qiurui
/
qtdeclarative
mirror of https://github.com/qt/qtdeclarative.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

VariantAssociationObject: mark own member during gc 

We were missing the DECLARE_MARKOBJECTS macro, which could lead to heap
corruption if the mapping was actually in use.

Pick-to: 6.10 6.9
Fixes: QTBUG-137350
Change-Id: Idd9184a3a3c35faa7caf35d0e3ac8c901f99afb7
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
This commit is contained in:
Fabian Kosmale 2025-06-03 15:03:54 +02:00
parent e1f8afef69
commit 217439c2d1
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/qml/jsruntime/qv4variantassociationobject_p.h
View File

@ -50,6 +50,8 @@ namespace QV4 {
DECLARE_HEAP_OBJECT(VariantAssociationObject, ReferenceObject) DECLARE_HEAP_OBJECT(VariantAssociationObject, ReferenceObject)
{ {
DECLARE_MARKOBJECTS(VariantAssociationObject)
enum class AssociationType: quint8 { enum class AssociationType: quint8 {
VariantMap, VariantMap,
VariantHash VariantHash

25
tests/auto/qml/qv4mm/tst_qv4mm.cpp
View File

@ -15,6 +15,7 @@
#include <private/qqmlcomponentattached_p.h> #include <private/qqmlcomponentattached_p.h>
#include <private/qv4mapobject_p.h> #include <private/qv4mapobject_p.h>
#include <private/qv4setobject_p.h> #include <private/qv4setobject_p.h>
#include <private/qv4variantassociationobject_p.h>
#if QT_CONFIG(qml_jit) #if QT_CONFIG(qml_jit)
#include <private/qv4baselinejit_p.h> #include <private/qv4baselinejit_p.h>
#endif #endif
@ -47,6 +48,7 @@ private slots:
void forInOnProxyMarksTarget(); void forInOnProxyMarksTarget();
void allocWithMemberDataMidwayDrain(); void allocWithMemberDataMidwayDrain();
void markObjectWrappersAfterMarkWeakValues(); void markObjectWrappersAfterMarkWeakValues();
void variantAssociationObjectMarksMember();
}; };
tst_qv4mm::tst_qv4mm() tst_qv4mm::tst_qv4mm()
@ -835,6 +837,29 @@ void tst_qv4mm::markObjectWrappersAfterMarkWeakValues()
QCOMPARE(qvariant_cast<QObject *>(retrieved)->objectName(), "yep"); QCOMPARE(qvariant_cast<QObject *>(retrieved)->objectName(), "yep");
} }
void tst_qv4mm::variantAssociationObjectMarksMember()
{
QJSEngine jsEngine;
QV4::ExecutionEngine &engine = *jsEngine.handle();
QV4::Scope scope(&engine);
QVariantHash assoc;
assoc[QLatin1String("test")] = 2;
QV4::ScopedObject o(scope, engine.newObject());
QV4::Scoped<QV4::VariantAssociationObject> varAssocObject(
scope,
QV4::VariantAssociationPrototype::fromQVariantHash(&engine, assoc, o->d(), -1, QV4::Heap::ReferenceObject::NoFlag)
);
bool hasProperty = false;
// ensure that the propertyIndexMapping gets initialized
varAssocObject->getElement(QLatin1String("test"), &hasProperty);
QVERIFY(hasProperty);
gc(engine);
auto mapping = varAssocObject->d()->propertyIndexMapping;
QVERIFY(mapping);
QVERIFY(mapping->inUse());
}
QTEST_MAIN(tst_qv4mm) QTEST_MAIN(tst_qv4mm)
#include "tst_qv4mm.moc" #include "tst_qv4mm.moc"