From 3c23f5371a19991771bd29c27d377c6672e46cd1 Mon Sep 17 00:00:00 2001
From: Ulf Hermann <ulf.hermann@qt.io>
Date: Fri, 10 Jan 2020 10:01:36 +0100
Subject: On QQmlEngine destruction drop singletons before type loader

The singleton destruction can trigger additional types to be loaded.

Fixes: QTBUG-80840
Change-Id: Ifa406b2a1cfd3b9e9b36e8005dfc0808eebf15cf
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
---
 .../qqmlengine/data/evilSingletonInstantiation.qml |  6 +++++
 tests/auto/qml/qqmlengine/tst_qqmlengine.cpp       | 31 ++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 tests/auto/qml/qqmlengine/data/evilSingletonInstantiation.qml

(limited to 'tests/auto/qml/qqmlengine')

diff --git a/tests/auto/qml/qqmlengine/data/evilSingletonInstantiation.qml b/tests/auto/qml/qqmlengine/data/evilSingletonInstantiation.qml
new file mode 100644
index 0000000000..757b0c90bb
--- /dev/null
+++ b/tests/auto/qml/qqmlengine/data/evilSingletonInstantiation.qml
@@ -0,0 +1,6 @@
+import QtQml 2.12
+import foo.foo 1.0
+
+QtObject {
+    objectName: Singleton.objectName
+}
diff --git a/tests/auto/qml/qqmlengine/tst_qqmlengine.cpp b/tests/auto/qml/qqmlengine/tst_qqmlengine.cpp
index 64f167b47e..613616ab71 100644
--- a/tests/auto/qml/qqmlengine/tst_qqmlengine.cpp
+++ b/tests/auto/qml/qqmlengine/tst_qqmlengine.cpp
@@ -83,6 +83,7 @@ private slots:
     void singletonInstance();
     void aggressiveGc();
     void cachedGetterLookup_qtbug_75335();
+    void createComponentOnSingletonDestruction();
 
 public slots:
     QObject *createAQObjectForOwnershipTest ()
@@ -1141,6 +1142,36 @@ void tst_qqmlengine::cachedGetterLookup_qtbug_75335()
     QVERIFY(object != nullptr);
 }
 
+class EvilSingleton : public QObject
+{
+    Q_OBJECT
+public:
+    QPointer<QQmlEngine> m_engine;
+    EvilSingleton(QQmlEngine *engine) : m_engine(engine) {
+        connect(this, &QObject::destroyed, this, [this]() {
+            QQmlComponent component(m_engine);
+            component.setData("import QtQml 2.0\nQtObject {}", QUrl("file://Stuff.qml"));
+            QVERIFY(component.isReady());
+            QScopedPointer<QObject> obj(component.create());
+            QVERIFY(obj);
+        });
+    }
+};
+
+void tst_qqmlengine::createComponentOnSingletonDestruction()
+{
+    qmlRegisterSingletonType<EvilSingleton>("foo.foo", 1, 0, "Singleton",
+                                            [](QQmlEngine *engine, QJSEngine *) {
+        return new EvilSingleton(engine);
+    });
+
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("evilSingletonInstantiation.qml"));
+    QVERIFY(component.isReady());
+    QScopedPointer<QObject> obj(component.create());
+    QVERIFY(obj);
+}
+
 QTEST_MAIN(tst_qqmlengine)
 
 #include "tst_qqmlengine.moc"
-- 
cgit v1.2.3