Qml: When cloning a stack frame, also clone its instruction pointer

Otherwise we get an out of range access when looking for the line
number. To be extra safe, we also add another guard against this to the
lineNumber() function.

Fixes: QTBUG-90466
Change-Id: I4d9cb52ecba2631696537f02a3c1b75c3658ceb8
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
(cherry picked from commit c02b0e529a3266cce2f7d852deca7774402b236e)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

2 files changed, 9 insertions, 5 deletions

diff --git a/src/qml/jsruntime/qv4jscall_p.h b/src/qml/jsruntime/qv4jscall_p.h
index 337b86dbc0..399ce1dee2 100644
--- a/src/qml/jsruntime/qv4jscall_p.h
+++ b/src/qml/jsruntime/qv4jscall_p.h
@@ -140,8 +140,12 @@ struct ScopedStackFrame
     ScopedStackFrame(const Scope &scope, ExecutionContext *context)
         : engine(scope.engine)
     {
-        frame.init(engine->currentStackFrame ? engine->currentStackFrame->v4Function : nullptr,
-                   nullptr, context, nullptr, nullptr, 0);
+        if (auto currentFrame = engine->currentStackFrame) {
+            frame.init(currentFrame->v4Function, nullptr, context, nullptr, nullptr, 0);
+            frame.instructionPointer = currentFrame->instructionPointer;
+        } else {
+            frame.init(nullptr, nullptr, context, nullptr, nullptr, 0);
+        }
         frame.push(engine);
     }
 
diff --git a/src/qml/jsruntime/qv4stackframe.cpp b/src/qml/jsruntime/qv4stackframe.cpp
index e99dda591f..0bd495234d 100644
--- a/src/qml/jsruntime/qv4stackframe.cpp
+++ b/src/qml/jsruntime/qv4stackframe.cpp
@@ -55,7 +55,7 @@ QString CppStackFrame::function() const
 
 int CppStackFrame::lineNumber() const
 {
-    if (!v4Function)
+    if (!v4Function || instructionPointer <= 0)
         return -1;
 
     auto findLine = [](const CompiledData::CodeOffsetToLine &entry, uint offset) {
@@ -63,9 +63,9 @@ int CppStackFrame::lineNumber() const
     };
 
     const QV4::CompiledData::Function *cf = v4Function->compiledFunction;
-    uint offset = instructionPointer;
+    const uint offset = instructionPointer;
     const CompiledData::CodeOffsetToLine *lineNumbers = cf->lineNumberTable();
-    uint nLineNumbers = cf->nLineNumbers;
+    const uint nLineNumbers = cf->nLineNumbers;
     const CompiledData::CodeOffsetToLine *line = std::lower_bound(lineNumbers, lineNumbers + nLineNumbers, offset, findLine) - 1;
     return line->line;
 }