1 files changed, 21 insertions, 14 deletions
diff --git a/src/script/api/qscriptengine.cpp b/src/script/api/qscriptengine.cpp
index 9f36953..ceb1b03 100644
--- a/src/script/api/qscriptengine.cpp
+++ b/src/script/api/qscriptengine.cpp
@@ -955,8 +955,11 @@ static QScriptValue __setupPackage__(QScriptContext *ctx, QScriptEngine *eng)
 } // namespace QScript
 
 QScriptEnginePrivate::QScriptEnginePrivate()
-    : registeredScriptValues(0), freeScriptValues(0), freeScriptValuesCount(0),
-      registeredScriptStrings(0), inEval(false)
+    : originalGlobalObjectProxy(0), currentFrame(0),
+      qobjectPrototype(0), qmetaobjectPrototype(0), variantPrototype(0),
+      activeAgent(0), agentLineNumber(-1),
+      registeredScriptValues(0), freeScriptValues(0), freeScriptValuesCount(0),
+      registeredScriptStrings(0), processEventsInterval(-1), inEval(false)
 {
     qMetaTypeId<QScriptValue>();
     qMetaTypeId<QList<int> >();
@@ -1002,10 +1005,6 @@ QScriptEnginePrivate::QScriptEnginePrivate()
 
     currentFrame = exec;
 
-    originalGlobalObjectProxy = 0;
-    activeAgent = 0;
-    agentLineNumber = -1;
-    processEventsInterval = -1;
     cachedTranslationUrl = JSC::UString();
     cachedTranslationContext = JSC::UString();
     JSC::setCurrentIdentifierTable(oldTable);
@@ -1253,10 +1252,12 @@ void QScriptEnginePrivate::mark(JSC::MarkStack& markStack)
 {
     Q_Q(QScriptEngine);
 
-    markStack.append(originalGlobalObject());
-    markStack.append(globalObject());
-    if (originalGlobalObjectProxy)
-        markStack.append(originalGlobalObjectProxy);
+    if (originalGlobalObject()) {
+        markStack.append(originalGlobalObject());
+        markStack.append(globalObject());
+        if (originalGlobalObjectProxy)
+            markStack.append(originalGlobalObjectProxy);
+    }
 
     if (qobjectPrototype)
         markStack.append(qobjectPrototype);
@@ -1281,7 +1282,7 @@ void QScriptEnginePrivate::mark(JSC::MarkStack& markStack)
         }
     }
 
-    {
+    if (q) {
         QScriptContext *context = q->currentContext();
 
         while (context) {
@@ -2728,6 +2729,14 @@ JSC::CallFrame *QScriptEnginePrivate::pushContext(JSC::CallFrame *exec, JSC::JSV
                                                   bool clearScopeChain)
 {
     JSC::JSValue thisObject = _thisObject;
+    if (!callee) {
+        // callee can't be zero, as this can cause JSC to crash during GC
+        // marking phase if the context's Arguments object has been created.
+        // Fake it by using the global object. Note that this is also handled
+        // in QScriptContext::callee(), as that function should still return
+        // an invalid value.
+        callee = originalGlobalObject();
+    }
     if (calledAsConstructor) {
         //JSC doesn't create default created object for native functions. so we do it
         JSC::JSValue prototype = callee->get(exec, exec->propertyNames().prototype);
@@ -2763,9 +2772,7 @@ JSC::CallFrame *QScriptEnginePrivate::pushContext(JSC::CallFrame *exec, JSC::JSV
         if (!clearScopeChain) {
             newCallFrame->init(0, /*vPC=*/0, exec->scopeChain(), exec, flags | ShouldRestoreCallFrame, argc, callee);
         } else {
-            JSC::JSObject *jscObject = originalGlobalObject();
-            JSC::ScopeChainNode *scn = new JSC::ScopeChainNode(0, jscObject, &exec->globalData(), exec->lexicalGlobalObject(), jscObject);
-            newCallFrame->init(0, /*vPC=*/0, scn, exec, flags | ShouldRestoreCallFrame, argc, callee);
+            newCallFrame->init(0, /*vPC=*/0, globalExec()->scopeChain(), exec, flags | ShouldRestoreCallFrame, argc, callee);
         }
     } else {
         setContextFlags(newCallFrame, flags);