diff options
| author | Ulf Hermann <ulf.hermann@qt.io> | 2019-03-04 15:36:57 +0100 |
|---|---|---|
| committer | Ulf Hermann <ulf.hermann@qt.io> | 2019-03-14 15:38:07 +0000 |
| commit | 7e32be87c0f53ce2e5d3c1e351a559d6c600f1bf (patch) | |
| tree | bbb24aa484a60125db5448c1adc83a66805a5ed4 /src/qml/jsruntime/qv4object.cpp | |
| parent | 744fe84d890479962ccb85d0ed6c4515a6ea11f4 (diff) | |
Don't keep raw pointers to SparseArrayNode
The nodes are owned by the SparseArrayData and will be freed whenever an
item is deleted from the array. Therefore, we have to look up the node
for each iteration. This is slightly slower, but at least it doesn't
crash.
Fixes: QTBUG-74188
Change-Id: Id24324a8c83b00b3ad1212cdaabccabd6c8a999f
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Diffstat (limited to 'src/qml/jsruntime/qv4object.cpp')
| -rw-r--r-- | src/qml/jsruntime/qv4object.cpp | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/qml/jsruntime/qv4object.cpp b/src/qml/jsruntime/qv4object.cpp index 3d2d54f651..9d6cb730a9 100644 --- a/src/qml/jsruntime/qv4object.cpp +++ b/src/qml/jsruntime/qv4object.cpp @@ -320,8 +320,11 @@ bool Object::virtualDeleteProperty(Managed *m, PropertyKey id) PropertyKey ObjectOwnPropertyKeyIterator::next(const Object *o, Property *pd, PropertyAttributes *attrs) { if (arrayIndex != UINT_MAX && o->arrayData()) { - if (!arrayIndex) - arrayNode = o->sparseBegin(); + SparseArrayNode *arrayNode = nullptr; + if (o->arrayType() == Heap::ArrayData::Sparse) { + SparseArray *sparse = o->arrayData()->sparse; + arrayNode = arrayIndex ? sparse->lowerBound(arrayIndex) : sparse->begin(); + } // sparse arrays if (arrayNode) { @@ -339,7 +342,6 @@ PropertyKey ObjectOwnPropertyKeyIterator::next(const Object *o, Property *pd, Pr *attrs = a; return PropertyKey::fromArrayIndex(k); } - arrayNode = nullptr; arrayIndex = UINT_MAX; } // dense arrays |