Fix invalid memory access during highlight creation in the item view

The creation of highlight item in the item views can go recursive
leading to invalid reference in the item thats been used to keep
track of the highlighted item.

The highlighted item has been reset with the newly created
highlighted item due to the geometry change in the item views,
which happened while creating the highlighted item itself. This is
like creation in a recursive loop. Since the highlighted item
referred by the tracked item, has been reset (in the second call to
the createHighlight()), the existing reference in the tracked item
automatically becomes invalid.                      

This patch adds validation to avoid recreating the highlighted item
in the item views if the creation request is already in progress.

Fixes: QTBUG-127455
Pick-to: 6.5
Change-Id: Ib4908d84e24c773e2b43a12c00ba23259896e171
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
Reviewed-by: Richard Moe Gustavsen <richard.gustavsen@qt.io>
(cherry picked from commit 81c95fb650a15261b9ba08e1dfe99f5f03fc3ad2)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 6c11f156d6f57de0916051cf18734ee9492ecb96)

2 files changed, 9 insertions, 3 deletions

diff --git a/src/quick/items/qquickitemview.cpp b/src/quick/items/qquickitemview.cpp
index 0822d43361..0a6a3e949b 100644
--- a/src/quick/items/qquickitemview.cpp
+++ b/src/quick/items/qquickitemview.cpp
@@ -2492,9 +2492,15 @@ bool QQuickItemViewPrivate::releaseItem(FxViewItem *item, QQmlInstanceModel::Reu
     return flags != QQmlInstanceModel::Referenced;
 }
 
-QQuickItem *QQuickItemViewPrivate::createHighlightItem() const
+QQuickItem *QQuickItemViewPrivate::createHighlightItem()
 {
-    return createComponentItem(highlightComponent, 0.0, true);
+    QQuickItem *item = nullptr;
+    if (!inRequest) {
+        inRequest = true;
+        item = createComponentItem(highlightComponent, 0.0, true);
+        inRequest = false;
+    }
+    return item;
 }
 
 QQuickItem *QQuickItemViewPrivate::createComponentItem(QQmlComponent *component, qreal zValue, bool createDefault) const
diff --git a/src/quick/items/qquickitemview_p_p.h b/src/quick/items/qquickitemview_p_p.h
index 0179dc1fdd..9cb6ea8fd5 100644
--- a/src/quick/items/qquickitemview_p_p.h
+++ b/src/quick/items/qquickitemview_p_p.h
@@ -152,7 +152,7 @@ public:
     }
     virtual bool releaseItem(FxViewItem *item, QQmlInstanceModel::ReusableFlag reusableFlag);
 
-    QQuickItem *createHighlightItem() const;
+    QQuickItem *createHighlightItem();
     QQuickItem *createComponentItem(QQmlComponent *component, qreal zValue, bool createDefault = false) const;
     virtual void initializeComponentItem(QQuickItem *) const;