diff options
author | Aaron Kennedy <aaron.kennedy@nokia.com> | 2009-11-09 11:33:14 +1000 |
---|---|---|
committer | Aaron Kennedy <aaron.kennedy@nokia.com> | 2009-11-10 13:44:16 +1000 |
commit | 8d7c74f560c263b3933b21d780c6a1980425a4ba (patch) | |
tree | 5cfd47381f502722a0666af613fffbf177705396 | |
parent | 74d3a4bf9654c8bbe9139951cc5c9352015438a6 (diff) |
During a GC mark the scope chain of QScriptContexts
It appears that simply being in the scope chain of an existant frame
isn't sufficient to be marked. This can lead to a QScriptContext
scope chain that contains a JSObject that has been collected.
For example, this code:
QScriptContext *ctxt = engine->pushContext();
ctxt.pushScope(engine->newObject());
previouslyCreatedFunctionObject.call(); // causes a GC
can lead to the object added to the scope chain to have become
invalid. This leads to hilarity later on.
Reviewed-by: Kent Hansen
-rw-r--r-- | src/script/api/qscriptengine.cpp | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/src/script/api/qscriptengine.cpp b/src/script/api/qscriptengine.cpp index 2b60a46a89..f41b4e28b0 100644 --- a/src/script/api/qscriptengine.cpp +++ b/src/script/api/qscriptengine.cpp @@ -1093,6 +1093,8 @@ void QScriptEnginePrivate::setContextFlags(JSC::ExecState *exec, uint flags) void QScriptEnginePrivate::mark(JSC::MarkStack& markStack) { + Q_Q(QScriptEngine); + markStack.append(originalGlobalObject()); markStack.append(globalObject()); if (originalGlobalObjectProxy) @@ -1130,6 +1132,22 @@ void QScriptEnginePrivate::mark(JSC::MarkStack& markStack) markStack.append((*it)->prototype); } } + + { + QScriptContext *context = q->currentContext(); + + while (context) { + JSC::ScopeChainNode *node = frameForContext(context)->scopeChain(); + JSC::ScopeChainIterator it(node); + for (it = node->begin(); it != node->end(); ++it) { + JSC::JSObject *object = *it; + if (object) + markStack.append(object); + } + + context = context->parentContext(); + } + } } bool QScriptEnginePrivate::isCollecting() const |