2 files changed, 40 insertions, 43 deletions

diff --git a/src/qml/qml/qqmldata_p.h b/src/qml/qml/qqmldata_p.h
index 4848f48766..5794e6f0c5 100644
--- a/src/qml/qml/qqmldata_p.h
+++ b/src/qml/qml/qqmldata_p.h
@@ -156,18 +156,21 @@ public:
     quint32 hasInterceptorMetaObject:1;
     quint32 hasVMEMetaObject:1;
     quint32 parentFrozen:1;
-    quint32 dummy:22;
+    quint32 dummy:6;
 
     // When bindingBitsSize < sizeof(ptr), we store the binding bit flags inside
     // bindingBitsValue. When we need more than sizeof(ptr) bits, we allocated
     // sufficient space and use bindingBits to point to it.
-    int bindingBitsSize;
+    quint32 bindingBitsArraySize : 16;
     typedef quintptr BindingBitsType;
+    enum {
+        BitsPerType = sizeof(BindingBitsType) * 8,
+        InlineBindingArraySize = 2
+    };
     union {
         BindingBitsType *bindingBits;
-        BindingBitsType bindingBitsValue;
+        BindingBitsType bindingBitsValue[InlineBindingArraySize];
     };
-    enum { MaxInlineBits = sizeof(BindingBitsType) * 8 };
 
     struct NotifyList {
         quint64 connectionMask;
@@ -275,6 +278,9 @@ public:
         return createPropertyCache(engine, object);
     }
 
+    Q_ALWAYS_INLINE static uint offsetForBit(int bit) { return static_cast<uint>(bit) / BitsPerType; }
+    Q_ALWAYS_INLINE static BindingBitsType bitFlagForBit(int bit) { return BindingBitsType(1) << (static_cast<uint>(bit) & (BitsPerType - 1)); }
+
 private:
     // For attachedProperties
     mutable QQmlDataExtended *extendedData;
@@ -286,13 +292,12 @@ private:
 
     Q_ALWAYS_INLINE bool hasBitSet(int bit) const
     {
-        if (bindingBitsSize <= bit)
+        uint offset = offsetForBit(bit);
+        if (bindingBitsArraySize <= offset)
             return false;
 
-        if (bindingBitsSize == MaxInlineBits)
-            return bindingBitsValue & (BindingBitsType(1) << bit);
-        else
-            return bindingBits[bit / MaxInlineBits] & (BindingBitsType(1) << (bit % MaxInlineBits));
+        const BindingBitsType *bits = (bindingBitsArraySize == InlineBindingArraySize) ? bindingBitsValue : bindingBits;
+        return bits[offset] & bitFlagForBit(bit);
     }
 };
 
diff --git a/src/qml/qml/qqmlengine.cpp b/src/qml/qml/qqmlengine.cpp
index 5350ad38a3..c09c048307 100644
--- a/src/qml/qml/qqmlengine.cpp
+++ b/src/qml/qml/qqmlengine.cpp
@@ -110,7 +110,10 @@ Q_DECLARE_METATYPE(QQmlProperty)
 QT_BEGIN_NAMESPACE
 
 typedef QQmlData::BindingBitsType BindingBitsType;
-enum { MaxInlineBits = QQmlData::MaxInlineBits };
+enum {
+    BitsPerType = QQmlData::BitsPerType,
+    InlineBindingArraySize = QQmlData::InlineBindingArraySize
+};
 
 void qmlRegisterBaseTypes(const char *uri, int versionMajor, int versionMinor)
 {
@@ -741,11 +744,12 @@ QQmlData::QQmlData()
     : ownedByQml1(false), ownMemory(true), indestructible(true), explicitIndestructibleSet(false),
       hasTaintedV4Object(false), isQueuedForDeletion(false), rootObjectInCreation(false),
       hasInterceptorMetaObject(false), hasVMEMetaObject(false), parentFrozen(false),
-      bindingBitsSize(MaxInlineBits), bindingBitsValue(0), notifyList(0),
+      bindingBitsArraySize(InlineBindingArraySize), notifyList(0),
       bindings(0), signalHandlers(0), nextContextObject(0), prevContextObject(0),
       lineNumber(0), columnNumber(0), jsEngineId(0), compilationUnit(0),
       propertyCache(0), guards(0), extendedData(0)
 {
+    memset(bindingBitsValue, 0, sizeof(bindingBitsValue));
     init();
 }
 
@@ -1792,7 +1796,7 @@ void QQmlData::destroyed(QObject *object)
         signalHandler = next;
     }
 
-    if (bindingBitsSize > MaxInlineBits)
+    if (bindingBitsArraySize > InlineBindingArraySize)
         free(bindingBits);
 
     if (propertyCache)
@@ -1841,47 +1845,35 @@ void QQmlData::parentChanged(QObject *object, QObject *parent)
 
 static void QQmlData_setBit(QQmlData *data, QObject *obj, int bit)
 {
-    if (Q_UNLIKELY(data->bindingBitsSize <= bit)) {
+    uint offset = QQmlData::offsetForBit(bit);
+    BindingBitsType *bits = (data->bindingBitsArraySize == InlineBindingArraySize) ? data->bindingBitsValue : data->bindingBits;
+    if (Q_UNLIKELY(data->bindingBitsArraySize <= offset)) {
         int props = QQmlMetaObject(obj).propertyCount();
         Q_ASSERT(bit < 2 * props);
 
-        int arraySize = (2 * props + MaxInlineBits - 1) / MaxInlineBits;
-        Q_ASSERT(arraySize > 1);
-
-        // special handling for 32 here is to make sure we wipe the first byte
-        // when going from bindingBitsValue to bindingBits, and preserve the old
-        // set bits so we can restore them after the allocation
-        int oldArraySize = data->bindingBitsSize > MaxInlineBits ? data->bindingBitsSize / MaxInlineBits : 0;
-        quintptr oldValue = data->bindingBitsSize == MaxInlineBits ? data->bindingBitsValue : 0;
-
-        data->bindingBits = static_cast<BindingBitsType *>(realloc((data->bindingBitsSize == MaxInlineBits) ? 0 : data->bindingBits,
-                                                                   arraySize * sizeof(BindingBitsType)));
-
-        memset(data->bindingBits + oldArraySize,
-               0x00,
-               sizeof(BindingBitsType) * (arraySize - oldArraySize));
+        uint arraySize = (2 * static_cast<uint>(props) + BitsPerType - 1) / BitsPerType;
+        Q_ASSERT(arraySize > InlineBindingArraySize && arraySize > data->bindingBitsArraySize);
 
-        data->bindingBitsSize = arraySize * MaxInlineBits;
+        BindingBitsType *newBits = static_cast<BindingBitsType *>(malloc(arraySize*sizeof(BindingBitsType)));
+        memcpy(newBits, bits, data->bindingBitsArraySize * sizeof(BindingBitsType));
+        memset(newBits + data->bindingBitsArraySize, 0, sizeof(BindingBitsType) * (arraySize - data->bindingBitsArraySize));
 
-        // reinstate bindingBitsValue after we dropped it
-        if (oldValue) {
-            memcpy(data->bindingBits, &oldValue, sizeof(oldValue));
-        }
+        if (data->bindingBitsArraySize > InlineBindingArraySize)
+            free(bits);
+        data->bindingBits = newBits;
+        bits = newBits;
+        data->bindingBitsArraySize = arraySize;
     }
-
-    if (data->bindingBitsSize == MaxInlineBits)
-        data->bindingBitsValue |= BindingBitsType(1) << bit;
-    else
-        data->bindingBits[bit / MaxInlineBits] |= (BindingBitsType(1) << (bit % MaxInlineBits));
+    Q_ASSERT(offset < data->bindingBitsArraySize);
+    bits[offset] |= QQmlData::bitFlagForBit(bit);
 }
 
 static void QQmlData_clearBit(QQmlData *data, int bit)
 {
-    if (data->bindingBitsSize > bit) {
-        if (data->bindingBitsSize == MaxInlineBits)
-            data->bindingBitsValue &= ~(BindingBitsType(1) << (bit % MaxInlineBits));
-        else
-            data->bindingBits[bit / MaxInlineBits] &= ~(BindingBitsType(1) << (bit % MaxInlineBits));
+    uint offset = QQmlData::offsetForBit(bit);
+    if (data->bindingBitsArraySize > offset) {
+        BindingBitsType *bits = (data->bindingBitsArraySize == InlineBindingArraySize) ? data->bindingBitsValue : data->bindingBits;
+        bits[offset] &= ~QQmlData::bitFlagForBit(bit);
     }
 }