Fix QQmlV4Function API to be GC safe

Change-Id: Id4f79c22fc48ada1c8a9a858e1b7b3d1cf14d120
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

6 files changed, 100 insertions, 80 deletions

diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 10b3c57d4b..adeeedbbc7 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -1757,10 +1757,10 @@ ReturnedValue QObjectMethod::callInternal(CallData *callData)
     }
 
     if (method.isV4Function()) {
-        QV4::Value rv = QV4::Value::undefinedValue();
+        QV4::ScopedValue rv(scope, QV4::Value::undefinedValue());
 
         QV4::ScopedValue qmlGlobal(scope, m_qmlGlobal.value());
-        QQmlV4Function func(callData->argc, callData->args, &rv, qmlGlobal,
+        QQmlV4Function func(callData, rv, qmlGlobal,
                             QmlContextWrapper::getContext(qmlGlobal),
                             v8Engine);
         QQmlV4Function *funcptr = &func;
diff --git a/src/qml/qml/qqmlcomponent.cpp b/src/qml/qml/qqmlcomponent.cpp
index cfda595438..f53df6386d 100644
--- a/src/qml/qml/qqmlcomponent.cpp
+++ b/src/qml/qml/qqmlcomponent.cpp
@@ -1206,49 +1206,48 @@ void QQmlComponent::createObject(QQmlV4Function *args)
     Q_ASSERT(args);
 
     QObject *parent = 0;
-    QV4::Value valuemap = QV4::Value::undefinedValue();
+    QV4::ExecutionEngine *v4 = args->v4engine();
+    QV4::Scope scope(v4);
+    QV4::ScopedValue valuemap(scope, QV4::Value::undefinedValue());
 
     if (args->length() >= 1) {
-        if (QV4::QObjectWrapper *qobjectWrapper = (*args)[0].as<QV4::QObjectWrapper>())
+        QV4::Scoped<QV4::QObjectWrapper> qobjectWrapper(scope, (*args)[0]);
+        if (qobjectWrapper)
             parent = qobjectWrapper->object();
     }
 
     if (args->length() >= 2) {
-        QV4::Value v = (*args)[1];
-        if (!v.asObject() || v.asArrayObject()) {
+        QV4::ScopedValue v(scope, (*args)[1]);
+        if (!v->asObject() || v->asArrayObject()) {
             qmlInfo(this) << tr("createObject: value is not an object");
-            args->setReturnValue(QV4::Value::nullValue());
+            args->setReturnValue(QV4::Encode::null());
             return;
         }
         valuemap = v;
     }
 
-    QV8Engine *v8engine = args->engine();
-    QV4::ExecutionEngine *v4engine = QV8Engine::getV4(v8engine);
-    QV4::Scope scope(v4engine);
-
     QQmlContext *ctxt = creationContext();
     if (!ctxt) ctxt = d->engine->rootContext();
 
     QObject *rv = beginCreate(ctxt);
 
     if (!rv) {
-        args->setReturnValue(QV4::Value::nullValue());
+        args->setReturnValue(QV4::Encode::null());
         return;
     }
 
     QQmlComponent_setQmlParent(rv, parent);
 
-    QV4::ScopedValue object(scope, QV4::QObjectWrapper::wrap(v4engine, rv));
+    QV4::ScopedValue object(scope, QV4::QObjectWrapper::wrap(v4, rv));
     Q_ASSERT(object->isObject());
 
-    if (!valuemap.isUndefined()) {
-        QQmlComponentExtension *e = componentExtension(v8engine);
+    if (!valuemap->isUndefined()) {
+        QQmlComponentExtension *e = componentExtension(args->engine());
         QV4::ScopedObject qmlglobal(scope, args->qmlGlobal());
-        QV4::ScopedValue f(scope, QV4::Script::evaluate(v4engine, QString::fromLatin1(INITIALPROPERTIES_SOURCE), qmlglobal));
+        QV4::ScopedValue f(scope, QV4::Script::evaluate(v4, QString::fromLatin1(INITIALPROPERTIES_SOURCE), qmlglobal));
         Q_ASSERT(f->asFunctionObject());
         QV4::ScopedCallData callData(scope, 2);
-        callData->thisObject = QV4::Value::fromObject(v4engine->globalObject);
+        callData->thisObject = QV4::Value::fromObject(v4->globalObject);
         callData->args[0] = object;
         callData->args[1] = valuemap;
         f->asFunctionObject()->call(callData);
@@ -1261,9 +1260,9 @@ void QQmlComponent::createObject(QQmlV4Function *args)
     QQmlData::get(rv)->indestructible = false;
 
     if (!rv)
-        args->setReturnValue(QV4::Value::nullValue());
+        args->setReturnValue(QV4::Encode::null());
     else
-        args->setReturnValue(object);
+        args->setReturnValue(object.asReturnedValue());
 }
 
 /*!
@@ -1330,7 +1329,7 @@ void QQmlComponent::incubateObject(QQmlV4Function *args)
     Q_ASSERT(d->engine);
     Q_UNUSED(d);
     Q_ASSERT(args);
-    QV4::ExecutionEngine *v4 = QV8Engine::getV4(args->engine());
+    QV4::ExecutionEngine *v4 = args->v4engine();
     QV4::Scope scope(v4);
 
     QObject *parent = 0;
@@ -1338,7 +1337,8 @@ void QQmlComponent::incubateObject(QQmlV4Function *args)
     QQmlIncubator::IncubationMode mode = QQmlIncubator::Asynchronous;
 
     if (args->length() >= 1) {
-        if (QV4::QObjectWrapper *qobjectWrapper = (*args)[0].as<QV4::QObjectWrapper>())
+        QV4::Scoped<QV4::QObjectWrapper> qobjectWrapper(scope, (*args)[0]);
+        if (qobjectWrapper)
             parent = qobjectWrapper->object();
     }
 
@@ -1347,7 +1347,7 @@ void QQmlComponent::incubateObject(QQmlV4Function *args)
         if (v->isNull()) {
         } else if (!v->asObject() || v->asArrayObject()) {
             qmlInfo(this) << tr("createObject: value is not an object");
-            args->setReturnValue(QV4::Value::nullValue());
+            args->setReturnValue(QV4::Encode::null());
             return;
         } else {
             valuemap = v;
@@ -1355,7 +1355,8 @@ void QQmlComponent::incubateObject(QQmlV4Function *args)
     }
 
     if (args->length() >= 3) {
-        quint32 v = (*args)[2].toUInt32();
+        QV4::ScopedValue val(scope, (*args)[2]);
+        quint32 v = val->toUInt32();
         if (v == 0)
             mode = QQmlIncubator::Asynchronous;
         else if (v == 1)
@@ -1377,9 +1378,9 @@ void QQmlComponent::incubateObject(QQmlV4Function *args)
     create(*r.getPointer(), creationContext());
 
     if (r->status() == QQmlIncubator::Null) {
-        args->setReturnValue(QV4::Value::nullValue());
+        args->setReturnValue(QV4::Encode::null());
     } else {
-        args->setReturnValue(r.asValue());
+        args->setReturnValue(r.asReturnedValue());
     }
 }
 
diff --git a/src/qml/qml/v8/qv8engine_p.h b/src/qml/qml/v8/qv8engine_p.h
index 90c4745d49..d7490036f3 100644
--- a/src/qml/qml/v8/qv8engine_p.h
+++ b/src/qml/qml/v8/qv8engine_p.h
@@ -125,28 +125,28 @@ class QV8Engine;
 class QQmlV4Function
 {
 public:
-    int length() const { return argc; }
-    QV4::Value operator[](int idx) { return idx < argc ? args[idx] : QV4::Value::undefinedValue(); }
+    int length() const { return callData->argc; }
+    QV4::ReturnedValue operator[](int idx) { return (idx < callData->argc ? callData->args[idx] : QV4::Value::undefinedValue()).asReturnedValue(); }
     QQmlContextData *context() { return ctx; }
-    QV4::Value qmlGlobal() { return global; }
-    void setReturnValue(const QV4::Value &rv) { *retVal = rv; }
-    void setReturnValue(QV4::ReturnedValue rv) { *retVal = QV4::Value::fromReturnedValue(rv); }
+    QV4::ReturnedValue qmlGlobal() { return callData->thisObject.asReturnedValue(); }
+    void setReturnValue(QV4::ReturnedValue rv) { retVal = rv; }
     QV8Engine *engine() const { return e; }
+    QV4::ExecutionEngine *v4engine() const;
 private:
     friend struct QV4::QObjectMethod;
     QQmlV4Function();
     QQmlV4Function(const QQmlV4Function &);
     QQmlV4Function &operator=(const QQmlV4Function &);
 
-    QQmlV4Function(int length, const QV4::Value *args,
-                           QV4::Value *rv, const QV4::Value &global,
-                           QQmlContextData *c, QV8Engine *e)
-    : argc(length), args(args), retVal(rv), global(global), ctx(c), e(e) {}
+    QQmlV4Function(QV4::CallData *callData, QV4::ValueRef retVal,
+                   const QV4::ValueRef global, QQmlContextData *c, QV8Engine *e)
+        : callData(callData), retVal(retVal), ctx(c), e(e)
+    {
+        callData->thisObject.val = global.asReturnedValue();
+    }
 
-    int argc;
-    const QV4::Value *args;
-    QV4::Value *retVal;
-    QV4::Value global;
+    QV4::CallData *callData;
+    QV4::ValueRef retVal;
     QQmlContextData *ctx;
     QV8Engine *e;
 };
@@ -288,7 +288,7 @@ private:
     Q_DISABLE_COPY(QV8Engine)
 };
 
-QV8Engine::Deletable *QV8Engine::extensionData(int index) const
+inline QV8Engine::Deletable *QV8Engine::extensionData(int index) const
 {
     if (index < m_extensionData.count())
         return m_extensionData[index];
@@ -296,6 +296,11 @@ QV8Engine::Deletable *QV8Engine::extensionData(int index) const
         return 0;
 }
 
+inline QV4::ExecutionEngine *QQmlV4Function::v4engine() const
+{
+    return QV8Engine::getV4(e);
+}
+
 QT_END_NAMESPACE
 
 Q_DECLARE_METATYPE(QQmlV4Handle)
diff --git a/src/qml/types/qqmldelegatemodel.cpp b/src/qml/types/qqmldelegatemodel.cpp
index 8537e1a68e..8c434ccfdc 100644
--- a/src/qml/types/qqmldelegatemodel.cpp
+++ b/src/qml/types/qqmldelegatemodel.cpp
@@ -2447,7 +2447,8 @@ void QQmlDelegateModelGroup::insert(QQmlV4Function *args)
         return;
 
     int  i = 0;
-    QV4::Value v = (*args)[i];
+    QV4::Scope scope(args->v4engine());
+    QV4::ScopedValue v(scope, (*args)[i]);
     if (d->parseIndex(v, &index, &group)) {
         if (index < 0 || index > model->m_compositor.count(group)) {
             qmlInfo(this) << tr("insert: index out of range");
@@ -2463,12 +2464,14 @@ void QQmlDelegateModelGroup::insert(QQmlV4Function *args)
             : model->m_compositor.end();
 
     int groups = 1 << d->group;
-    if (++i < args->length())
-        groups |= model->m_cacheMetaType->parseGroups((*args)[i]);
+    if (++i < args->length()) {
+        QV4::ScopedValue val(scope, (*args)[i]);
+        groups |= model->m_cacheMetaType->parseGroups(val);
+    }
 
-    if (v.asArrayObject()) {
+    if (v->asArrayObject()) {
         return;
-    } else if (v.asObject()) {
+    } else if (v->asObject()) {
         model->insert(before, v, groups);
         model->emitChanges();
     }
@@ -2506,16 +2509,19 @@ void QQmlDelegateModelGroup::create(QQmlV4Function *args)
     Compositor::Group group = d->group;
 
     int  i = 0;
-    QV4::Value v = (*args)[i];
+    QV4::Scope scope(args->v4engine());
+    QV4::ScopedValue v(scope, (*args)[i]);
     if (d->parseIndex(v, &index, &group))
         ++i;
 
     if (i < args->length() && index >= 0 && index <= model->m_compositor.count(group)) {
         v = (*args)[i];
-        if (/*QV4::Object *o = */v.asObject()) {
+        if (v->asObject()) {
             int groups = 1 << d->group;
-            if (++i < args->length())
-                groups |= model->m_cacheMetaType->parseGroups((*args)[i]);
+            if (++i < args->length()) {
+                QV4::ScopedValue val(scope, (*args)[i]);
+                groups |= model->m_cacheMetaType->parseGroups(val);
+            }
 
             Compositor::insert_iterator before = index < model->m_compositor.count(group)
                     ? model->m_compositor.findInsertPosition(group, index)
@@ -2579,7 +2585,8 @@ void QQmlDelegateModelGroup::resolve(QQmlV4Function *args)
     Compositor::Group fromGroup = d->group;
     Compositor::Group toGroup = d->group;
 
-    QV4::Value v = (*args)[0];
+    QV4::Scope scope(args->v4engine());
+    QV4::ScopedValue v(scope, (*args)[0]);
     if (d->parseIndex(v, &from, &fromGroup)) {
         if (from < 0 || from >= model->m_compositor.count(fromGroup)) {
             qmlInfo(this) << tr("resolve: from index out of range");
@@ -2676,7 +2683,8 @@ void QQmlDelegateModelGroup::remove(QQmlV4Function *args)
         return;
 
     int i = 0;
-    QV4::Value v = (*args)[i];
+    QV4::Scope scope(args->v4engine());
+    QV4::ScopedValue v(scope, (*args)[0]);
     if (!d->parseIndex(v, &index, &group)) {
         qmlInfo(this) << tr("remove: invalid index");
         return;
@@ -2684,8 +2692,8 @@ void QQmlDelegateModelGroup::remove(QQmlV4Function *args)
 
     if (++i < args->length()) {
         v = (*args)[i];
-        if (v.isNumber())
-            count = v.toInt32();
+        if (v->isNumber())
+            count = v->toInt32();
     }
 
     QQmlDelegateModelPrivate *model = QQmlDelegateModelPrivate::get(d->model);
@@ -2711,13 +2719,14 @@ bool QQmlDelegateModelGroupPrivate::parseGroupArgs(
         return false;
 
     int i = 0;
-    QV4::Value v = (*args)[i];
+    QV4::Scope scope(args->v4engine());
+    QV4::ScopedValue v(scope, (*args)[i]);
     if (!parseIndex(v, index, group))
         return false;
 
     v = (*args)[++i];
-    if (v.isNumber()) {
-        *count = v.toInt32();
+    if (v->isNumber()) {
+        *count = v->toInt32();
 
         if (++i == args->length())
             return false;
@@ -2844,20 +2853,23 @@ void QQmlDelegateModelGroup::move(QQmlV4Function *args)
     int to = -1;
     int count = 1;
 
-    if (!d->parseIndex((*args)[0], &from, &fromGroup)) {
+    QV4::Scope scope(args->v4engine());
+    QV4::ScopedValue v(scope, (*args)[0]);
+    if (!d->parseIndex(v, &from, &fromGroup)) {
         qmlInfo(this) << tr("move: invalid from index");
         return;
     }
 
-    if (!d->parseIndex((*args)[1], &to, &toGroup)) {
+    v = (*args)[1];
+    if (!d->parseIndex(v, &to, &toGroup)) {
         qmlInfo(this) << tr("move: invalid to index");
         return;
     }
 
     if (args->length() > 2) {
-        QV4::Value v = (*args)[2];
-        if (v.isNumber())
-            count = v.toInt32();
+        v = (*args)[2];
+        if (v->isNumber())
+            count = v->toInt32();
     }
 
     QQmlDelegateModelPrivate *model = QQmlDelegateModelPrivate::get(d->model);
diff --git a/src/qml/types/qqmllistmodel.cpp b/src/qml/types/qqmllistmodel.cpp
index 7965bc046d..4af19438bf 100644
--- a/src/qml/types/qqmllistmodel.cpp
+++ b/src/qml/types/qqmllistmodel.cpp
@@ -1883,8 +1883,9 @@ void QQmlListModel::remove(QQmlV4Function *args)
     int argLength = args->length();
 
     if (argLength == 1 || argLength == 2) {
-        int index = (*args)[0].toInt32();
-        int removeCount = (argLength == 2 ? (*args)[1].toInt32() : 1);
+        QV4::Scope scope(args->v4engine());
+        int index = QV4::ScopedValue(scope, (*args)[0])->toInt32();
+        int removeCount = (argLength == 2 ? QV4::ScopedValue(scope, (*args)[1])->toInt32() : 1);
 
         if (index < 0 || index+removeCount > count() || removeCount <= 0) {
             qmlInfo(this) << tr("remove: indices [%1 - %2] out of range [0 - %3]").arg(index).arg(index+removeCount).arg(count());
@@ -1924,20 +1925,19 @@ void QQmlListModel::remove(QQmlV4Function *args)
 void QQmlListModel::insert(QQmlV4Function *args)
 {
     if (args->length() == 2) {
-
-        QV4::Value arg0 = (*args)[0];
-        int index = arg0.toInt32();
+        QV4::Scope scope(args->v4engine());
+        QV4::ScopedValue arg0(scope, (*args)[0]);
+        int index = arg0->toInt32();
 
         if (index < 0 || index > count()) {
             qmlInfo(this) << tr("insert: index %1 out of range").arg(index);
             return;
         }
 
-        QV4::Value arg1 = (*args)[1];
-
-        if (QV4::ArrayObject *objectArray = arg1.asArrayObject()) {
-            QV4::Scope scope(objectArray->engine());
-            QV4::Scoped<QV4::Object> argObject(scope);
+        QV4::ScopedObject argObject(scope, (*args)[1]);
+        QV4::ScopedArrayObject objectArray(scope, (*args)[1]);
+        if (objectArray) {
+            QV4::ScopedObject argObject(scope);
 
             int objectArrayLength = objectArray->arrayLength();
             for (int i=0 ; i < objectArrayLength ; ++i) {
@@ -1950,11 +1950,11 @@ void QQmlListModel::insert(QQmlV4Function *args)
                 }
             }
             emitItemsInserted(index, objectArrayLength);
-        } else if (QV4::Object *argObject = arg1.asObject()) {
+        } else if (argObject) {
             if (m_dynamicRoles) {
-                m_modelObjects.insert(index, DynamicRoleModelNode::create(args->engine()->variantMapFromJS(argObject), this));
+                m_modelObjects.insert(index, DynamicRoleModelNode::create(args->engine()->variantMapFromJS(argObject.getPointer()), this));
             } else {
-                m_listModel->insert(index, argObject, args->engine());
+                m_listModel->insert(index, argObject.getPointer(), args->engine());
             }
 
             emitItemsInserted(index, 1);
@@ -2034,10 +2034,11 @@ void QQmlListModel::move(int from, int to, int n)
 void QQmlListModel::append(QQmlV4Function *args)
 {
     if (args->length() == 1) {
-        QV4::Value arg = (*args)[0];
+        QV4::Scope scope(args->v4engine());
+        QV4::ScopedObject argObject(scope, (*args)[0]);
+        QV4::ScopedArrayObject objectArray(scope, (*args)[0]);
 
-        if (QV4::ArrayObject *objectArray = arg.asArrayObject()) {
-            QV4::Scope scope(objectArray->engine());
+        if (objectArray) {
             QV4::Scoped<QV4::Object> argObject(scope);
 
             int objectArrayLength = objectArray->arrayLength();
@@ -2054,14 +2055,14 @@ void QQmlListModel::append(QQmlV4Function *args)
             }
 
             emitItemsInserted(index, objectArrayLength);
-        } else if (QV4::Object *argObject = arg.asObject()) {
+        } else if (argObject) {
             int index;
 
             if (m_dynamicRoles) {
                 index = m_modelObjects.count();
-                m_modelObjects.append(DynamicRoleModelNode::create(args->engine()->variantMapFromJS(argObject), this));
+                m_modelObjects.append(DynamicRoleModelNode::create(args->engine()->variantMapFromJS(argObject.getPointer()), this));
             } else {
-                index = m_listModel->append(argObject, args->engine());
+                index = m_listModel->append(argObject.getPointer(), args->engine());
             }
 
             emitItemsInserted(index, 1);
diff --git a/src/qml/types/qquickworkerscript.cpp b/src/qml/types/qquickworkerscript.cpp
index b955555a82..a96a8ee71d 100644
--- a/src/qml/types/qquickworkerscript.cpp
+++ b/src/qml/types/qquickworkerscript.cpp
@@ -682,7 +682,8 @@ void QQuickWorkerScript::sendMessage(QQmlV4Function *args)
         return;
     }
 
-    QV4::Value argument = QV4::Value::undefinedValue();
+    QV4::Scope scope(args->v4engine());
+    QV4::ScopedValue argument(scope, QV4::Value::undefinedValue());
     if (args->length() != 0)
         argument = (*args)[0];