QML: clear the property cache on QObjectWrapper destuction

If an external QObject is exposed to an engine through a QObjectWrapper,
make sure to deref and clear the propertyCache reference in the object's
declarative data when the QObjectWrapper is destroyed. This makes sure
that there is no dangling propertyCache pointer when the object is
subsequently exposed to another engine.

Task-number: QTBUG-57633
Change-Id: I37f6793d8be65b23b4e81bb4ed91db18271261b0
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

src/qml/jsruntime/qv4qobjectwrapper.cpp

@@ -989,6 +989,10 @@ void QObjectWrapper::destroyObject(bool lastCall)
  // If the object is C++-owned, we still have to release the weak reference we have
  // to it.
  ddata->jsWrapper.clear();
+ if (lastCall && ddata->propertyCache) {
+ ddata->propertyCache->release();
+ ddata->propertyCache = nullptr;
+ }
  }
  }
  }

tests/auto/qml/qjsengine/tst_qjsengine.cpp

@@ -29,6 +29,7 @@
 
 #include <QtTest/QtTest>
 
+#include <private/qqmldata_p.h>
 #include <qjsengine.h>
 #include <qjsvalueiterator.h>
 #include <qgraphicsitem.h>
@@ -73,6 +74,7 @@ private slots:
  void newQObject();
  void newQObject_ownership();
  void newQObject_deletedEngine();
+ void newQObjectPropertyCache();
  void newQMetaObject();
  void exceptionInSlot();
  void globalObjectProperties();
@@ -757,6 +759,19 @@ class TestQMetaObject : public QObject {
  int m_called;
 };
 
+void tst_QJSEngine::newQObjectPropertyCache()
+{
+ QScopedPointer<QObject> obj(new QObject);
+ QQmlEngine::setObjectOwnership(obj.data(), QQmlEngine::CppOwnership);
+
+ {
+ QJSEngine engine;
+ engine.newQObject(obj.data());
+ QVERIFY(QQmlData::get(obj.data())->propertyCache);
+ }
+ QVERIFY(!QQmlData::get(obj.data())->propertyCache);
+}
+
 void tst_QJSEngine::newQMetaObject() {
  {
  QJSEngine engine;