Don't return a Property pointer in Object::advanceIterator

Change-Id: Iac4cb2a2252b18e40455910e51e3e374df7c1e80
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

15 files changed, 76 insertions, 79 deletions

diff --git a/src/qml/jsruntime/qv4managed.cpp b/src/qml/jsruntime/qv4managed.cpp
index c3dec2535b..60f6b7dbab 100644
--- a/src/qml/jsruntime/qv4managed.cpp
+++ b/src/qml/jsruntime/qv4managed.cpp
@@ -255,7 +255,7 @@ bool Managed::deleteProperty(const StringRef name)
     return internalClass->vtable->deleteProperty(this, name);
 }
 
-Property *Managed::advanceIterator(ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes)
+void Managed::advanceIterator(ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attributes)
 {
-    return internalClass->vtable->advanceIterator(this, it, name, index, attributes);
+    internalClass->vtable->advanceIterator(this, it, name, index, p, attributes);
 }
diff --git a/src/qml/jsruntime/qv4managed_p.h b/src/qml/jsruntime/qv4managed_p.h
index 932dbe818c..89618955eb 100644
--- a/src/qml/jsruntime/qv4managed_p.h
+++ b/src/qml/jsruntime/qv4managed_p.h
@@ -107,7 +107,7 @@ struct ManagedVTable
     void (*setLookup)(Managed *m, Lookup *l, const ValueRef v);
     bool (*isEqualTo)(Managed *m, Managed *other);
     uint (*getLength)(const Managed *m);
-    Property *(*advanceIterator)(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes);
+    void (*advanceIterator)(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attributes);
     const char *className;
 };
 
@@ -332,7 +332,7 @@ public:
     bool isEqualTo(Managed *other)
     { return internalClass->vtable->isEqualTo(this, other); }
     uint getLength() const { return internalClass->vtable->getLength(this); }
-    Property *advanceIterator(ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes);
+    void advanceIterator(ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attributes);
 
     static void destroy(Managed *that) { that->_data = 0; }
     static ReturnedValue construct(Managed *m, CallData *d);
diff --git a/src/qml/jsruntime/qv4object.cpp b/src/qml/jsruntime/qv4object.cpp
index 0814613ebf..0208c85c69 100644
--- a/src/qml/jsruntime/qv4object.cpp
+++ b/src/qml/jsruntime/qv4object.cpp
@@ -547,7 +547,7 @@ void Object::setLookup(Managed *m, Lookup *l, const ValueRef value)
         l->setter = Lookup::setterInsert2;
 }
 
-Property *Object::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attrs)
+void Object::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *pd, PropertyAttributes *attrs)
 {
     Object *o = static_cast<Object *>(m);
     name = (String *)0;
@@ -568,9 +568,9 @@ Property *Object::advanceIterator(Managed *m, ObjectIterator *it, StringRef name
                 if (!(it->flags & ObjectIterator::EnumerableOnly) || a.isEnumerable()) {
                     it->arrayIndex = k + 1;
                     *index = k;
-                    if (attrs)
-                        *attrs = a;
-                    return p;
+                    *attrs = a;
+                    *pd = *p;
+                    return;
                 }
             }
             it->arrayNode = 0;
@@ -584,9 +584,9 @@ Property *Object::advanceIterator(Managed *m, ObjectIterator *it, StringRef name
             if (!p->value.isEmpty()
                 && (!(it->flags & ObjectIterator::EnumerableOnly) || a.isEnumerable())) {
                 *index = it->arrayIndex - 1;
-                if (attrs)
-                    *attrs = a;
-                return p;
+                *attrs = a;
+                *pd = *p;
+                return;
             }
         }
     }
@@ -600,13 +600,13 @@ Property *Object::advanceIterator(Managed *m, ObjectIterator *it, StringRef name
         ++it->memberIndex;
         if (!(it->flags & ObjectIterator::EnumerableOnly) || a.isEnumerable()) {
             name = n;
-            if (attrs)
-                *attrs = a;
-            return p;
+            *attrs = a;
+            *pd = *p;
+            return;
         }
     }
 
-    return 0;
+    *attrs = PropertyAttributes();
 }
 
 // Section 8.12.3
diff --git a/src/qml/jsruntime/qv4object_p.h b/src/qml/jsruntime/qv4object_p.h
index d84b553b66..f99191a24c 100644
--- a/src/qml/jsruntime/qv4object_p.h
+++ b/src/qml/jsruntime/qv4object_p.h
@@ -265,7 +265,7 @@ protected:
     static bool deleteIndexedProperty(Managed *m, uint index);
     static ReturnedValue getLookup(Managed *m, Lookup *l);
     static void setLookup(Managed *m, Lookup *l, const ValueRef v);
-    static Property *advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes);
+    static void advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attributes);
     static uint getLength(const Managed *m);
 
 private:
diff --git a/src/qml/jsruntime/qv4objectiterator.cpp b/src/qml/jsruntime/qv4objectiterator.cpp
index 64ab671abf..3efda3f9cb 100644
--- a/src/qml/jsruntime/qv4objectiterator.cpp
+++ b/src/qml/jsruntime/qv4objectiterator.cpp
@@ -56,7 +56,6 @@ ObjectIterator::ObjectIterator(SafeObject *scratch1, SafeObject *scratch2, const
 {
     object = o;
     current = o;
-    tmpDynamicProperty.value = Primitive::undefinedValue();
 
     if (object && object->asArgumentsObject()) {
         Scope scope(object->engine());
@@ -74,7 +73,6 @@ ObjectIterator::ObjectIterator(Scope &scope, const ObjectRef o, uint flags)
 {
     object = o;
     current = o;
-    tmpDynamicProperty.value = Primitive::undefinedValue();
 
     if (object && object->asArgumentsObject()) {
         Scope scope(object->engine());
@@ -92,25 +90,29 @@ void ObjectIterator::next(StringRef name, uint *index, Property *pd, PropertyAtt
         return;
     }
 
-    Property *p = 0;
     while (1) {
         if (!current)
             break;
 
-        while ((p = current->advanceIterator(this, name, index, attrs))) {
+        while (1) {
+            current->advanceIterator(this, name, index, pd, attrs);
+            if (attrs->isEmpty())
+                break;
             // check the property is not already defined earlier in the proto chain
             if (current != object) {
-                Property *pp;
-                if (name) {
-                    pp = object->__getPropertyDescriptor__(name);
-                } else {
-                    assert (*index != UINT_MAX);
-                    pp = object->__getPropertyDescriptor__(*index);
+                Object *o = object;
+                bool shadowed = false;
+                while (o != current) {
+                    if ((name && o->hasOwnProperty(name)) ||
+                        (*index != UINT_MAX && o->hasOwnProperty(*index))) {
+                        shadowed = true;
+                        break;
+                    }
+                    o = o->prototype();
                 }
-                if (pp != p)
+                if (shadowed)
                     continue;
             }
-            *pd = *p;
             return;
         }
 
diff --git a/src/qml/jsruntime/qv4objectiterator_p.h b/src/qml/jsruntime/qv4objectiterator_p.h
index 142895a41a..e95f59e247 100644
--- a/src/qml/jsruntime/qv4objectiterator_p.h
+++ b/src/qml/jsruntime/qv4objectiterator_p.h
@@ -74,8 +74,6 @@ struct Q_QML_EXPORT ObjectIterator
     uint memberIndex;
     uint flags;
 
-    Property tmpDynamicProperty;
-
     ObjectIterator(SafeObject *scratch1, SafeObject *scratch2, const ObjectRef o, uint flags);
     ObjectIterator(Scope &scope, const ObjectRef o, uint flags);
     void next(StringRef name, uint *index, Property *pd, PropertyAttributes *attributes = 0);
diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index bad2cf3cd4..17673fcfb6 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -700,36 +700,33 @@ PropertyAttributes QObjectWrapper::query(const Managed *m, StringRef name)
         return QV4::Object::query(m, name);
 }
 
-Property *QObjectWrapper::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes)
+void QObjectWrapper::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attributes)
 {
     name = (String *)0;
     *index = UINT_MAX;
 
     QObjectWrapper *that = static_cast<QObjectWrapper*>(m);
 
-    if (!that->m_object)
-        return QV4::Object::advanceIterator(m, it, name, index, attributes);
-
-    const QMetaObject *mo = that->m_object->metaObject();
-    const int propertyCount = mo->propertyCount();
-    if (it->arrayIndex < static_cast<uint>(propertyCount)) {
-        name = that->engine()->newString(QString::fromUtf8(mo->property(it->arrayIndex).name()));
-        ++it->arrayIndex;
-        if (attributes)
+    if (that->m_object) {
+        const QMetaObject *mo = that->m_object->metaObject();
+        const int propertyCount = mo->propertyCount();
+        if (it->arrayIndex < static_cast<uint>(propertyCount)) {
+            name = that->engine()->newString(QString::fromUtf8(mo->property(it->arrayIndex).name()));
+            ++it->arrayIndex;
             *attributes = QV4::Attr_Data;
-        it->tmpDynamicProperty.value = that->get(name);
-        return &it->tmpDynamicProperty;
-    }
-    const int methodCount = mo->methodCount();
-    if (it->arrayIndex < static_cast<uint>(propertyCount + methodCount)) {
-        name = that->engine()->newString(QString::fromUtf8(mo->method(it->arrayIndex - propertyCount).name()));
-        ++it->arrayIndex;
-        if (attributes)
+            p->value = that->get(name);
+            return;
+        }
+        const int methodCount = mo->methodCount();
+        if (it->arrayIndex < static_cast<uint>(propertyCount + methodCount)) {
+            name = that->engine()->newString(QString::fromUtf8(mo->method(it->arrayIndex - propertyCount).name()));
+            ++it->arrayIndex;
             *attributes = QV4::Attr_Data;
-        it->tmpDynamicProperty.value = that->get(name);
-        return &it->tmpDynamicProperty;
+            p->value = that->get(name);
+            return;
+        }
     }
-    return QV4::Object::advanceIterator(m, it, name, index, attributes);
+    QV4::Object::advanceIterator(m, it, name, index, p, attributes);
 }
 
 namespace QV4 {
diff --git a/src/qml/jsruntime/qv4qobjectwrapper_p.h b/src/qml/jsruntime/qv4qobjectwrapper_p.h
index 07de1933c5..748a782b4e 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper_p.h
+++ b/src/qml/jsruntime/qv4qobjectwrapper_p.h
@@ -116,7 +116,7 @@ private:
     static ReturnedValue get(Managed *m, const StringRef name, bool *hasProperty);
     static void put(Managed *m, const StringRef name, const ValueRef value);
     static PropertyAttributes query(const Managed *, StringRef name);
-    static Property *advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes);
+    static void advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attributes);
     static void markObjects(Managed *that, QV4::ExecutionEngine *e);
     static void collectDeletables(Managed *m, GCDeletable **deletable);
     static void destroy(Managed *that)
diff --git a/src/qml/jsruntime/qv4regexp.cpp b/src/qml/jsruntime/qv4regexp.cpp
index 8544970347..5be637d327 100644
--- a/src/qml/jsruntime/qv4regexp.cpp
+++ b/src/qml/jsruntime/qv4regexp.cpp
@@ -192,7 +192,7 @@ bool RegExp::deleteIndexedProperty(Managed *m, uint index)
     return false;
 }
 
-Property *RegExp::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes)
+void RegExp::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *, PropertyAttributes *attributes)
 {
     Q_UNUSED(m);
     Q_UNUSED(it);
@@ -200,5 +200,5 @@ Property *RegExp::advanceIterator(Managed *m, ObjectIterator *it, StringRef name
     Q_UNUSED(index);
     Q_UNUSED(attributes);
 
-    return 0;
+    return;
 }
diff --git a/src/qml/jsruntime/qv4regexp_p.h b/src/qml/jsruntime/qv4regexp_p.h
index d8e9930876..3ec34bae19 100644
--- a/src/qml/jsruntime/qv4regexp_p.h
+++ b/src/qml/jsruntime/qv4regexp_p.h
@@ -120,7 +120,7 @@ protected:
     static PropertyAttributes queryIndexed(const Managed *m, uint index);
     static bool deleteProperty(Managed *, const StringRef);
     static bool deleteIndexedProperty(Managed *m, uint index);
-    static Property *advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes);
+    static void advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *, PropertyAttributes *attributes);
 
 private:
     friend class RegExpCache;
diff --git a/src/qml/jsruntime/qv4sequenceobject.cpp b/src/qml/jsruntime/qv4sequenceobject.cpp
index feb3806ba5..52a6244890 100644
--- a/src/qml/jsruntime/qv4sequenceobject.cpp
+++ b/src/qml/jsruntime/qv4sequenceobject.cpp
@@ -286,26 +286,27 @@ public:
         return (signedIdx < m_container.count()) ? QV4::Attr_Data : QV4::Attr_Invalid;
     }
 
-    Property *containerAdvanceIterator(ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attrs)
+    void containerAdvanceIterator(ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attrs)
     {
         name = (String *)0;
         *index = UINT_MAX;
 
         if (m_isReference) {
-            if (!m_object)
-                return QV4::Object::advanceIterator(this, it, name, index, attrs);
+            if (!m_object) {
+                QV4::Object::advanceIterator(this, it, name, index, p, attrs);
+                return;
+            }
             loadReference();
         }
 
         if (it->arrayIndex < static_cast<uint>(m_container.count())) {
-            if (attrs)
-                *attrs = QV4::Attr_Data;
             *index = it->arrayIndex;
             ++it->arrayIndex;
-            it->tmpDynamicProperty.value = convertElementToValue(engine(), m_container.at(*index));
-            return &it->tmpDynamicProperty;
+            *attrs = QV4::Attr_Data;
+            p->value = convertElementToValue(engine(), m_container.at(*index));
+            return;
         }
-        return QV4::Object::advanceIterator(this, it, name, index, attrs);
+        QV4::Object::advanceIterator(this, it, name, index, p, attrs);
     }
 
     bool containerDeleteIndexedProperty(uint index)
@@ -509,8 +510,8 @@ private:
     { return static_cast<QQmlSequence<Container> *>(that)->containerDeleteIndexedProperty(index); }
     static bool isEqualTo(Managed *that, Managed *other)
     { return static_cast<QQmlSequence<Container> *>(that)->containerIsEqualTo(other); }
-    static Property *advanceIterator(Managed *that, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attrs)
-    { return static_cast<QQmlSequence<Container> *>(that)->containerAdvanceIterator(it, name, index, attrs); }
+    static void advanceIterator(Managed *that, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attrs)
+    { return static_cast<QQmlSequence<Container> *>(that)->containerAdvanceIterator(it, name, index, p, attrs); }
 
     static void destroy(Managed *that)
     {
diff --git a/src/qml/jsruntime/qv4stringobject.cpp b/src/qml/jsruntime/qv4stringobject.cpp
index 1781ce2581..dfd093caed 100644
--- a/src/qml/jsruntime/qv4stringobject.cpp
+++ b/src/qml/jsruntime/qv4stringobject.cpp
@@ -135,7 +135,7 @@ bool StringObject::deleteIndexedProperty(Managed *m, uint index)
     return true;
 }
 
-Property *StringObject::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attrs)
+void StringObject::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attrs)
 {
     name = (String *)0;
     StringObject *s = static_cast<StringObject *>(m);
@@ -145,11 +145,11 @@ Property *StringObject::advanceIterator(Managed *m, ObjectIterator *it, StringRe
             *index = it->arrayIndex;
             ++it->arrayIndex;
             PropertyAttributes a;
-            Property *p = s->__getOwnProperty__(*index, &a);
+            Property *pd = s->__getOwnProperty__(*index, &a);
             if (!(it->flags & ObjectIterator::EnumerableOnly) || a.isEnumerable()) {
-                if (attrs)
-                    *attrs = a;
-                return p;
+                *attrs = a;
+                *p = *pd;
+                return;
             }
         }
         if (s->arrayData) {
@@ -160,7 +160,7 @@ Property *StringObject::advanceIterator(Managed *m, ObjectIterator *it, StringRe
         }
     }
 
-    return Object::advanceIterator(m, it, name, index, attrs);
+    return Object::advanceIterator(m, it, name, index, p, attrs);
 }
 
 void StringObject::markObjects(Managed *that, ExecutionEngine *e)
diff --git a/src/qml/jsruntime/qv4stringobject_p.h b/src/qml/jsruntime/qv4stringobject_p.h
index b91cc48e36..e7e8d5a2b9 100644
--- a/src/qml/jsruntime/qv4stringobject_p.h
+++ b/src/qml/jsruntime/qv4stringobject_p.h
@@ -63,7 +63,7 @@ struct StringObject: Object {
 
 protected:
     StringObject(InternalClass *ic);
-    static Property *advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attrs);
+    static void advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attrs);
     static void markObjects(Managed *that, ExecutionEngine *e);
 };
 
diff --git a/src/qml/qml/qqmllistwrapper.cpp b/src/qml/qml/qqmllistwrapper.cpp
index 76c11cb748..2272beec4a 100644
--- a/src/qml/qml/qqmllistwrapper.cpp
+++ b/src/qml/qml/qqmllistwrapper.cpp
@@ -150,21 +150,20 @@ void QmlListWrapper::destroy(Managed *that)
     w->~QmlListWrapper();
 }
 
-Property *QmlListWrapper::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attrs)
+void QmlListWrapper::advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attrs)
 {
     name = (String *)0;
     *index = UINT_MAX;
     QmlListWrapper *w = m->as<QmlListWrapper>();
     quint32 count = w->property.count ? w->property.count(&w->property) : 0;
     if (it->arrayIndex < count) {
-        if (attrs)
-            *attrs = QV4::Attr_Data;
         *index = it->arrayIndex;
         ++it->arrayIndex;
-        it->tmpDynamicProperty.value = QV4::QObjectWrapper::wrap(w->engine(), w->property.at(&w->property, *index));
-        return &it->tmpDynamicProperty;
+        *attrs = QV4::Attr_Data;
+        p->value = QV4::QObjectWrapper::wrap(w->engine(), w->property.at(&w->property, *index));
+        return;
     }
-    return QV4::Object::advanceIterator(m, it, name, index, attrs);
+    return QV4::Object::advanceIterator(m, it, name, index, p, attrs);
 }
 
 QT_END_NAMESPACE
diff --git a/src/qml/qml/qqmllistwrapper_p.h b/src/qml/qml/qqmllistwrapper_p.h
index 9ece5851ed..11916a4f91 100644
--- a/src/qml/qml/qqmllistwrapper_p.h
+++ b/src/qml/qml/qqmllistwrapper_p.h
@@ -84,7 +84,7 @@ public:
     static ReturnedValue get(Managed *m, const StringRef name, bool *hasProperty);
     static ReturnedValue getIndexed(Managed *m, uint index, bool *hasProperty);
     static void put(Managed *m, const StringRef name, const ValueRef value);
-    static Property *advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, PropertyAttributes *attributes);
+    static void advanceIterator(Managed *m, ObjectIterator *it, StringRef name, uint *index, Property *p, PropertyAttributes *attributes);
     static void destroy(Managed *that);
 
 private: