Fix GC problem with json conversion methods

The ObjectSet used to protect against recursion is not safe
against a GC that moves objects around. Fix this by storing
pointers to QV4::Object in there instead.

Change-Id: I88bcac330246a1c9180caed13be1f6ab5c40a6ae
Reviewed-by: Simon Hausmann <simon.hausmann@theqtcompany.com>

1 files changed, 14 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4jsonobject_p.h b/src/qml/jsruntime/qv4jsonobject_p.h
index dbb49cb592..1ad0e2c5de 100644
--- a/src/qml/jsruntime/qv4jsonobject_p.h
+++ b/src/qml/jsruntime/qv4jsonobject_p.h
@@ -38,6 +38,7 @@
 #include <qjsonobject.h>
 #include <qjsonvalue.h>
 #include <qjsondocument.h>
+#include <qhash.h>
 
 QT_BEGIN_NAMESPACE
 
@@ -51,12 +52,23 @@ struct JsonObject : Object {
 
 }
 
+struct ObjectItem {
+    const QV4::Object *o;
+    ObjectItem(const QV4::Object *o) : o(o) {}
+};
+
+inline bool operator ==(const ObjectItem &a, const ObjectItem &b)
+{ return a.o->d() == b.o->d(); }
+
+inline int qHash(const ObjectItem &i, uint seed = 0)
+{ return ::qHash((void *)i.o->d(), seed); }
+
 struct JsonObject : Object {
     Q_MANAGED_TYPE(JsonObject)
     V4_OBJECT2(JsonObject, Object)
 private:
-    // ### GC
-    typedef QSet<QV4::Heap::Base *> V4ObjectSet;
+
+    typedef QSet<ObjectItem> V4ObjectSet;
 public:
 
     static ReturnedValue method_parse(CallContext *ctx);