Fix QtSharedPointer::ExternalRefCountData object leaks

Call destroyObject() for every QV4::Heap::QObectWrapper object in heap in
QV4::MemoryManager::sweep() to make sure the QPointer object contained in
QV4::Heap::QObjectWrapper is properly destructed.
We also keep track of QObjectWrapper in QV4::Heap::ModelObject to make
sure we destory them in QV4::MemoryManager::sweep()

Change-Id: I3b3e96cfc300c2e21ab691762879ac2970afa90c
Reviewed-by: Simon Hausmann <simon.hausmann@theqtcompany.com>

6 files changed, 27 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4persistent.cpp b/src/qml/jsruntime/qv4persistent.cpp
index 4a0f84b685..032ad0d00a 100644
--- a/src/qml/jsruntime/qv4persistent.cpp
+++ b/src/qml/jsruntime/qv4persistent.cpp
@@ -34,6 +34,7 @@
 #include "qv4persistent_p.h"
 #include <private/qv4mm_p.h>
 #include "qv4object_p.h"
+#include "qv4qobjectwrapper_p.h"
 #include "PageAllocation.h"
 
 using namespace QV4;
@@ -204,6 +205,12 @@ void PersistentValueStorage::free(Value *v)
 
     Page *p = getPage(v);
 
+    // Keep track of QObjectWrapper to release its resources later in MemoryManager::sweep()
+    if (p->header.engine) {
+        if (QObjectWrapper *qobjectWrapper = v->as<QObjectWrapper>())
+            p->header.engine->memoryManager->m_pendingDestroyedObjectWrappers.push_back(qobjectWrapper->d());
+    }
+
     v->setTag(QV4::Value::Empty_Type);
     v->setInt_32(p->header.freeList);
     p->header.freeList = v - p->values;
diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 8f471132b7..2cb8991055 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -1019,6 +1019,11 @@ void QObjectWrapper::markObjects(Heap::Base *that, QV4::ExecutionEngine *e)
 void QObjectWrapper::destroyObject(bool lastCall)
 {
     Heap::QObjectWrapper *h = d();
+    destroyObject(h, lastCall);
+}
+
+void QObjectWrapper::destroyObject(Heap::QObjectWrapper *h, bool lastCall)
+{
     if (!h->internalClass)
         return; // destroyObject already got called
 
diff --git a/src/qml/jsruntime/qv4qobjectwrapper_p.h b/src/qml/jsruntime/qv4qobjectwrapper_p.h
index 1126013806..29e1263f2d 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper_p.h
+++ b/src/qml/jsruntime/qv4qobjectwrapper_p.h
@@ -120,6 +120,7 @@ struct Q_QML_EXPORT QObjectWrapper : public Object
     void setProperty(ExecutionEngine *engine, int propertyIndex, const Value &value);
 
     void destroyObject(bool lastCall);
+    static void destroyObject(Heap::QObjectWrapper *h, bool lastCall);
 
 protected:
     static bool isEqualTo(Managed *that, Managed *o);
diff --git a/src/qml/memory/qv4mm.cpp b/src/qml/memory/qv4mm.cpp
index 5181bf912b..053dfb856c 100644
--- a/src/qml/memory/qv4mm.cpp
+++ b/src/qml/memory/qv4mm.cpp
@@ -41,8 +41,6 @@
 #include "StdLibExtras.h"
 
 #include <QTime>
-#include <QVector>
-#include <QVector>
 #include <QMap>
 
 #include <iostream>
@@ -437,6 +435,15 @@ void MemoryManager::sweep(bool lastSweep)
         (*it) = Primitive::undefinedValue();
     }
 
+    // Some QV4::QObjectWrapper objects will be removed from PersistentValueStorage in WeakValue::~WeakValue()
+    // before MemoryManager::sweep() is being called, in this case we will never have a chance to call detroyObject()
+    // on those QV4::QObjectWrapper objects. Here we call detroyObject() for each pending destroyed Heap::QObjectWrapper
+    // object on the heap to make sure that we can release all the resources held by them
+    for (QVector<Heap::QObjectWrapper *>::const_iterator it = m_pendingDestroyedObjectWrappers.constBegin();
+         it != m_pendingDestroyedObjectWrappers.constEnd(); ++it)
+        QObjectWrapper::destroyObject(*it, lastSweep);
+    m_pendingDestroyedObjectWrappers.clear();
+
     if (MultiplyWrappedQObjectMap *multiplyWrappedQObjects = engine->m_multiplyWrappedQObjects) {
         for (MultiplyWrappedQObjectMap::Iterator it = multiplyWrappedQObjects->begin(); it != multiplyWrappedQObjects->end();) {
             if (!it.value().isNullOrUndefined())
diff --git a/src/qml/memory/qv4mm_p.h b/src/qml/memory/qv4mm_p.h
index 3543da0907..69aae1c5bf 100644
--- a/src/qml/memory/qv4mm_p.h
+++ b/src/qml/memory/qv4mm_p.h
@@ -49,6 +49,7 @@
 #include <private/qv4value_p.h>
 #include <private/qv4scopedvalue_p.h>
 #include <private/qv4object_p.h>
+#include <QVector>
 
 //#define DETAILED_MM_STATS
 
@@ -327,6 +328,7 @@ public:
     QScopedPointer<Data> m_d;
     PersistentValueStorage *m_persistentValues;
     PersistentValueStorage *m_weakValues;
+    QVector<Heap::QObjectWrapper *> m_pendingDestroyedObjectWrappers;
 };
 
 }
diff --git a/src/qml/types/qqmllistmodel.cpp b/src/qml/types/qqmllistmodel.cpp
index a4c0f7043f..4b0aa47c63 100644
--- a/src/qml/types/qqmllistmodel.cpp
+++ b/src/qml/types/qqmllistmodel.cpp
@@ -2277,6 +2277,9 @@ QQmlV4Handle QQmlListModel::get(int index) const
         } else {
             QObject *object = m_listModel->getOrCreateModelObject(const_cast<QQmlListModel *>(this), index);
             result = scope.engine->memoryManager->allocObject<QV4::ModelObject>(object, const_cast<QQmlListModel *>(this), index);
+            // Keep track of the QObjectWrapper in persistent value storage
+            QV4::Value *val = scope.engine->memoryManager->m_weakValues->allocate();
+            *val = result;
         }
     }