Details
Description
The attached example uses a DelegateModel with a DelegateModelGroup "selectedItems" to remember item selection (in the original code it was used to persist item expansion across model resets). If the first item "foo" is selected and the "clear" button is clicked, the clearing of the underlying model causes a crash in DelegateModel.
The issue occurs here because the DelegateModelGroup is used in the binding of "height" (making items in the group twice as high as those not in the group). If the group membership is only used for coloring, the crash does not occur.
Looks like in QQmlDelegateModelAttached::emitChanges(), m_cacheItem is reset to nullptr as an effect of one of the emitted signals, and accessed afterwards (still inside the for loop)without check.
This affects at least Qt 5.9.9 onwards, but not Qt 5.6.3.