Merge branch '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1 into 4.7-integration

* '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1:
  Fix potential networking crash due to null-pointer dereference
  Revert "Improve timer ID safety by using a serial counter per ID."
  Invalidate QScriptPrograms when engine is destroyed
  Fix alignment issue causing crash in QtScript/JavaScriptCore
  Restore Qt 4.6 behaviour: exec() always enters the event loop.
  Make syncqt not complain about missing header macros.

3 files changed, 17 insertions, 28 deletions

diff --git a/src/corelib/kernel/qabstracteventdispatcher.cpp b/src/corelib/kernel/qabstracteventdispatcher.cpp
index cc08f092..e79f87a 100644
--- a/src/corelib/kernel/qabstracteventdispatcher.cpp
+++ b/src/corelib/kernel/qabstracteventdispatcher.cpp
@@ -137,12 +137,6 @@ void QAbstractEventDispatcherPrivate::init()
 // free list). As an added protection, we use the cell to store an invalid
 // (negative) value that we can later check for integrity.
 //
-// ABA prevention simply adds a value to 7 of the top 8 bits when resetting
-// nextFreeTimerId.
-//
-// The extra code is the bucket allocation which allows us to start with a
-// very small bucket size and grow as needed.
-//
 // (continues below).
 int QAbstractEventDispatcherPrivate::allocateTimerId()
 {
@@ -170,8 +164,6 @@ int QAbstractEventDispatcherPrivate::allocateTimerId()
         newTimerId = prepareNewValueWithSerialNumber(timerId, b[at]);
     } while (!nextFreeTimerId.testAndSetRelaxed(timerId, newTimerId));
 
-    timerId &= TimerIdMask;
-    timerId |= b[at] & TimerSerialMask;
     b[at] = -timerId;
 
     return timerId;
@@ -182,13 +174,12 @@ int QAbstractEventDispatcherPrivate::allocateTimerId()
 //    X[timerId] = nextFreeTimerId;
 // then we update nextFreeTimerId to the timer we've just released
 //
+// The extra code in allocateTimerId and releaseTimerId are ABA prevention
+// and bucket memory. The buckets are simply to make sure we allocate only
+// the necessary number of timers. See above.
+//
 // ABA prevention simply adds a value to 7 of the top 8 bits when resetting
 // nextFreeTimerId.
-//
-// In addition to that, we update the same 7 bits in each entry in the bucket
-// as a counter. That way, a timer ID allocated and released will always be
-// returned with a different ID. This reduces the chances of timers being released
-// erroneously by application code.
 void QAbstractEventDispatcherPrivate::releaseTimerId(int timerId)
 {
     int which = timerId & TimerIdMask;
@@ -196,21 +187,12 @@ void QAbstractEventDispatcherPrivate::releaseTimerId(int timerId)
     int at = bucketIndex(bucket, which);
     int *b = timerIds[bucket];
 
-#ifndef QT_NO_DEBUG
-    // debug code
-    Q_ASSERT_X(timerId == -b[at], "QAbstractEventDispatcher::releaseTimerId", "Timer ID was not found, fix application");
-#else
-    if (timerId != -b[at]) {
-        // release code
-        qWarning("Timer ID %d was not found, fix application", timerId);
-        return;
-    }
-#endif
+    Q_ASSERT(b[at] == -timerId);
 
     int freeId, newTimerId;
     do {
         freeId = nextFreeTimerId;//.loadAcquire(); // ### FIXME Proper memory ordering semantics
-        b[at] = prepareNewValueWithSerialNumber(-b[at], freeId);
+        b[at] = freeId & TimerIdMask;
 
         newTimerId = prepareNewValueWithSerialNumber(freeId, timerId);
     } while (!nextFreeTimerId.testAndSetRelease(freeId, newTimerId));
diff --git a/src/corelib/thread/qthread.cpp b/src/corelib/thread/qthread.cpp
index f368192..f4bfa5d 100644
--- a/src/corelib/thread/qthread.cpp
+++ b/src/corelib/thread/qthread.cpp
@@ -482,10 +482,7 @@ int QThread::exec()
     Q_D(QThread);
     QMutexLocker locker(&d->mutex);
     d->data->quitNow = false;
-    if (d->exited) {
-        d->exited = false;
-        return d->returnCode;
-    }
+    d->exited = false;
     locker.unlock();
 
     QEventLoop eventLoop;
diff --git a/src/corelib/tools/qsharedpointer_impl.h b/src/corelib/tools/qsharedpointer_impl.h
index 2404d2a..0337c1f 100644
--- a/src/corelib/tools/qsharedpointer_impl.h
+++ b/src/corelib/tools/qsharedpointer_impl.h
@@ -44,7 +44,17 @@
 #ifndef QSHAREDPOINTER_H
 #error Do not include qsharedpointer_impl.h directly
 #endif
+
 #if 0
+// These macros are duplicated here to make syncqt not complain a about
+// this header, as we have a "qt_sync_stop_processing" below, which in turn
+// is here because this file contains a template mess and duplicates the
+// classes found in qsharedpointer.h
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+QT_MODULE(Core)
+QT_END_NAMESPACE
+QT_END_HEADER
 #pragma qt_sync_stop_processing
 #endif