QQmlObjectModel: Guard against spontaneous deletion of objects

Since QQmlObjectModel does not own its elements, we cannot assume
anything about their life cycle. Observe the elements using QPointer and
do not access them anymore when they are dead.

Pick-to: 6.8
Task-number: QTBUG-124345
Change-Id: I3ba806ae2bbc6ec0b0d97ae6c51cea32e25d4508
Reviewed-by: Olivier De Cannière <[email protected]>
Reviewed-by: Fabian Kosmale <[email protected]>

1 files changed, 8 insertions, 6 deletions

diff --git a/src/qmlmodels/qqmlobjectmodel.cpp b/src/qmlmodels/qqmlobjectmodel.cpp
index fc63d5004e..1be4382ea1 100644
--- a/src/qmlmodels/qqmlobjectmodel.cpp
+++ b/src/qmlmodels/qqmlobjectmodel.cpp
@@ -3,7 +3,6 @@
 
 #include "qqmlobjectmodel_p.h"
 
-#include <QtCore/qcoreapplication.h>
 #include <QtQml/qqmlcontext.h>
 #include <QtQml/qqmlengine.h>
 #include <QtQml/qqmlinfo.h>
@@ -11,10 +10,11 @@
 #include <private/qqmlchangeset_p.h>
 #include <private/qqmlglobal_p.h>
 #include <private/qobject_p.h>
-#include <private/qpodvector_p.h>
 
+#include <QtCore/qcoreapplication.h>
 #include <QtCore/qhash.h>
 #include <QtCore/qlist.h>
+#include <QtCore/qvarlengtharray.h>
 
 QT_BEGIN_NAMESPACE
 
@@ -29,7 +29,7 @@ public:
         void addRef() { ++ref; }
         bool deref() { return --ref == 0; }
 
-        QObject *item;
+        QPointer<QObject> item;
         int ref;
     };
 
@@ -95,7 +95,7 @@ public:
             n = tfrom-tto;
         }
 
-        QPODVector<QQmlObjectModelPrivate::Item, 4> store;
+        QVarLengthArray<QQmlObjectModelPrivate::Item, 4> store;
         for (int i = 0; i < to - from; ++i)
             store.append(children[from + n + i]);
         for (int i = 0; i < n; ++i)
@@ -158,7 +158,7 @@ private:
     QList<Item> children;
 };
 
-Q_DECLARE_TYPEINFO(QQmlObjectModelPrivate::Item, Q_PRIMITIVE_TYPE);
+Q_DECLARE_TYPEINFO(QQmlObjectModelPrivate::Item, Q_RELOCATABLE_TYPE);
 
 
 /*!
@@ -269,7 +269,9 @@ QVariant QQmlObjectModel::variantValue(int index, const QString &role)
     Q_D(QQmlObjectModel);
     if (index < 0 || index >= d->children.size())
         return QString();
-    return d->children.at(index).item->property(role.toUtf8().constData());
+    if (QObject *item = d->children.at(index).item)
+        return item->property(role.toUtf8().constData());
+    return QString();
 }
 
 QQmlIncubator::Status QQmlObjectModel::incubationStatus(int)