();
         if (!transitioner || !transitioner->canTransition(QQuickItemViewTransitioner::PopulateTransition, true)) // pos will be set by layoutVisibleItems()
             item->setPosition(pos, true);
-        QQuickItemPrivate::get(item->item)->setCulled(doBuffer);
+        if (item->item)
+            QQuickItemPrivate::get(item->item)->setCulled(doBuffer);
         pos += item->size() + spacing;
         visibleItems.append(item);
         ++modelIndex;
@@ -688,7 +689,8 @@ bool QQuickListViewPrivate::addVisibleItems(qreal fillFrom, qreal fillTo, qreal
         visiblePos -= item->size() + spacing;
         if (!transitioner || !transitioner->canTransition(QQuickItemViewTransitioner::PopulateTransition, true)) // pos will be set by layoutVisibleItems()
             item->setPosition(visiblePos, true);
-        QQuickItemPrivate::get(item->item)->setCulled(doBuffer);
+        if (item->item)
+            QQuickItemPrivate::get(item->item)->setCulled(doBuffer);
         visibleItems.prepend(item);
         changed = true;
     }
@@ -2851,7 +2853,8 @@ void QQuickListView::viewportMoved(Qt::Orientations orient)
     qreal to = d->isContentFlowReversed() ? -d->position()+d->displayMarginEnd : d->position()+d->size()+d->displayMarginEnd;
     for (int i = 0; i < d->visibleItems.count(); ++i) {
         FxViewItem *item = static_cast<FxListItemSG*>(d->visibleItems.at(i));
-        QQuickItemPrivate::get(item->item)->setCulled(item->endPosition() < from || item->position() > to);
+        if (item->item)
+            QQuickItemPrivate::get(item->item)->setCulled(item->endPosition() < from || item->position() > to);
     }
     if (d->currentItem)
         QQuickItemPrivate::get(d->currentItem->item)->setCulled(d->currentItem->endPosition() < from || d->currentItem->position() > to);