Fix memory leak in QtScript variable object

The d-pointer is of type JSVariableObjectData*, but
JSVariableObjectData doesn't have a virtual destructor.
Hence we must cast the d-pointer to our subclass when deleting.

In particular, this will ensure that the destructor of the
symbolTable member is called, which will deallocate the table
storage. (For QScriptActivationObject this did not cause a leak
in practice, because its symbolTable is always empty, and JSC's
hash table uses lazy allocation.)

Task-number: QTBUG-12479
Reviewed-by: Olivier Goffart

2 files changed, 2 insertions, 2 deletions

diff --git a/src/script/bridge/qscriptactivationobject.cpp b/src/script/bridge/qscriptactivationobject.cpp
index 6a8ae56..85224d1 100644
--- a/src/script/bridge/qscriptactivationobject.cpp
+++ b/src/script/bridge/qscriptactivationobject.cpp
@@ -53,7 +53,7 @@ QScriptActivationObject::QScriptActivationObject(JSC::ExecState *callFrame, JSC:
 
 QScriptActivationObject::~QScriptActivationObject()
 {
-    delete d;
+    delete d_ptr();
 }
 
 bool QScriptActivationObject::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
diff --git a/src/script/bridge/qscriptstaticscopeobject.cpp b/src/script/bridge/qscriptstaticscopeobject.cpp
index 44548a4..940c859 100644
--- a/src/script/bridge/qscriptstaticscopeobject.cpp
+++ b/src/script/bridge/qscriptstaticscopeobject.cpp
@@ -87,7 +87,7 @@ QScriptStaticScopeObject::QScriptStaticScopeObject(WTF::NonNullPassRefPtr<JSC::S
 
 QScriptStaticScopeObject::~QScriptStaticScopeObject()
 {
-    delete d;
+    delete d_ptr();
 }
 
 bool QScriptStaticScopeObject::getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)