# --- T2-COPYRIGHT-BEGIN ---
# t2/package/*/qt6declarative/hotfix-use-after-free.patch
# Copyright (C) 2026 The T2 SDE Project
# SPDX-License-Identifier: GPL-2.0 or patched project license
# --- T2-COPYRIGHT-END ---

--- qtdeclarative-everywhere-src-6.11.1/src/qml/qml/qqmllistwrapper.cpp.vanilla	2026-07-26 15:37:02.336369692 +0200
+++ qtdeclarative-everywhere-src-6.11.1/src/qml/qml/qqmllistwrapper.cpp	2026-07-26 15:37:08.667740175 +0200
@@ -188,9 +188,18 @@ ReturnedValue QmlListWrapper::createOwne
 QVariant QmlListWrapper::toVariant() const
 {
     Heap::QmlListWrapper *p = d();
-    return p->object()
-            ? QVariant::fromValue(toListReference())
-            : QVariant::fromValue(p->property()->toList<QObjectList>());
+
+    // A wrapper without an owning object keeps its elements in its own array data,
+    // so the list callbacks can always be run.
+    if (!p->property()->object)
+        return QVariant::fromValue(p->property()->toList<QObjectList>());
+
+    // The owning object was destroyed: the QQmlListProperty still holds a dangling
+    // QObject* its callbacks would dereference.
+    if (!p->object())
+        return QVariant::fromValue(QObjectList());
+
+    return QVariant::fromValue(toListReference());
 }
 
 QQmlListReference QmlListWrapper::toListReference() const