V4: Write back value type references after function calls

If we call a function on a value type reference we have to assume that
the value has changed. Therefore, we need to write back, just like we do
when writing a property on the reference.

Fixes: QTBUG-91783
Pick-to: 6.1 5.15
Change-Id: I6d2e957997d64e40e42eb5210350b6592a92ee26
Reviewed-by: Andrei Golubev <andrei.golubev@qt.io>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

1 files changed, 10 insertions, 1 deletions

diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 5940729b78..578c789575 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -2211,20 +2211,29 @@ ReturnedValue QObjectMethod::callInternal(const Value *thisObject, const Value *
 
     d()->ensureMethodsCache();
 
+    Scope scope(v4);
     QQmlObjectOrGadget object(d()->object());
+    QV4::Scoped<QQmlValueTypeReference> valueTypeReference(scope);
     if (!d()->object()) {
         if (!d()->valueTypeWrapper)
             return Encode::undefined();
 
+        valueTypeReference = d()->valueTypeWrapper.get();
         object = QQmlObjectOrGadget(d()->metaObject(), d()->valueTypeWrapper->gadgetPtr());
     }
 
-    Scope scope(v4);
     JSCallData cData(thisObject, argv, argc);
     CallData *callData = cData.callData(scope);
 
     auto method = d()->methods[0];
 
+    // If we call the method, we have to write back any value type references afterwards.
+    // The method might change the value.
+    auto guard = qScopeGuard([&valueTypeReference]() {
+        if (valueTypeReference)
+            valueTypeReference->d()->writeBack();
+    });
+
     if (method.isV4Function()) {
         QV4::ScopedValue rv(scope, QV4::Value::undefinedValue());
         QQmlV4Function func(callData, rv, v4);