Fix crashes with closures created in QML components

When closures created inside QML components are called after the
surrounding component (and consequently QML context) has been destroyed,
we are in a somewhat limited environment. Initially we would just crash
as the calling QML context is not valid anymore. We can alleviate that
by introducing reference counting on the context and letting the QML
context wrapper keep a strong reference. This avoids the crashes and
also ensures that at least imports continue to be accessible within
these contexts (as the singleton test case demonstrates).

Task-number: QTBUG-61781
Change-Id: I893f171842d01b0863d95a02ea738adc2620e236
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

3 files changed, 47 insertions, 0 deletions

diff --git a/tests/auto/qml/qqmlcontext/data/Singleton.qml b/tests/auto/qml/qqmlcontext/data/Singleton.qml
new file mode 100644
index 0000000000..68ef5850e3
--- /dev/null
+++ b/tests/auto/qml/qqmlcontext/data/Singleton.qml
@@ -0,0 +1,5 @@
+pragma Singleton
+import QtQml 2.0
+QtObject {
+    readonly property string song: "Highway to Hell"
+}
diff --git a/tests/auto/qml/qqmlcontext/data/contextViaClosureAfterDestruction.qml b/tests/auto/qml/qqmlcontext/data/contextViaClosureAfterDestruction.qml
new file mode 100644
index 0000000000..2e0e6f20e2
--- /dev/null
+++ b/tests/auto/qml/qqmlcontext/data/contextViaClosureAfterDestruction.qml
@@ -0,0 +1,14 @@
+import QtQml 2.0
+
+import constants 1.0
+
+QtObject {
+    function createClosure() {
+        return function() { return Sing.song; }
+    }
+    function createComponentFactory() {
+        return function(parentObj) {
+            return Qt.createQmlObject('import QtQml 2.0; QtObject { property string test: "ok"; }', parentObj);
+        }
+    }
+}
diff --git a/tests/auto/qml/qqmlcontext/tst_qqmlcontext.cpp b/tests/auto/qml/qqmlcontext/tst_qqmlcontext.cpp
index f49fd391ac..5f57b9ebb0 100644
--- a/tests/auto/qml/qqmlcontext/tst_qqmlcontext.cpp
+++ b/tests/auto/qml/qqmlcontext/tst_qqmlcontext.cpp
@@ -62,6 +62,7 @@ private slots:
     void evalAfterInvalidate();
     void qobjectDerived();
     void qtbug_49232();
+    void contextViaClosureAfterDestruction();
 
 private:
     QQmlEngine engine;
@@ -723,6 +724,33 @@ void tst_qqmlcontext::qtbug_49232()
     QCOMPARE(obj->property("valueTwo"), QVariant(97));
 }
 
+void tst_qqmlcontext::contextViaClosureAfterDestruction()
+{
+    qmlRegisterSingletonType(testFileUrl("Singleton.qml"), "constants", 1, 0, "Sing");
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("contextViaClosureAfterDestruction.qml"));
+    QJSValue valueClosure;
+    QJSValue componentFactoryClosure;
+    {
+        QScopedPointer<QObject> obj(component.create());
+        QVERIFY(!obj.isNull());
+        // meta-calls don't support QJSValue return types, so do the call "by hand"
+        valueClosure = engine.newQObject(obj.data()).property(QStringLiteral("createClosure")).call();
+        QVERIFY(valueClosure.isCallable());
+        componentFactoryClosure = engine.newQObject(obj.data()).property(QStringLiteral("createComponentFactory")).call();
+        QVERIFY(componentFactoryClosure.isCallable());
+    }
+    QCOMPARE(valueClosure.call().toString(), QLatin1String("Highway to Hell"));
+
+    QScopedPointer<QObject> parent(new QObject);
+    QJSValue parentWrapper = engine.newQObject(parent.data());
+    QQmlEngine::setObjectOwnership(parent.data(), QQmlEngine::CppOwnership);
+
+    QJSValue subObject = componentFactoryClosure.callWithInstance(componentFactoryClosure, QJSValueList() << parentWrapper);
+    QVERIFY(subObject.isError());
+    QCOMPARE(subObject.toString(), QLatin1String("Error: Qt.createQmlObject(): Cannot create a component in an invalid context"));
+}
+
 QTEST_MAIN(tst_qqmlcontext)
 
 #include "tst_qqmlcontext.moc"