QQmlListModel: Fix C++ owned object getting destroyed

If an object is explicitly set as C++ owned, it should not be turned to
destructible in any case. explicitIndestructibleSet flag is used for
that and thus it should not be unset in any case.
This fixes an issue where a C++ owned object could be destroyed by GC
when it is added to a ListModel. An object is supposed to be set as
destructible implicitly when it is used as a return value from JS unless
explicitIndestructibleSet is set.

Fixes: QTBUG-96167
Change-Id: Iad06847e56e29dd1b20146be108d7f747d8474dc
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Reviewed-by: Jaeyoon Jung <jaeyoon.jung@lge.com>
(cherry picked from commit 219ca3bf2be65fb4f1741bdc7b53d6dc4a41dd31)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

1 files changed, 3 insertions, 5 deletions

diff --git a/src/qmlmodels/qqmllistmodel.cpp b/src/qmlmodels/qqmllistmodel.cpp
index b71931cc85..4ae6b011fa 100644
--- a/src/qmlmodels/qqmllistmodel.cpp
+++ b/src/qmlmodels/qqmllistmodel.cpp
@@ -1095,10 +1095,8 @@ restoreQObjectOwnership(ListElement::GuardedQObjectPointer *pointer)
 
         // Only restore the previous state if the object hasn't become explicitly
         // owned
-        if (!data->explicitIndestructibleSet) {
+        if (!data->explicitIndestructibleSet)
             data->indestructible = (pointer->tag() & ListElement::Indestructible);
-            data->explicitIndestructibleSet = (pointer->tag() & ListElement::ExplicitlySet);
-        }
     }
 }
 
@@ -1112,8 +1110,8 @@ static void setQObjectOwnership(char *mem, QObject *o)
     if (!ddata)
         ddata = QQmlData::get(o, true);
 
-    ddata->indestructible = ownership != 0;
-    ddata->explicitIndestructibleSet = false;
+    if (!ddata->explicitIndestructibleSet)
+        ddata->indestructible = ownership != 0;
 
     new (mem) ListElement::GuardedQObjectPointer(
             o, static_cast<ListElement::ObjectIndestructible>(ownership));