MemoryManager: Only clear weak values once

We want to keep the weak values alive while the destruction callbacks
are running, so that they can still access them. We set them to
undefined later anyway because we expect the destruction callbacks to
mess with the values. Therefore there is no point in also setting them
in between.

Fixes: QTBUG-72137
Change-Id: I83f70230f5b4ad2761c74770f975b14a5ca71f18
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

5 files changed, 90 insertions, 5 deletions

diff --git a/src/qml/memory/qv4mm.cpp b/src/qml/memory/qv4mm.cpp
index 97254b9172..3cf22d82e5 100644
--- a/src/qml/memory/qv4mm.cpp
+++ b/src/qml/memory/qv4mm.cpp
@@ -973,8 +973,6 @@ void MemoryManager::sweep(bool lastSweep, ClassDestroyStatsCallback classCountPt
         // signal before we start sweeping the heap
         if (QObjectWrapper *qobjectWrapper = (*it).as<QObjectWrapper>())
             qobjectWrapper->destroyObject(lastSweep);
-
-        (*it) = Value::undefinedValue();
     }
 
     // remove objects from weak maps and sets
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 085cd5ffd0..788ecce1c5 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -7550,7 +7550,8 @@ public:
 
 private slots:
     void reviveFirstWeakReference() {
-        *resultPtr = weakRef->valueRef() && weakRef->isNullOrUndefined();
+        // weakRef is not required to be undefined here. The gc can clear it later.
+        *resultPtr = weakRef->valueRef();
         if (!*resultPtr)
             return;
         QV4::ExecutionEngine *v4 = qmlEngine(this)->handle();
diff --git a/tests/auto/qml/qv4mm/data/createdestroy.qml b/tests/auto/qml/qv4mm/data/createdestroy.qml
new file mode 100644
index 0000000000..5a4dd0f520
--- /dev/null
+++ b/tests/auto/qml/qv4mm/data/createdestroy.qml
@@ -0,0 +1,60 @@
+/****************************************************************************
+**
+** Copyright (C) 2019 The Qt Company Ltd.
+** Contact: https://www.qt.io/licensing/
+**
+** This file is part of the test suite of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:GPL-EXCEPT$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and The Qt Company. For licensing terms
+** and conditions see https://www.qt.io/terms-conditions. For further
+** information use the contact form at https://www.qt.io/contact-us.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3 as published by the Free Software
+** Foundation with exceptions as appearing in the file LICENSE.GPL3-EXCEPT
+** included in the packaging of this file. Please review the following
+** information to ensure the GNU General Public License requirements will
+** be met: https://www.gnu.org/licenses/gpl-3.0.html.
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+import QtQml 2.2
+
+QtObject {
+    property int creations: 0
+    property int destructions: 0
+    property int iterations: 0
+
+    property Component itemComponent: Component {
+        QtObject {
+            property var parent;
+            Component.onCompleted: ++parent.creations
+            Component.onDestruction: ++parent.destructions
+        }
+    }
+
+    property QtObject item: null;
+    property Timer timer: Timer {
+        running: true
+        repeat: true
+        interval: 1
+        onTriggered: {
+            if (parent.iterations === 100) {
+                item = null;
+                running = false;
+            } else {
+                ++parent.iterations;
+                item = itemComponent.createObject(null, { parent : parent });
+            }
+            gc();
+        }
+    }
+}
diff --git a/tests/auto/qml/qv4mm/qv4mm.pro b/tests/auto/qml/qv4mm/qv4mm.pro
index d9b749af4a..375c5cea75 100644
--- a/tests/auto/qml/qv4mm/qv4mm.pro
+++ b/tests/auto/qml/qv4mm/qv4mm.pro
@@ -1,6 +1,10 @@
 CONFIG += testcase
 TARGET = tst_qv4mm
-osx:CONFIG -= app_bundle
+include (../../shared/util.pri)
+
+macos:CONFIG -= app_bundle
+
+TESTDATA = data/*
 
 SOURCES += tst_qv4mm.cpp
 
diff --git a/tests/auto/qml/qv4mm/tst_qv4mm.cpp b/tests/auto/qml/qv4mm/tst_qv4mm.cpp
index d8f4ed12e8..578a47d5fa 100644
--- a/tests/auto/qml/qv4mm/tst_qv4mm.cpp
+++ b/tests/auto/qml/qv4mm/tst_qv4mm.cpp
@@ -29,16 +29,23 @@
 #include <qtest.h>
 #include <QQmlEngine>
 #include <QLoggingCategory>
+#include <QQmlComponent>
+
 #include <private/qv4mm_p.h>
 #include <private/qv4qobjectwrapper_p.h>
 
-class tst_qv4mm : public QObject
+#include "../../shared/util.h"
+
+#include <memory>
+
+class tst_qv4mm : public QQmlDataTest
 {
     Q_OBJECT
 
 private slots:
     void gcStats();
     void multiWrappedQObjects();
+    void accessParentOnDestruction();
 };
 
 void tst_qv4mm::gcStats()
@@ -86,6 +93,21 @@ void tst_qv4mm::multiWrappedQObjects()
     QCOMPARE(engine2.memoryManager->m_pendingFreedObjectWrapperValue.size(), 0);
 }
 
+void tst_qv4mm::accessParentOnDestruction()
+{
+    QLoggingCategory::setFilterRules("qt.qml.gc.*=false");
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("createdestroy.qml"));
+    std::unique_ptr<QObject> obj(component.create());
+    QVERIFY(obj);
+    QPointer<QObject> timer = qvariant_cast<QObject *>(obj->property("timer"));
+    QVERIFY(timer);
+    QTRY_VERIFY(!timer->property("running").toBool());
+    QCOMPARE(obj->property("iterations").toInt(), 100);
+    QCOMPARE(obj->property("creations").toInt(), 100);
+    QCOMPARE(obj->property("destructions").toInt(), 100);
+}
+
 QTEST_MAIN(tst_qv4mm)
 
 #include "tst_qv4mm.moc"