Fix GC problem with json conversion methods

The ObjectSet used to protect against recursion is not safe
against a GC that moves objects around. Fix this by storing
pointers to QV4::Object in there instead.

Change-Id: I88bcac330246a1c9180caed13be1f6ab5c40a6ae
Reviewed-by: Simon Hausmann <simon.hausmann@theqtcompany.com>

1 files changed, 6 insertions, 6 deletions

diff --git a/src/qml/jsruntime/qv4jsonobject.cpp b/src/qml/jsruntime/qv4jsonobject.cpp
index 652657e1f8..815376c200 100644
--- a/src/qml/jsruntime/qv4jsonobject.cpp
+++ b/src/qml/jsruntime/qv4jsonobject.cpp
@@ -990,14 +990,14 @@ QJsonObject JsonObject::toJsonObject(const Object *o, V4ObjectSet &visitedObject
 
     Scope scope(o->engine());
 
-    if (visitedObjects.contains(o->d())) {
+    if (visitedObjects.contains(ObjectItem(o))) {
         // Avoid recursion.
         // For compatibility with QVariant{List,Map} conversion, we return an
         // empty object (and no error is thrown).
         return result;
     }
 
-    visitedObjects.insert(o->d());
+    visitedObjects.insert(ObjectItem(o));
 
     ObjectIterator it(scope, o, ObjectIterator::EnumerableOnly);
     ScopedValue name(scope);
@@ -1012,7 +1012,7 @@ QJsonObject JsonObject::toJsonObject(const Object *o, V4ObjectSet &visitedObject
             result.insert(key, toJsonValue(val, visitedObjects));
     }
 
-    visitedObjects.remove(o->d());
+    visitedObjects.remove(ObjectItem(o));
 
     return result;
 }
@@ -1038,14 +1038,14 @@ QJsonArray JsonObject::toJsonArray(const ArrayObject *a, V4ObjectSet &visitedObj
 
     Scope scope(a->engine());
 
-    if (visitedObjects.contains(a->d())) {
+    if (visitedObjects.contains(ObjectItem(a))) {
         // Avoid recursion.
         // For compatibility with QVariant{List,Map} conversion, we return an
         // empty array (and no error is thrown).
         return result;
     }
 
-    visitedObjects.insert(a->d());
+    visitedObjects.insert(ObjectItem(a));
 
     ScopedValue v(scope);
     quint32 length = a->getLength();
@@ -1056,7 +1056,7 @@ QJsonArray JsonObject::toJsonArray(const ArrayObject *a, V4ObjectSet &visitedObj
         result.append(toJsonValue(v, visitedObjects));
     }
 
-    visitedObjects.remove(a->d());
+    visitedObjects.remove(ObjectItem(a));
 
     return result;
 }