QQuickItemView: don't leave dangling entries in unrequestedItems

b0b1c1de68a1cc15f6304bb85d0c57a49499f866 ("QQuickItemView: register
Destroyed listener when storing an item") added a loop at the end of
~QQuickItemView that walks unrequestedItems and dereferences the stored
raw pointers to remove our Destroyed listener from each item. This is
only safe while every entry points at a live item. The listener is what
keeps that true: when the item is deleted, it calls itemDestroyed(),
which removes the entry from the hash.

releaseItem() can break that invariant. An item stored with isClearing
== false gets both the entry and the listener. Releasing it again while
the view is being cleared (isClearing == true) removes the listener but
leaves the entry, so itemDestroyed() never runs for it and the entry is
never dropped. Once the item is freed, the destructor loop dereferences
a dangling pointer, causing a use-after-free crash.

For instance, deactivating a Loader that hosts a ListView invalidates
the delegate contexts synchronously while the deferred delete is still
pending: the delegate ends up in unrequestedItems, and its
currentItem/visibleItems twin is released again during clear(true).

Remove the entry from unrequestedItems whenever the listener is removed,
keeping the two in sync so the destructor never walks a freed pointer.

Fixes: QTBUG-150769
Pick-to: 6.12
Change-Id: Ide32473f3fea373749197c969eaff6d13869c32d
Reviewed-by: Mitch Curtis <mitch.curtis@qt.io>
Reviewed-by: Richard Moe Gustavsen <richard.gustavsen@qt.io>

0 files changed, 0 insertions, 0 deletions