Fix memory corruption when sharing QObjects between different QML engines

When marking the JS wrappers for QObject manually, we cannot use
ddata->jsWrapper directly but we must respect the case where the same
object is exposed to different engines and then we must mark the wrapper
that belongs to the engine that is currently collecting garbage.

Change-Id: If82883c762ccaf3431e7074243ff2ff703234d66
Task-number: QTBUG-44895
Reviewed-by: Marco Martin <mart@kde.org>
Reviewed-by: Jan Kundrát <jkt@kde.org>
Reviewed-by: Lars Knoll <lars.knoll@digia.com>
Reviewed-by: Aleix Pol Gonzalez <aleixpol@kde.org>

1 files changed, 2 insertions, 0 deletions

diff --git a/src/qml/jsruntime/qv4qobjectwrapper_p.h b/src/qml/jsruntime/qv4qobjectwrapper_p.h
index 5d2378018c..24e8b29e08 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper_p.h
+++ b/src/qml/jsruntime/qv4qobjectwrapper_p.h
@@ -110,6 +110,7 @@ struct Q_QML_EXPORT QObjectWrapper : public Object
     static bool setQmlProperty(ExecutionEngine *engine, QQmlContextData *qmlContext, QObject *object, String *name, RevisionMode revisionMode, const Value &value);
 
     static ReturnedValue wrap(ExecutionEngine *engine, QObject *object);
+    static void markWrapper(QObject *object, ExecutionEngine *engine);
 
     using Object::get;
 
@@ -189,6 +190,7 @@ public:
     ReturnedValue value(QObject *key) const { return QHash<QObject*, QV4::WeakValue>::value(key).value(); }
     Iterator erase(Iterator it);
     void remove(QObject *key);
+    void mark(QObject *key, ExecutionEngine *engine);
 
 private Q_SLOTS:
     void removeDestroyedObject(QObject*);