Fix memory corruption with type trimming

When creating a composite type, we register the meta-type in the qml
loader thread. However we would require linking of the compilation unit
to the QML/engine thread before we would be able to also undo that
registration in unlink(), because we require the engine member to be
set. If that did not happen, i.e. a qml type was loaded and trimmed from
the cache before it was ever linked, we would end up with a dangling
pointer in m_compositeTypes.

Let's handle the case of CompilationUnit referring to a QML composite
type separately from it being a compilation unit resulting from a .js
file or in a plain QJSEngine environment.

Task-number: QTBUG-62630
Change-Id: Ia68cc46f05345702bd9ba0378f61118f1964d141
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

1 files changed, 3 insertions, 3 deletions

diff --git a/src/qml/qml/qqmlengine_p.h b/src/qml/qml/qqmlengine_p.h
index da8ea24ea0..fd74a233a4 100644
--- a/src/qml/qml/qqmlengine_p.h
+++ b/src/qml/qml/qqmlengine_p.h
@@ -204,7 +204,7 @@ public:
     template<typename T>
     inline void deleteInEngineThread(T *);
     template<typename T>
-    inline static void deleteInEngineThread(QQmlEngine *, T *);
+    inline static void deleteInEngineThread(QQmlEnginePrivate *, T *);
     QString offlineStorageDatabaseDirectory() const;
 
     // These methods may be called from the loader thread
@@ -359,10 +359,10 @@ Delete \a value in the \a engine thread.  If the calling thread is the engine
 thread, \a value will be deleted immediately.
 */
 template<typename T>
-void QQmlEnginePrivate::deleteInEngineThread(QQmlEngine *engine, T *value)
+void QQmlEnginePrivate::deleteInEngineThread(QQmlEnginePrivate *engine, T *value)
 {
     Q_ASSERT(engine);
-    QQmlEnginePrivate::get(engine)->deleteInEngineThread<T>(value);
+    engine->deleteInEngineThread<T>(value);
 }
 
 /*!