Fix QQmlExpression/QQmlScriptString/QQmlBinding crashes

In the QQmlScriptString we store the binding id and it is an index into the
runtimeFunctions array of the compilation unit. However we don't store the
compilation unit and instead in QQmlBinding and QQmlExpression try to retrieve
it from the cache via the context url (we have the context after all). That
turns out to be not a reliable way, as sometimes the URL might slightly differ
from the originally compiled cache (qrc:/// turning to qrc:/ maybe).
Consequently the type is (unnecessarily) compiled again and unfortunately not
_linked_, therefore the runtime functions array is empty. Another option is
that when the component was created from a QByteArray, then no entry exists in
the cache in the first place.

This patch addresses the problem by storing a reference to the compilation unit
in the QQmlContextData. That we can safely retrieve and it'll make sure the
compilation unit also stays alive.

In the process of that the manual reference counting was switched over to
QQmlRefCount and QQmlRefPointer for QV4::CompilationUnit.

Task-number: QTBUG-41193
Change-Id: I9111f9a3b65618e453954abcd789c039e65a94f7
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

1 files changed, 4 insertions, 9 deletions

diff --git a/src/qml/compiler/qv4compileddata_p.h b/src/qml/compiler/qv4compileddata_p.h
index e5b7681a7c..6791970461 100644
--- a/src/qml/compiler/qv4compileddata_p.h
+++ b/src/qml/compiler/qv4compileddata_p.h
@@ -39,6 +39,7 @@
 #include <QHash>
 #include <private/qv4value_p.h>
 #include <private/qv4executableallocator_p.h>
+#include <private/qqmlrefcount_p.h>
 
 QT_BEGIN_NAMESPACE
 
@@ -559,18 +560,16 @@ struct TypeReferenceMap : QHash<int, TypeReference>
 //    CompilationUnit * (for functions that need to clean up)
 //    CompiledData::Function *compiledFunction
 
-struct Q_QML_PRIVATE_EXPORT CompilationUnit
+struct Q_QML_PRIVATE_EXPORT CompilationUnit : public QQmlRefCount
 {
 #ifdef V4_BOOTSTRAP
     CompilationUnit()
-        : refCount(0)
-        , data(0)
+        : data(0)
     {}
     virtual ~CompilationUnit() {}
 #else
     CompilationUnit()
-        : refCount(0)
-        , data(0)
+        : data(0)
         , engine(0)
         , runtimeStrings(0)
         , runtimeLookups(0)
@@ -580,10 +579,6 @@ struct Q_QML_PRIVATE_EXPORT CompilationUnit
     virtual ~CompilationUnit();
 #endif
 
-    void ref() { ++refCount; }
-    void deref() { if (!--refCount) delete this; }
-
-    int refCount;
     Unit *data;
 
     // Called only when building QML, when we build the header for JS first and append QML data