Fix memory corruption in array handling

SimpleArrayData's markObjects() implementation did not mark the entries
correctly. When the dequeue offset was non-zero, we would end up marking values
that may have been garbage collected earlier.

Task-number: QTBUG-45888
Change-Id: Iacec350ccc76399ad4d16138af50acf22b2809db
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

diff --git a/src/qml/jsruntime/qv4arraydata.cpp b/src/qml/jsruntime/qv4arraydata.cpp
index 737c891f9b4c43f890f0cfb3ae4aba2fa87fb24b..afcfa0090524ba9eab14b62ade33e53eff076635 100644 (file)
--- a/src/qml/jsruntime/qv4arraydata.cpp
+++ b/src/qml/jsruntime/qv4arraydata.cpp
@@ -216,9 +216,8 @@ void ArrayData::ensureAttributes(Object *o)
 void SimpleArrayData::markObjects(Heap::Base *d, ExecutionEngine *e)
 {
     Heap::SimpleArrayData *dd = static_cast<Heap::SimpleArrayData *>(d);
-    uint l = dd->len;
-    for (uint i = 0; i < l; ++i)
-        dd->arrayData[i].mark(e);
+    for (uint i = 0; i < dd->len; ++i)
+        dd->arrayData[dd->mappedIndex(i)].mark(e);
 }
 
 ReturnedValue SimpleArrayData::get(const Heap::ArrayData *d, uint index)