QQmlListModel: Do not crash or leak when querying inner models

The list models can be nested, and inner models don't necessarily have a
layout. Also, we need to release any worker agents we reference.

Pick-to: 6.9 6.8 6.5 5.15
Fixes: QTBUG-136127
Change-Id: Ibedefce2a1d6783169e754fbf083099d050dceb1
Reviewed-by: Olivier De Cannière <[email protected]>
Reviewed-by: Sami Shalayel <[email protected]>

1 files changed, 10 insertions, 5 deletions

diff --git a/src/qmlmodels/qqmllistmodel.cpp b/src/qmlmodels/qqmllistmodel.cpp
index e553c747ef..a33d391f89 100644
--- a/src/qmlmodels/qqmllistmodel.cpp
+++ b/src/qmlmodels/qqmllistmodel.cpp
@@ -2068,7 +2068,11 @@ QQmlListModel::QQmlListModel(QQmlListModel *orig, QQmlListModelWorkerAgent *agen
     m_agent = agent;
     m_dynamicRoles = orig->m_dynamicRoles;
 
-    m_layout = new ListLayout(orig->m_layout);
+    if (ListLayout *layout = orig->m_layout)
+        m_layout = new ListLayout(layout);
+    else
+        m_layout = new ListLayout;
+
     m_listModel = new ListModel(m_layout, this);
 
     if (m_dynamicRoles)
@@ -2088,12 +2092,13 @@ QQmlListModel::~QQmlListModel()
         m_listModel->destroy();
         delete m_listModel;
 
-        if (m_mainThread && m_agent) {
+        if (m_mainThread && m_agent)
             m_agent->modelDestroyed();
-            m_agent->release();
-        }
     }
 
+    if (m_mainThread && m_agent)
+        m_agent->release();
+
     m_listModel = nullptr;
 
     delete m_layout;
@@ -2363,7 +2368,7 @@ void QQmlListModel::setDynamicRoles(bool enableDynamicRoles)
 {
     if (m_mainThread && m_agent == nullptr) {
         if (enableDynamicRoles) {
-            if (m_layout->roleCount())
+            if (m_layout && m_layout->roleCount())
                 qmlWarning(this) << tr("unable to enable dynamic roles as this model is not empty");
             else
                 m_dynamicRoles = true;