From 18b1e8266fd98c3099724de3baf4e9a014fb72d5 Mon Sep 17 00:00:00 2001 From: Maximilian Goldstein Date: Thu, 4 Mar 2021 14:51:30 +0100 Subject: qv4generatorobject: Fix crash when creating new properties Previously HeapObject::GeneratorObject utilized a ValueArray member to store stack information. As we rely on all HeapObject members to have a constant size in order for QV4Table::inlinePropertyOffset to remain accurate, this lead to a memory conflict when a user defined his own property on the Generator. Please do not use ValueArray for any types that are user accessible or that you intend to add properties to. Now the stack information is stored into ArrayObjects instead which circumvents the issue. Fixes: QTBUG-91491 Change-Id: Id6f638bf36a3ae3c9320ac99e67214c48dc81226 Reviewed-by: Fabian Kosmale Reviewed-by: Andrei Golubev (cherry picked from commit 7ea690c61dabd2485e80e7fae9aed392ba02c846) Reviewed-by: Qt Cherry-pick Bot --- src/qml/jsruntime/qv4generatorobject_p.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/qml/jsruntime/qv4generatorobject_p.h') diff --git a/src/qml/jsruntime/qv4generatorobject_p.h b/src/qml/jsruntime/qv4generatorobject_p.h index d697bd871f..8e14bcfa84 100644 --- a/src/qml/jsruntime/qv4generatorobject_p.h +++ b/src/qml/jsruntime/qv4generatorobject_p.h @@ -90,7 +90,8 @@ struct GeneratorPrototype : FunctionObject { Member(class, Pointer, GeneratorFunction *, function) \ Member(class, NoMark, GeneratorState, state) \ Member(class, NoMark, CppStackFrame, cppFrame) \ - Member(class, ValueArray, ValueArray, stack) + Member(class, Pointer, ArrayObject *, values) \ + Member(class, Pointer, ArrayObject *, jsFrame) DECLARE_HEAP_OBJECT(GeneratorObject, Object) { DECLARE_MARKOBJECTS(GeneratorObject); -- cgit v1.2.3