Fix interaction of garbage collector with JS objects during QML type instantiation

It may happen that during the lengthy process of instantiating a tree of
objects for QML, the garbage collector runs.

For objects created by QML we support different ownership models, for example
in QtQuick visual parents keep their visual children alive, despite perhaps a
lack of QObject parentship. That ownership becomes active once the QML
autoparent function has assigned the correct visual parent, which happens after
object instantiation (after QQmlObjectCreator).

Similarly when a composite type is created, its QObject parent is only set
after all properties have been set. The root QObject is kept alive through a
special boolean, but if the sub-objects aren't children yet, their JS wrapper
might get deleted. For composite types with var properties, that also means
their var properties get deleted, such as the model property of TableView.qml
in the bug report.

In the future we want to support creating QWidget hierarchies with QML, which
also for layouts may rely on a delayed parent assignment for layouts.

To accommodate all this, this patch introduces an array on the JS stack that
keeps track of all JS wrappers for all QObjects created. This array is alive
during object tree creation. Afterwards, the different ownership models take
over, for example the auto parent function assigning a visual parent.

This patch also fixes an off-by-one in the total object count calculation
for composite types, where when instantiating a composite type as a sub-object
we counted the sub composite's object count but forgot the object itself.

Task-number: QTBUG-38835
Task-number: QTBUG-39966
Change-Id: I6104b2434510642081e0c54793ed296adeca7481
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/src/qml/qml/qqmlobjectcreator_p.h b/src/qml/qml/qqmlobjectcreator_p.h
index ad2d67624f..fb4d71d054 100644
--- a/src/qml/qml/qqmlobjectcreator_p.h
+++ b/src/qml/qml/qqmlobjectcreator_p.h
@@ -64,6 +64,7 @@ struct QQmlObjectCreatorSharedState : public QSharedData
     QFiniteStack<QQmlAbstractBinding*> allCreatedBindings;
     QFiniteStack<QQmlParserStatus*> allParserStatusCallbacks;
     QFiniteStack<QObject*> allCreatedObjects;
+    QV4::Value *allJavaScriptObjects; // pointer to vector on JS stack to reference JS wrappers during creation phase.
     QQmlComponentAttached *componentAttached;
     QList<QQmlEnginePrivate::FinalizeCallback> finalizeCallbacks;
     QQmlVmeProfiler profiler;