Never truncate the JS stack

Truncating it can lead to all sorts of crazy side effects, especially
as we'd be extending it again when leaving the function. When that happens
already freed JS objects could suddenly become visible to the GC again.

Fix this by copying the CallData to set up a new stack frame. This is not yet
ideal, as we're copying too much data, but that can be fixed separately.

Change-Id: I02a39ce479475bae326f9eddfe6654fbcf8e6d35
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

1 files changed, 2 insertions, 0 deletions

diff --git a/src/qml/jsruntime/qv4runtime.cpp b/src/qml/jsruntime/qv4runtime.cpp
index 2e97d8074a..97b0c5259f 100644
--- a/src/qml/jsruntime/qv4runtime.cpp
+++ b/src/qml/jsruntime/qv4runtime.cpp
@@ -1028,6 +1028,7 @@ ReturnedValue Runtime::method_callName(ExecutionEngine *engine, int nameIndex, C
 
 ReturnedValue Runtime::method_callProperty(ExecutionEngine *engine, int nameIndex, CallData *callData)
 {
+    Q_ASSERT(engine->jsStackTop >= callData->args + callData->argc());
     if (!callData->thisObject.isObject()) {
         Q_ASSERT(!callData->thisObject.isEmpty());
         if (callData->thisObject.isNullOrUndefined()) {
@@ -1058,6 +1059,7 @@ ReturnedValue Runtime::method_callProperty(ExecutionEngine *engine, int nameInde
 
 ReturnedValue Runtime::method_callPropertyLookup(ExecutionEngine *engine, uint index, CallData *callData)
 {
+    Q_ASSERT(engine->jsStackTop >= callData->args + callData->argc());
     Lookup *l = engine->currentStackFrame->v4Function->compilationUnit->runtimeLookups + index;
     callData->function = l->getter(l, engine, callData->thisObject);