QVarLengthArray: fix appending an already-contained item

Like the lvalue QVector::append() overload, when we reallocate,
we need to take a copy of the function's argument because the
reference will get stale upon reallocation.

Add a test.

[ChangeLog][QtCore][QVarLengthArray] Fixed a bug involving
appending an item already in the container to the container
again.

Change-Id: I06eeed6cb383dd5924e47a302bb3d1666d04c8e8
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>

1 files changed, 15 insertions, 5 deletions

diff --git a/src/corelib/tools/qvarlengtharray.h b/src/corelib/tools/qvarlengtharray.h
index bb5ae78d2b..2d3c25a5dd 100644
--- a/src/corelib/tools/qvarlengtharray.h
+++ b/src/corelib/tools/qvarlengtharray.h
@@ -146,15 +146,25 @@ public:
     T value(int i, const T &defaultValue) const;
 
     inline void append(const T &t) {
-        if (s == a)   // i.e. s != 0
+        if (s == a) {   // i.e. s != 0
+            T copy(t);
             realloc(s, s<<1);
-        const int idx = s++;
-        if (QTypeInfo<T>::isComplex) {
-            new (ptr + idx) T(t);
+            const int idx = s++;
+            if (QTypeInfo<T>::isComplex) {
+                new (ptr + idx) T(std::move(copy));
+            } else {
+                ptr[idx] = std::move(copy);
+            }
         } else {
-            ptr[idx] = t;
+            const int idx = s++;
+            if (QTypeInfo<T>::isComplex) {
+                new (ptr + idx) T(t);
+            } else {
+                ptr[idx] = t;
+            }
         }
     }
+
     void append(const T *buf, int size);
     inline QVarLengthArray<T, Prealloc> &operator<<(const T &t)
     { append(t); return *this; }