QQuickPopupPositioner: avoid adding duplicate item change listeners

The issue is that QQuickPopupPositioner::setParentItem() is called when
the delegate has been created and assigned to the Repeater, then the
ancestor listeners are added, and then straight after that, the
benchmark item itself is parented to benchmarkRoot, which causes
QQuickPopupPositioner::itemParentChanged() to be called, which adds a
single ancestor listener: the QQuickRootItem (which was just added
previously as a result of QQuickPopupPositioner::setParentItem()
being called).

The item could be arbitrarily high up in the ancestry tree, so there's
no nice (i.e. fast) way of checking for duplicates in Controls 2
itself. Instead, use the new
QQuickItemPrivate::updateOrAddItemChangeListener() function which only
adds the listener if it doesn't already exist.

This avoids a heap-use-after-free in qmlbench when creating Menus.

Task-number: QTBUG-70729
Change-Id: I0efaa10167c4c9a9c4c1b65a5c34e683c3ec5732
Fixes: QTBUG-70729
Reviewed-by: Michael Brasser <michael.brasser@live.com>
Reviewed-by: Richard Moe Gustavsen <richard.gustavsen@qt.io>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/quicktemplates2/qquickpopuppositioner.cpp b/src/quicktemplates2/qquickpopuppositioner.cpp
index 841eac9c..4fe5135c 100644
--- a/src/quicktemplates2/qquickpopuppositioner.cpp
+++ b/src/quicktemplates2/qquickpopuppositioner.cpp
@@ -269,7 +269,7 @@ void QQuickPopupPositioner::addAncestorListeners(QQuickItem *item)
 
     QQuickItem *p = item;
     while (p) {
-        QQuickItemPrivate::get(p)->addItemChangeListener(this, AncestorChangeTypes);
+        QQuickItemPrivate::get(p)->updateOrAddItemChangeListener(this, AncestorChangeTypes);
         p = p->parentItem();
     }
 }