Fix a bug in removeMember causing a duplicate transition with an 0 lookup.

We shouldn't have taken a copy here. I'm not sure why I did that. Also sprinkle
Q_ASSERT fairydust around to try ensure that this doesn't happen again.

This was exposed when we started trying to delete the transitions again, which
were leaked in 6421f275286b3238fe1a7a5e909225251f3e8dbf.

Change-Id: Id9272db7f1863d1ccc5b1f48b6382c68ae0da9da
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

1 files changed, 8 insertions, 3 deletions

diff --git a/src/qml/jsruntime/qv4internalclass.cpp b/src/qml/jsruntime/qv4internalclass.cpp
index d1937c4712..82c71339a3 100644
--- a/src/qml/jsruntime/qv4internalclass.cpp
+++ b/src/qml/jsruntime/qv4internalclass.cpp
@@ -192,6 +192,7 @@ InternalClass *InternalClass::changeMember(Identifier *identifier, PropertyAttri
     }
 
     t.lookup = newClass;
+    Q_ASSERT(t.lookup);
     return newClass;
 }
 
@@ -228,6 +229,7 @@ InternalClass *InternalClass::changeVTable(const ManagedVTable *vt)
     }
 
     t.lookup = newClass;
+    Q_ASSERT(t.lookup);
     return newClass;
 }
 
@@ -249,6 +251,7 @@ InternalClass *InternalClass::nonExtensible()
     newClass->extensible = false;
 
     t.lookup = newClass;
+    Q_ASSERT(t.lookup);
     return newClass;
 }
 
@@ -313,6 +316,7 @@ InternalClass *InternalClass::addMemberImpl(Identifier *identifier, PropertyAttr
     }
 
     t.lookup = newClass;
+    Q_ASSERT(t.lookup);
     return newClass;
 }
 
@@ -322,8 +326,8 @@ void InternalClass::removeMember(Object *object, Identifier *id)
     uint propIdx = oldClass->propertyTable.lookup(id);
     Q_ASSERT(propIdx < oldClass->size);
 
-    Transition t = { { id }, 0, -1 };
-    t = object->internalClass()->lookupOrInsertTransition(t); // take a copy
+    Transition temp = { { id }, 0, -1 };
+    Transition &t = object->internalClass()->lookupOrInsertTransition(temp);
 
     if (t.lookup) {
         object->setInternalClass(t.lookup);
@@ -343,7 +347,7 @@ void InternalClass::removeMember(Object *object, Identifier *id)
     memmove(object->memberData()->data + propIdx, object->memberData()->data + propIdx + 1, (object->internalClass()->size - propIdx)*sizeof(Value));
 
     t.lookup = object->internalClass();
-    oldClass->lookupOrInsertTransition(t);
+    Q_ASSERT(t.lookup);
 }
 
 uint InternalClass::find(const String *string)
@@ -428,6 +432,7 @@ void InternalClass::destroy()
             destroyStack.append(next->m_frozen);
 
         for (size_t i = 0; i < next->transitions.size(); ++i) {
+            Q_ASSERT(next->transitions.at(i).lookup);
             destroyStack.append(next->transitions.at(i).lookup);
         }