diff options
| author | Simon Hausmann <simon.hausmann@digia.com> | 2014-03-04 16:15:26 +0100 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2014-03-05 15:01:07 +0100 |
| commit | e4e4a7912b03499a20f25e261e1c515aab17e5a8 (patch) | |
| tree | 412e643b91e0445b64fe4389c51359bb17195be1 /src/qml/compiler/qv4isel_p.cpp | |
| parent | 0d84dab38059345f51e8318d2474068e817ac007 (diff) | |
[new compiler] Fix invalid memory reads when JS closures outlive QML types
If QQmlCompiledData gets destroyed while somebody still has refcount on the
QV4::CompiledData::CompilationUnit, then unit's _data_ would be freed already
by ~QQmlCompiledData. Given that compilationUnit->data is pointing to the same
malloc'ed address as QQmlCompiledData::qmlUnit, we can just let the
CompilationUnit always own the data.
Fixes tst_qquickloader and makes it possible to run the qquickcomponent tests.
Change-Id: Ie3f3e5335139236d7c2524a327665bda0a9cc847
Reviewed-by: Lars Knoll <lars.knoll@digia.com>
Diffstat (limited to 'src/qml/compiler/qv4isel_p.cpp')
| -rw-r--r-- | src/qml/compiler/qv4isel_p.cpp | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/src/qml/compiler/qv4isel_p.cpp b/src/qml/compiler/qv4isel_p.cpp index 7d05b9c28a..0e429423ab 100644 --- a/src/qml/compiler/qv4isel_p.cpp +++ b/src/qml/compiler/qv4isel_p.cpp @@ -86,10 +86,8 @@ QV4::CompiledData::CompilationUnit *EvalInstructionSelection::compile(bool gener run(i); QV4::CompiledData::CompilationUnit *unit = backendCompileStep(); - if (generateUnitData) { + if (generateUnitData) unit->data = jsGenerator->generateUnit(); - unit->ownsData = true; - } return unit; } |