diff options
| author | Simon Hausmann <simon.hausmann@qt.io> | 2016-10-22 12:07:24 +0200 |
|---|---|---|
| committer | Simon Hausmann <simon.hausmann@qt.io> | 2016-10-22 14:22:33 +0000 |
| commit | e13eece273195a9f39d29712a233a8dd00ddf71b (patch) | |
| tree | 69f517b764aee8b58ecdef03c116a58a35dd65ce /src/qml/jsruntime/qv4lookup.cpp | |
| parent | ac6a26a3888a6fb767d492ddd2edabf5881c997f (diff) | |
Fix crash with v4 lookups on changing objects
When lookups are enabled for property access and the property exists, we
change the type of the lookup from the generic fallback to a more
specialized direct property access. When upon subsequent access the
internal class has changed, we fall back to the case of two alternating
classes/shapes. If during that fallback we fail to find the property
altogether, then we should revert back to the overall fallback, instead
of continuing with an invalid property data index.
Ran into this while running the typescript compiler in V4 itself.
Change-Id: If5975d6c18ff41b9fb21c40f0cbaeed37da4b489
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Diffstat (limited to 'src/qml/jsruntime/qv4lookup.cpp')
| -rw-r--r-- | src/qml/jsruntime/qv4lookup.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/qml/jsruntime/qv4lookup.cpp b/src/qml/jsruntime/qv4lookup.cpp index 42e561bc7c..84755a6402 100644 --- a/src/qml/jsruntime/qv4lookup.cpp +++ b/src/qml/jsruntime/qv4lookup.cpp @@ -306,7 +306,7 @@ ReturnedValue Lookup::getterTwoClasses(Lookup *l, ExecutionEngine *engine, const ReturnedValue v = o->getLookup(l); Lookup l2 = *l; - if (l2.getter == Lookup::getter0 || l2.getter == Lookup::getter1) { + if (l->index != UINT_MAX && (l2.getter == Lookup::getter0 || l2.getter == Lookup::getter1)) { // if we have a getter0, make sure it comes first if (l2.getter == Lookup::getter0) qSwap(l1, l2); |