Fix QtSharedPointer::ExternalRefCountData object leaks

Call destroyObject() for every QV4::Heap::QObectWrapper object in heap in
QV4::MemoryManager::sweep() to make sure the QPointer object contained in
QV4::Heap::QObjectWrapper is properly destructed.
We also keep track of QObjectWrapper in QV4::Heap::ModelObject to make
sure we destory them in QV4::MemoryManager::sweep()

Change-Id: I3b3e96cfc300c2e21ab691762879ac2970afa90c
Reviewed-by: Simon Hausmann <simon.hausmann@theqtcompany.com>

3 files changed, 13 insertions, 0 deletions

diff --git a/src/qml/jsruntime/qv4persistent.cpp b/src/qml/jsruntime/qv4persistent.cpp
index 4a0f84b685..032ad0d00a 100644
--- a/src/qml/jsruntime/qv4persistent.cpp
+++ b/src/qml/jsruntime/qv4persistent.cpp
@@ -34,6 +34,7 @@
 #include "qv4persistent_p.h"
 #include <private/qv4mm_p.h>
 #include "qv4object_p.h"
+#include "qv4qobjectwrapper_p.h"
 #include "PageAllocation.h"
 
 using namespace QV4;
@@ -204,6 +205,12 @@ void PersistentValueStorage::free(Value *v)
 
     Page *p = getPage(v);
 
+    // Keep track of QObjectWrapper to release its resources later in MemoryManager::sweep()
+    if (p->header.engine) {
+        if (QObjectWrapper *qobjectWrapper = v->as<QObjectWrapper>())
+            p->header.engine->memoryManager->m_pendingDestroyedObjectWrappers.push_back(qobjectWrapper->d());
+    }
+
     v->setTag(QV4::Value::Empty_Type);
     v->setInt_32(p->header.freeList);
     p->header.freeList = v - p->values;
diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 8f471132b7..2cb8991055 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -1019,6 +1019,11 @@ void QObjectWrapper::markObjects(Heap::Base *that, QV4::ExecutionEngine *e)
 void QObjectWrapper::destroyObject(bool lastCall)
 {
     Heap::QObjectWrapper *h = d();
+    destroyObject(h, lastCall);
+}
+
+void QObjectWrapper::destroyObject(Heap::QObjectWrapper *h, bool lastCall)
+{
     if (!h->internalClass)
         return; // destroyObject already got called
 
diff --git a/src/qml/jsruntime/qv4qobjectwrapper_p.h b/src/qml/jsruntime/qv4qobjectwrapper_p.h
index 1126013806..29e1263f2d 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper_p.h
+++ b/src/qml/jsruntime/qv4qobjectwrapper_p.h
@@ -120,6 +120,7 @@ struct Q_QML_EXPORT QObjectWrapper : public Object
     void setProperty(ExecutionEngine *engine, int propertyIndex, const Value &value);
 
     void destroyObject(bool lastCall);
+    static void destroyObject(Heap::QObjectWrapper *h, bool lastCall);
 
 protected:
     static bool isEqualTo(Managed *that, Managed *o);