Fix read access violation when using KeyNavigation attached property

Setting the KeyNavigation.up property of an item to another item will
implicitly set the reverse (KeyNavigation.down) property on that other
item pointing back to the item. Once the item is destroyed, you will
have an invalid pointer stored in the other item pointing to the
destroyed item.

Using QPointer<> instead of raw pointers fixes that issue, because
they will become null on QObject's destruction.

Added QQuickItem test that verifies the issue is solved.

Fixes: QTBUG-75399
Change-Id: Ibb3e976c4eb9fcd81604bcc2eb757257d3653930
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

1 files changed, 7 insertions, 6 deletions

diff --git a/src/quick/items/qquickitem_p.h b/src/quick/items/qquickitem_p.h
index 771228914b..f618bcf1c3 100644
--- a/src/quick/items/qquickitem_p.h
+++ b/src/quick/items/qquickitem_p.h
@@ -75,6 +75,7 @@
 #include <QtCore/qlist.h>
 #include <QtCore/qdebug.h>
 #include <QtCore/qelapsedtimer.h>
+#include <QtCore/qpointer.h>
 
 #if QT_CONFIG(quick_shadereffect)
 #include <QtQuick/private/qquickshadereffectsource_p.h>
@@ -682,12 +683,12 @@ public:
         : leftSet(false), rightSet(false), upSet(false), downSet(false),
           tabSet(false), backtabSet(false) {}
 
-    QQuickItem *left = nullptr;
-    QQuickItem *right = nullptr;
-    QQuickItem *up = nullptr;
-    QQuickItem *down = nullptr;
-    QQuickItem *tab = nullptr;
-    QQuickItem *backtab = nullptr;
+    QPointer<QQuickItem> left;
+    QPointer<QQuickItem> right;
+    QPointer<QQuickItem> up;
+    QPointer<QQuickItem> down;
+    QPointer<QQuickItem> tab;
+    QPointer<QQuickItem> backtab;
     bool leftSet : 1;
     bool rightSet : 1;
     bool upSet : 1;