Fix crash when the currently running binding is deleted.

Stop capturing properties once the expression is deleted. The
following example triggers invalid read/write memcheck errors
when trying to capture propFromParentScope:

Item {
    property real testProp: {
        if (x == 0) testProp = 7
        return propFromParentScope
    }
}

Which can eventually lead to a crash.

Task-number: QTBUG-36798
Change-Id: I233de2c81498884df0563e8ce155752845aafcfb
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/src/qml/qml/qqmljavascriptexpression_p.h b/src/qml/qml/qqmljavascriptexpression_p.h
index 7d65f1c9cc..d0f10e498d 100644
--- a/src/qml/qml/qqmljavascriptexpression_p.h
+++ b/src/qml/qml/qqmljavascriptexpression_p.h
@@ -161,8 +161,8 @@ private:
     friend void QQmlJavaScriptExpressionGuard_callback(QQmlNotifierEndpoint *, void **);
 
     struct GuardCapture : public QQmlEnginePrivate::PropertyCapture {
-        GuardCapture(QQmlEngine *engine, QQmlJavaScriptExpression *e)
-        : engine(engine), expression(e), errorString(0) { }
+        GuardCapture(QQmlEngine *engine, QQmlJavaScriptExpression *e, DeleteWatcher *w)
+        : engine(engine), expression(e), watcher(w), errorString(0) { }
 
         ~GuardCapture()  {
             Q_ASSERT(guards.isEmpty());
@@ -174,6 +174,7 @@ private:
 
         QQmlEngine *engine;
         QQmlJavaScriptExpression *expression;
+        DeleteWatcher *watcher;
         QFieldList<Guard, &Guard::next> guards;
         QStringList *errorString;
     };