QQmlTableInstanceModel: Fix refcounting of metatypes

The reusable items pool should only hold unreferenced objects.
Therefore, we can immediately delete them when draining. release() is
not suitable here because it unconditionally decreases and therefore
underflows the refcount.

Furthermore, the metatype is also refcounted, which means we should
keep it in a QQmlRefCounter in order to not leak references.

Task-number: QTBUG-82000
Change-Id: Iefdaaecc34342eb2e3b1e5a3281f2e46ac472347
Reviewed-by: Joni Poikelin <joni.poikelin@qt.io>
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

2 files changed, 14 insertions, 4 deletions

diff --git a/src/qmlmodels/qqmltableinstancemodel.cpp b/src/qmlmodels/qqmltableinstancemodel.cpp
index fb2f7ee98b..9800eb8c72 100644
--- a/src/qmlmodels/qqmltableinstancemodel.cpp
+++ b/src/qmlmodels/qqmltableinstancemodel.cpp
@@ -78,7 +78,10 @@ void QQmlTableInstanceModel::deleteModelItemLater(QQmlDelegateModelItem *modelIt
 QQmlTableInstanceModel::QQmlTableInstanceModel(QQmlContext *qmlContext, QObject *parent)
     : QQmlInstanceModel(*(new QObjectPrivate()), parent)
     , m_qmlContext(qmlContext)
-    , m_metaType(new QQmlDelegateModelItemMetaType(m_qmlContext->engine()->handle(), nullptr, QStringList()))
+    , m_metaType(
+          new QQmlDelegateModelItemMetaType(m_qmlContext->engine()->handle(), nullptr,
+                                            QStringList()),
+          QQmlRefPointer<QQmlDelegateModelItemMetaType>::Adopt)
 {
 }
 
@@ -149,7 +152,7 @@ QQmlDelegateModelItem *QQmlTableInstanceModel::resolveModelItem(int index)
     }
 
     // Create a new item from scratch
-    modelItem = m_adaptorModel.createItem(m_metaType, index);
+    modelItem = m_adaptorModel.createItem(m_metaType.data(), index);
     if (modelItem) {
         modelItem->delegate = delegate;
         m_modelItems.insert(index, modelItem);
@@ -333,7 +336,14 @@ void QQmlTableInstanceModel::drainReusableItemsPool(int maxPoolTime)
             ++it;
         } else {
             it = m_reusableItemsPool.erase(it);
-            release(modelItem->object, NotReusable);
+
+            Q_ASSERT(!modelItem->incubationTask);
+            Q_ASSERT(!modelItem->isObjectReferenced());
+            Q_ASSERT(!modelItem->isReferenced());
+            Q_ASSERT(modelItem->object);
+            emit destroyingItem(modelItem->object);
+            delete modelItem->object;
+            delete modelItem;
         }
     }
 }
diff --git a/src/qmlmodels/qqmltableinstancemodel_p.h b/src/qmlmodels/qqmltableinstancemodel_p.h
index 1ea5ee7401..fd5968d872 100644
--- a/src/qmlmodels/qqmltableinstancemodel_p.h
+++ b/src/qmlmodels/qqmltableinstancemodel_p.h
@@ -142,7 +142,7 @@ private:
     QQmlAbstractDelegateComponent *m_delegateChooser = nullptr;
     QQmlComponent *m_delegate = nullptr;
     QPointer<QQmlContext> m_qmlContext;
-    QQmlDelegateModelItemMetaType *m_metaType;
+    QQmlRefPointer<QQmlDelegateModelItemMetaType> m_metaType;
 
     QHash<int, QQmlDelegateModelItem *> m_modelItems;
     QList<QQmlDelegateModelItem *> m_reusableItemsPool;