Fix QQmlExpression/QQmlScriptString/QQmlBinding crashes

In the QQmlScriptString we store the binding id and it is an index into the
runtimeFunctions array of the compilation unit. However we don't store the
compilation unit and instead in QQmlBinding and QQmlExpression try to retrieve
it from the cache via the context url (we have the context after all). That
turns out to be not a reliable way, as sometimes the URL might slightly differ
from the originally compiled cache (qrc:/// turning to qrc:/ maybe).
Consequently the type is (unnecessarily) compiled again and unfortunately not
_linked_, therefore the runtime functions array is empty. Another option is
that when the component was created from a QByteArray, then no entry exists in
the cache in the first place.

This patch addresses the problem by storing a reference to the compilation unit
in the QQmlContextData. That we can safely retrieve and it'll make sure the
compilation unit also stays alive.

In the process of that the manual reference counting was switched over to
QQmlRefCount and QQmlRefPointer for QV4::CompilationUnit.

Task-number: QTBUG-41193
Change-Id: I9111f9a3b65618e453954abcd789c039e65a94f7
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/qml/compiler/qqmlirbuilder_p.h b/src/qml/compiler/qqmlirbuilder_p.h
index ddd9a22bc2..cc22023f8e 100644
--- a/src/qml/compiler/qqmlirbuilder_p.h
+++ b/src/qml/compiler/qqmlirbuilder_p.h
@@ -317,7 +317,7 @@ struct Q_QML_PRIVATE_EXPORT Document
     QV4::Compiler::JSUnitGenerator jsGenerator;
     quint32 unitFlags;
 
-    QV4::CompiledData::CompilationUnit *javaScriptCompilationUnit;
+    QQmlRefPointer<QV4::CompiledData::CompilationUnit> javaScriptCompilationUnit;
     QHash<int, QStringList> extraSignalParameters;
 
     QV4::CompiledData::TypeReferenceMap typeReferences;