diff options
| author | Chris Adams <christopher.adams@nokia.com> | 2012-03-13 13:30:39 +1000 |
|---|---|---|
| committer | Qt by Nokia <qt-info@nokia.com> | 2012-03-15 02:44:40 +0100 |
| commit | 25793276e52240e4dfad297dc5b9eb282ed3f5e6 (patch) | |
| tree | 2c28122e886334703cd3f6cdd17cba759209b313 /src/qml/qml/qqmldata_p.h | |
| parent | 147247a31a9d6c1edadb0c7c78cf10b894dfab25 (diff) | |
Fix crash caused by dereferencing collected v8 data
If a var property of a QObject is read after the v8 data associated
with the qobject has been deleted but prior to the DeferredDelete
event being processed, the varProperties array will be null and
a crash will occur.
This patch ensures that we check for this condition in both the
access and set codepaths for var properties, and also ensures
that an object which has previously been queued for deletion cannot
be referenced in JS.
Finally, it adds a unit test to ensure that we don't regress.
Task-number: QTBUG-24748
Change-Id: Idde384ca01e18f4dcf9e376e9379f2c5eb410e14
Reviewed-by: Michael Brasser <michael.brasser@nokia.com>
Diffstat (limited to 'src/qml/qml/qqmldata_p.h')
| -rw-r--r-- | src/qml/qml/qqmldata_p.h | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/qml/qml/qqmldata_p.h b/src/qml/qml/qqmldata_p.h index e4ba44583d..09d1a23510 100644 --- a/src/qml/qml/qqmldata_p.h +++ b/src/qml/qml/qqmldata_p.h @@ -78,8 +78,8 @@ class Q_QML_EXPORT QQmlData : public QAbstractDeclarativeData public: QQmlData() : ownMemory(true), ownContext(false), indestructible(true), explicitIndestructibleSet(false), - hasTaintedV8Object(false), notifyList(0), context(0), outerContext(0), bindings(0), - nextContextObject(0), prevContextObject(0), bindingBitsSize(0), bindingBits(0), + hasTaintedV8Object(false), isQueuedForDeletion(false), notifyList(0), context(0), outerContext(0), + bindings(0), nextContextObject(0), prevContextObject(0), bindingBitsSize(0), bindingBits(0), lineNumber(0), columnNumber(0), deferredComponent(0), deferredIdx(0), v8objectid(0), propertyCache(0), guards(0), extendedData(0) { init(); @@ -110,7 +110,8 @@ public: quint32 indestructible:1; quint32 explicitIndestructibleSet:1; quint32 hasTaintedV8Object:1; - quint32 dummy:27; + quint32 isQueuedForDeletion:1; + quint32 dummy:26; struct NotifyList { quint64 connectionMask; |