Fix GC-related crash in QScriptValue::setData()

Yet another missing API shim.
When converting the QScriptValue to JSC, a JSCell may be allocated,
which can cause the GC to trigger.
If an identifier (JSC::Identifier) is then garbage collected, the
destructor will try to remove itself from the currentIdentifierTable().
Because the API shim was missing, the identifier table was 0.
It's difficult to create a bulletproof test for this case, but the
attached test is a best effort (it crashes on my machine without the
fix).

Task-number: QTBUG-15144
Reviewed-by: Jedrzej Nowacki

2 files changed, 14 insertions, 0 deletions

diff --git a/tests/auto/qscriptvalue/tst_qscriptvalue.cpp b/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
index 639df36..53e2699 100644
--- a/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
+++ b/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
@@ -2253,6 +2253,19 @@ void tst_QScriptValue::getSetData()
     QVERIFY(!object.data().isValid());
 }
 
+void tst_QScriptValue::setData_QTBUG15144()
+{
+    QScriptEngine eng;
+    QScriptValue obj = eng.newObject();
+    for (int i = 0; i < 10000; ++i) {
+        // Create an object with property 'fooN' on it, and immediately kill
+        // the reference to the object so it and the property name become garbage.
+        eng.evaluate(QString::fromLatin1("o = {}; o.foo%0 = 10; o = null;").arg(i));
+        // Setting the data will cause a JS string to be allocated, which could
+        // trigger a GC. This should not cause a crash.
+        obj.setData("foodfight");
+    }
+}
 class TestScriptClass : public QScriptClass
 {
 public:
diff --git a/tests/auto/qscriptvalue/tst_qscriptvalue.h b/tests/auto/qscriptvalue/tst_qscriptvalue.h
index 462749a..aa6bc6c 100644
--- a/tests/auto/qscriptvalue/tst_qscriptvalue.h
+++ b/tests/auto/qscriptvalue/tst_qscriptvalue.h
@@ -216,6 +216,7 @@ private slots:
     void getSetProperty();
     void arrayElementGetterSetter();
     void getSetData();
+    void setData_QTBUG15144();
     void getSetScriptClass();
     void call();
     void construct();