From 0692398b0b1ce505d8d84791dfd99c390c8ecf69 Mon Sep 17 00:00:00 2001
From: Friedemann Kleint <Friedemann.Kleint@qt.io>
Date: Fri, 18 Sep 2020 13:00:21 +0200
Subject: [PATCH] Fix a double deletion in QDomAttr::setNodeValue()

Check the reference count before deleting. Patch
as contributed on bug report.

Fixes: QTBUG-86547
Change-Id: I2cb197e3eeda7ade2442c23f6b4f1ae6ff2ff810
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
(cherry picked from commit af22ccf5605c6b7b20b845fb2b4003d3f56d8bc9)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
---
 src/xml/dom/qdom.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/xml/dom/qdom.cpp b/src/xml/dom/qdom.cpp
index 5893d8448e1..dd6916f9468 100644
--- a/src/xml/dom/qdom.cpp
+++ b/src/xml/dom/qdom.cpp
@@ -4117,7 +4117,9 @@ void QDomAttrPrivate::setNodeValue(const QString& v)
     // keep the refcount balanced: appendChild() does a ref anyway.
     t->ref.deref();
     if (first) {
-        delete removeChild(first);
+        auto removed = removeChild(first);
+        if (removed && !removed->ref)
+            delete removed;
     }
     appendChild(t);
 }