Fix crash on exit when centering Popup within Overlay in StackView item

If a Popup is centered within an Overlay, and that Overlay is destroyed
before the Popup, we must make sure centerIn is cleared so we don't try
to access a dangling pointer.

Fixes: QTBUG-84579
Pick-to: 5.15 5.12
Change-Id: Icb2750f847f9d5710725bedc4d1c92bf4c122c03
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>

2 files changed, 31 insertions, 1 deletions

diff --git a/src/quicktemplates2/qquickpopupanchors.cpp b/src/quicktemplates2/qquickpopupanchors.cpp
index c48ca5ff..0d286cc0 100644
--- a/src/quicktemplates2/qquickpopupanchors.cpp
+++ b/src/quicktemplates2/qquickpopupanchors.cpp
@@ -47,6 +47,15 @@ QQuickPopupAnchors::QQuickPopupAnchors(QQuickPopup *popup)
     d->popup = popup;
 }
 
+QQuickPopupAnchors::~QQuickPopupAnchors()
+{
+    Q_D(const QQuickPopupAnchors);
+    if (d->centerIn) {
+        auto centerInPrivate = QQuickItemPrivate::get(d->centerIn);
+        centerInPrivate->removeItemChangeListener(this, QQuickItemPrivate::Destroyed);
+    }
+}
+
 QQuickItem *QQuickPopupAnchors::centerIn() const
 {
     Q_D(const QQuickPopupAnchors);
@@ -59,8 +68,20 @@ void QQuickPopupAnchors::setCenterIn(QQuickItem *item)
     if (item == d->centerIn)
         return;
 
+    if (d->centerIn) {
+        auto centerInPrivate = QQuickItemPrivate::get(d->centerIn);
+        centerInPrivate->removeItemChangeListener(this, QQuickItemPrivate::Destroyed);
+    }
+
     d->centerIn = item;
+
+    if (d->centerIn) {
+        auto centerInPrivate = QQuickItemPrivate::get(d->centerIn);
+        centerInPrivate->addItemChangeListener(this, QQuickItemPrivate::Destroyed);
+    }
+
     QQuickPopupPrivate::get(d->popup)->reposition();
+
     emit centerInChanged();
 }
 
@@ -69,6 +90,11 @@ void QQuickPopupAnchors::resetCenterIn()
     setCenterIn(nullptr);
 }
 
+void QQuickPopupAnchors::itemDestroyed(QQuickItem *)
+{
+    resetCenterIn();
+}
+
 QT_END_NAMESPACE
 
 #include "moc_qquickpopupanchors_p.cpp"
diff --git a/src/quicktemplates2/qquickpopupanchors_p.h b/src/quicktemplates2/qquickpopupanchors_p.h
index 531c494e..eff4e23d 100644
--- a/src/quicktemplates2/qquickpopupanchors_p.h
+++ b/src/quicktemplates2/qquickpopupanchors_p.h
@@ -50,6 +50,7 @@
 
 #include <QtCore/qobject.h>
 #include <QtQml/qqml.h>
+#include <QtQuick/private/qquickitem_p.h>
 #include <QtQuickTemplates2/private/qtquicktemplates2global_p.h>
 
 QT_BEGIN_NAMESPACE
@@ -58,13 +59,14 @@ class QQuickItem;
 class QQuickPopupAnchorsPrivate;
 class QQuickPopup;
 
-class Q_QUICKTEMPLATES2_PRIVATE_EXPORT QQuickPopupAnchors : public QObject
+class Q_QUICKTEMPLATES2_PRIVATE_EXPORT QQuickPopupAnchors : public QObject, public QQuickItemChangeListener
 {
     Q_OBJECT
     Q_PROPERTY(QQuickItem *centerIn READ centerIn WRITE setCenterIn RESET resetCenterIn NOTIFY centerInChanged)
 
 public:
     explicit QQuickPopupAnchors(QQuickPopup *popup);
+    ~QQuickPopupAnchors();
 
     QQuickItem *centerIn() const;
     void setCenterIn(QQuickItem *item);
@@ -74,6 +76,8 @@ Q_SIGNALS:
     void centerInChanged();
 
 private:
+    void itemDestroyed(QQuickItem *item) override;
+
     Q_DISABLE_COPY(QQuickPopupAnchors)
     Q_DECLARE_PRIVATE(QQuickPopupAnchors)
 };