Merge remote-tracking branch 'origin/5.7' into dev

Conflicts:
	config_help.txt
	configure
	src/corelib/io/qprocess_wince.cpp
	src/plugins/platforms/windows/qwindowstheme.cpp
	src/plugins/platforms/xcb/qxcbbackingstore.cpp
	tests/auto/corelib/tools/qtimezone/BLACKLIST
	tests/auto/network/socket/qudpsocket/tst_qudpsocket.cpp
	tests/auto/widgets/kernel/qwidget/tst_qwidget.cpp

Change-Id: I26644d1cb3b78412c8ff285e2a55bea1bd641c01

17 files changed, 121 insertions, 116 deletions

diff --git a/src/corelib/tools/qarraydata.cpp b/src/corelib/tools/qarraydata.cpp
index 21ad799e25..bf336a8f31 100644
--- a/src/corelib/tools/qarraydata.cpp
+++ b/src/corelib/tools/qarraydata.cpp
@@ -38,6 +38,7 @@
 ****************************************************************************/
 
 #include <QtCore/qarraydata.h>
+#include <QtCore/private/qnumeric_p.h>
 #include <QtCore/private/qtools_p.h>
 
 #include <stdlib.h>
@@ -93,16 +94,22 @@ QArrayData *QArrayData::allocate(size_t objectSize, size_t alignment,
         if (capacity > std::numeric_limits<size_t>::max() / objectSize)
             return 0;
 
-        size_t alloc = objectSize * capacity;
+        size_t alloc;
+        if (mul_overflow(objectSize, capacity, &alloc))
+            return 0;
 
-        // Make sure qAllocMore won't overflow.
+        // Make sure qAllocMore won't overflow qAllocMore.
         if (headerSize > size_t(MaxAllocSize) || alloc > size_t(MaxAllocSize) - headerSize)
             return 0;
 
         capacity = qAllocMore(int(alloc), int(headerSize)) / int(objectSize);
     }
 
-    size_t allocSize = headerSize + objectSize * capacity;
+    size_t allocSize;
+    if (mul_overflow(objectSize, capacity, &allocSize))
+        return 0;
+    if (add_overflow(allocSize, headerSize, &allocSize))
+        return 0;
 
     QArrayData *header = static_cast<QArrayData *>(::malloc(allocSize));
     if (header) {
diff --git a/src/corelib/tools/qdatetime.cpp b/src/corelib/tools/qdatetime.cpp
index 6aae979835..a223aa1490 100644
--- a/src/corelib/tools/qdatetime.cpp
+++ b/src/corelib/tools/qdatetime.cpp
@@ -4565,7 +4565,7 @@ QDateTime QDateTime::fromString(const QString &string, const QString &format)
     Q_UNUSED(string);
     Q_UNUSED(format);
 #endif
-    return QDateTime(QDate(), QTime(-1, -1, -1));
+    return QDateTime();
 }
 
 #endif // QT_NO_DATESTRING
diff --git a/src/corelib/tools/qdatetimeparser.cpp b/src/corelib/tools/qdatetimeparser.cpp
index c1abdf11a7..8ddf1d9e41 100644
--- a/src/corelib/tools/qdatetimeparser.cpp
+++ b/src/corelib/tools/qdatetimeparser.cpp
@@ -313,7 +313,7 @@ int QDateTimeParser::sectionPos(const SectionNode &sn) const
 
 */
 
-static QString unquote(const QString &str)
+static QString unquote(const QStringRef &str)
 {
     const QChar quote(QLatin1Char('\''));
     const QChar slash(QLatin1Char('\\'));
@@ -357,10 +357,8 @@ static inline int countRepeat(const QString &str, int index, int maxCount)
 
 static inline void appendSeparator(QStringList *list, const QString &string, int from, int size, int lastQuote)
 {
-    QString str(string.mid(from, size));
-    if (lastQuote >= from)
-        str = unquote(str);
-    list->append(str);
+    const QStringRef separator = string.midRef(from, size);
+    list->append(lastQuote >= from ? unquote(separator) : separator.toString());
 }
 
 
@@ -471,7 +469,7 @@ bool QDateTimeParser::parseFormat(const QString &newFormat)
                 if (parserType != QVariant::Time) {
                     const SectionNode sn = { MonthSection, i - add, countRepeat(newFormat, i, 4), 0 };
                     newSectionNodes.append(sn);
-                    newSeparators.append(unquote(newFormat.mid(index, i - index)));
+                    newSeparators.append(unquote(newFormat.midRef(index, i - index)));
                     i += sn.count - 1;
                     index = i + 1;
                     newDisplay |= MonthSection;
@@ -553,19 +551,20 @@ int QDateTimeParser::sectionSize(int sectionIndex) const
         // is the previous value and displayText() is the new value.
         // The size difference is always due to leading zeroes.
         int sizeAdjustment = 0;
-        if (displayText().size() != text.size()) {
+        const int displayTextSize = displayText().size();
+        if (displayTextSize != text.size()) {
             // Any zeroes added before this section will affect our size.
             int preceedingZeroesAdded = 0;
             if (sectionNodes.size() > 1 && context == DateTimeEdit) {
-                for (QVector<SectionNode>::ConstIterator sectionIt = sectionNodes.constBegin();
-                    sectionIt != sectionNodes.constBegin() + sectionIndex; ++sectionIt) {
+                const auto begin = sectionNodes.cbegin();
+                const auto end = begin + sectionIndex;
+                for (auto sectionIt = begin; sectionIt != end; ++sectionIt)
                     preceedingZeroesAdded += sectionIt->zeroesAdded;
-                }
             }
             sizeAdjustment = preceedingZeroesAdded;
         }
 
-        return displayText().size() + sizeAdjustment - sectionPos(sectionIndex) - separators.last().size();
+        return displayTextSize + sizeAdjustment - sectionPos(sectionIndex) - separators.last().size();
     } else {
         return sectionPos(sectionIndex + 1) - sectionPos(sectionIndex)
             - separators.at(sectionIndex + 1).size();
@@ -847,7 +846,7 @@ int QDateTimeParser::parseSection(const QDateTime &currentValue, int sectionInde
                     if (skipToNextSection(sectionIndex, currentValue, digitsStr)) {
                         state = Acceptable;
                         const int missingZeroes = sectionmaxsize - digitsStr.size();
-                        text.insert(index, QString().fill(QLatin1Char('0'), missingZeroes));
+                        text.insert(index, QString(missingZeroes, QLatin1Char('0')));
                         used = sectionmaxsize;
                         cursorPosition += missingZeroes;
                         ++(const_cast<QDateTimeParser*>(this)->sectionNodes[sectionIndex].zeroesAdded);
@@ -1164,11 +1163,12 @@ end:
                             if (newCurrentValue.daysTo(minimum) != 0) {
                                 break;
                             }
-                            toMin = newCurrentValue.time().msecsTo(minimum.time());
+                            const QTime time = newCurrentValue.time();
+                            toMin = time.msecsTo(minimum.time());
                             if (newCurrentValue.daysTo(maximum) > 0) {
                                 toMax = -1; // can't get to max
                             } else {
-                                toMax = newCurrentValue.time().msecsTo(maximum.time());
+                                toMax = time.msecsTo(maximum.time());
                             }
                         } else {
                             toMin = newCurrentValue.daysTo(minimum);
@@ -1555,10 +1555,7 @@ QString QDateTimeParser::SectionNode::format() const
         qWarning("QDateTimeParser::sectionFormat Internal error 2");
         return QString();
     }
-
-    QString str;
-    str.fill(fillChar, count);
-    return str;
+    return QString(count, fillChar);
 }
 
 
diff --git a/src/corelib/tools/qelapsedtimer_unix.cpp b/src/corelib/tools/qelapsedtimer_unix.cpp
index 1e672531c8..e1fc77fb4c 100644
--- a/src/corelib/tools/qelapsedtimer_unix.cpp
+++ b/src/corelib/tools/qelapsedtimer_unix.cpp
@@ -115,7 +115,11 @@ static inline void qt_clock_gettime(clockid_t clock, struct timespec *ts)
 
 static int unixCheckClockType()
 {
-#if (_POSIX_MONOTONIC_CLOCK-0 == 0) && defined(_SC_MONOTONIC_CLOCK)
+#ifdef Q_OS_LINUX
+    // Despite glibc claiming that we should check at runtime, the Linux kernel
+    // always supports the monotonic clock
+    return CLOCK_MONOTONIC;
+#elif (_POSIX_MONOTONIC_CLOCK-0 == 0) && defined(_SC_MONOTONIC_CLOCK)
     // we need a value we can store in a clockid_t that isn't a valid clock
     // check if the valid ones are both non-negative or both non-positive
 #  if CLOCK_MONOTONIC >= 0 && CLOCK_REALTIME >= 0
diff --git a/src/corelib/tools/qharfbuzz_p.h b/src/corelib/tools/qharfbuzz_p.h
index 3b69a2e4f6..cc4d9bbd85 100644
--- a/src/corelib/tools/qharfbuzz_p.h
+++ b/src/corelib/tools/qharfbuzz_p.h
@@ -348,6 +348,7 @@ Q_CORE_EXPORT HB_Face qHBLoadFace(HB_Face face);
 
 Q_DECLARE_TYPEINFO(HB_GlyphAttributes, Q_PRIMITIVE_TYPE);
 Q_DECLARE_TYPEINFO(HB_FixedPoint, Q_PRIMITIVE_TYPE);
+Q_DECLARE_TYPEINFO(HB_ScriptItem, Q_PRIMITIVE_TYPE);
 
 QT_END_NAMESPACE
 
diff --git a/src/corelib/tools/qhash.h b/src/corelib/tools/qhash.h
index 5e3016d313..b15dc7b07b 100644
--- a/src/corelib/tools/qhash.h
+++ b/src/corelib/tools/qhash.h
@@ -554,11 +554,15 @@ QHash<Key, T>::createNode(uint ah, const Key &akey, const T &avalue, Node **anex
 template <class Key, class T>
 Q_INLINE_TEMPLATE QHash<Key, T> &QHash<Key, T>::unite(const QHash &other)
 {
-    QHash copy(other);
-    const_iterator it = copy.constEnd();
-    while (it != copy.constBegin()) {
-        --it;
-        insertMulti(it.key(), it.value());
+    if (d == &QHashData::shared_null) {
+        *this = other;
+    } else {
+        QHash copy(other);
+        const_iterator it = copy.constEnd();
+        while (it != copy.constBegin()) {
+            --it;
+            insertMulti(it.key(), it.value());
+        }
     }
     return *this;
 }
diff --git a/src/corelib/tools/qlist.h b/src/corelib/tools/qlist.h
index 8149238a50..81f8f8ec05 100644
--- a/src/corelib/tools/qlist.h
+++ b/src/corelib/tools/qlist.h
@@ -855,7 +855,7 @@ inline bool QList<T>::op_eq_impl(const QList &l, QListData::ArrayCompatibleLayou
     const T *lb = reinterpret_cast<const T*>(l.p.begin());
     const T *b  = reinterpret_cast<const T*>(p.begin());
     const T *e  = reinterpret_cast<const T*>(p.end());
-    return std::equal(b, e, lb);
+    return std::equal(b, e, QT_MAKE_CHECKED_ARRAY_ITERATOR(lb, l.p.size()));
 }
 
 template <typename T>
diff --git a/src/corelib/tools/qlocale.cpp b/src/corelib/tools/qlocale.cpp
index 52f82827f2..7809c513d6 100644
--- a/src/corelib/tools/qlocale.cpp
+++ b/src/corelib/tools/qlocale.cpp
@@ -54,7 +54,6 @@
 #include "qlocale.h"
 #include "qlocale_p.h"
 #include "qlocale_tools_p.h"
-#include "qdatetime_p.h"
 #include "qdatetimeparser_p.h"
 #include "qnamespace.h"
 #include "qdatetime.h"
diff --git a/src/corelib/tools/qmap.h b/src/corelib/tools/qmap.h
index 9801878bdc..f84d733db0 100644
--- a/src/corelib/tools/qmap.h
+++ b/src/corelib/tools/qmap.h
@@ -640,6 +640,8 @@ Q_INLINE_TEMPLATE void QMap<Key, T>::clear()
     *this = QMap<Key, T>();
 }
 
+QT_WARNING_PUSH
+QT_WARNING_DISABLE_CLANG("-Wreturn-stack-address")
 
 template <class Key, class T>
 Q_INLINE_TEMPLATE const T QMap<Key, T>::value(const Key &akey, const T &adefaultValue) const
@@ -648,6 +650,8 @@ Q_INLINE_TEMPLATE const T QMap<Key, T>::value(const Key &akey, const T &adefault
     return n ? n->value : adefaultValue;
 }
 
+QT_WARNING_POP
+
 template <class Key, class T>
 Q_INLINE_TEMPLATE const T QMap<Key, T>::operator[](const Key &akey) const
 {
diff --git a/src/corelib/tools/qscopedpointer.h b/src/corelib/tools/qscopedpointer.h
index d98b914757..3e6af97a33 100644
--- a/src/corelib/tools/qscopedpointer.h
+++ b/src/corelib/tools/qscopedpointer.h
@@ -162,7 +162,7 @@ public:
         return oldD;
     }
 
-    inline void swap(QScopedPointer<T, Cleanup> &other)
+    void swap(QScopedPointer<T, Cleanup> &other) Q_DECL_NOTHROW
     {
         qSwap(d, other.d);
     }
@@ -189,18 +189,9 @@ inline bool operator!=(const QScopedPointer<T, Cleanup> &lhs, const QScopedPoint
 }
 
 template <class T, class Cleanup>
-Q_INLINE_TEMPLATE void qSwap(QScopedPointer<T, Cleanup> &p1, QScopedPointer<T, Cleanup> &p2)
+inline void swap(QScopedPointer<T, Cleanup> &p1, QScopedPointer<T, Cleanup> &p2) Q_DECL_NOTHROW
 { p1.swap(p2); }
 
-QT_END_NAMESPACE
-namespace std {
-    template <class T, class Cleanup>
-    Q_INLINE_TEMPLATE void swap(QT_PREPEND_NAMESPACE(QScopedPointer)<T, Cleanup> &p1, QT_PREPEND_NAMESPACE(QScopedPointer)<T, Cleanup> &p2)
-    { p1.swap(p2); }
-}
-QT_BEGIN_NAMESPACE
-
-
 
 namespace QtPrivate {
     template <typename X, typename Y> struct QScopedArrayEnsureSameType;
@@ -230,6 +221,9 @@ public:
         return this->d[i];
     }
 
+    void swap(QScopedArrayPointer &other) Q_DECL_NOTHROW // prevent QScopedPointer <->QScopedArrayPointer swaps
+    { QScopedPointer<T, Cleanup>::swap(other); }
+
 private:
     explicit inline QScopedArrayPointer(void *) {
         // Enforce the same type.
@@ -245,6 +239,10 @@ private:
     Q_DISABLE_COPY(QScopedArrayPointer)
 };
 
+template <typename T, typename Cleanup>
+inline void swap(QScopedArrayPointer<T, Cleanup> &lhs, QScopedArrayPointer<T, Cleanup> &rhs) Q_DECL_NOTHROW
+{ lhs.swap(rhs); }
+
 QT_END_NAMESPACE
 
 #endif // QSCOPEDPOINTER_H
diff --git a/src/corelib/tools/qstring.cpp b/src/corelib/tools/qstring.cpp
index 27d85c6460..21f3e34c6f 100644
--- a/src/corelib/tools/qstring.cpp
+++ b/src/corelib/tools/qstring.cpp
@@ -709,8 +709,8 @@ static int findChar(const QChar *str, int len, QChar ch, int from,
 }
 
 #define REHASH(a) \
-    if (sl_minus_1 < (int)sizeof(int) * CHAR_BIT)       \
-        hashHaystack -= (a) << sl_minus_1; \
+    if (sl_minus_1 < sizeof(uint) * CHAR_BIT)  \
+        hashHaystack -= uint(a) << sl_minus_1; \
     hashHaystack <<= 1
 
 inline bool qIsUpper(char ch)
@@ -3093,8 +3093,9 @@ int qFindString(
     const ushort *needle = (const ushort *)needle0;
     const ushort *haystack = (const ushort *)haystack0 + from;
     const ushort *end = (const ushort *)haystack0 + (l-sl);
-    const int sl_minus_1 = sl-1;
-    int hashNeedle = 0, hashHaystack = 0, idx;
+    const uint sl_minus_1 = sl - 1;
+    uint hashNeedle = 0, hashHaystack = 0;
+    int idx;
 
     if (cs == Qt::CaseSensitive) {
         for (idx = 0; idx < sl; ++idx) {
@@ -3169,10 +3170,11 @@ static int lastIndexOfHelper(const ushort *haystack, int from, const ushort *nee
 
     const ushort *end = haystack;
     haystack += from;
-    const int sl_minus_1 = sl-1;
+    const uint sl_minus_1 = sl - 1;
     const ushort *n = needle+sl_minus_1;
     const ushort *h = haystack+sl_minus_1;
-    int hashNeedle = 0, hashHaystack = 0, idx;
+    uint hashNeedle = 0, hashHaystack = 0;
+    int idx;
 
     if (cs == Qt::CaseSensitive) {
         for (idx = 0; idx < sl; ++idx) {
@@ -10127,6 +10129,9 @@ static inline int qt_find_latin1_string(const QChar *haystack, int size,
                                         QLatin1String needle,
                                         int from, Qt::CaseSensitivity cs)
 {
+    if (size < needle.size())
+        return -1;
+
     const char *latin1 = needle.latin1();
     int len = needle.size();
     QVarLengthArray<ushort> s(len);
diff --git a/src/corelib/tools/qtimezone.cpp b/src/corelib/tools/qtimezone.cpp
index 3c7417d64e..63a21ec75c 100644
--- a/src/corelib/tools/qtimezone.cpp
+++ b/src/corelib/tools/qtimezone.cpp
@@ -325,7 +325,7 @@ Q_GLOBAL_STATIC(QTimeZoneSingleton, global_tz);
     Create a null/invalid time zone instance.
 */
 
-QTimeZone::QTimeZone()
+QTimeZone::QTimeZone() Q_DECL_NOTHROW
     : d(0)
 {
 }
diff --git a/src/corelib/tools/qtimezone.h b/src/corelib/tools/qtimezone.h
index b5957150f9..db99f07f44 100644
--- a/src/corelib/tools/qtimezone.h
+++ b/src/corelib/tools/qtimezone.h
@@ -74,7 +74,7 @@ public:
     };
     typedef QVector<OffsetData> OffsetDataList;
 
-    QTimeZone();
+    QTimeZone() Q_DECL_NOTHROW;
     explicit QTimeZone(const QByteArray &ianaId);
     explicit QTimeZone(int offsetSeconds);
     /*implicit*/ QTimeZone(const QByteArray &zoneId, int offsetSeconds, const QString &name,
diff --git a/src/corelib/tools/qunicodetools.cpp b/src/corelib/tools/qunicodetools.cpp
index 52e7b5a53f..fad4267edc 100644
--- a/src/corelib/tools/qunicodetools.cpp
+++ b/src/corelib/tools/qunicodetools.cpp
@@ -685,10 +685,10 @@ Q_CORE_EXPORT void initCharAttributes(const ushort *string, int length,
 Q_CORE_EXPORT void initScripts(const ushort *string, int length, uchar *scripts)
 {
     int sor = 0;
-    int eor = -1;
+    int eor = 0;
     uchar script = QChar::Script_Common;
-    for (int i = 0; i < length; ++i) {
-        eor = i;
+
+    for (int i = 0; i < length; ++i, eor = i) {
         uint ucs4 = string[i];
         if (QChar::isHighSurrogate(ucs4) && i + 1 < length) {
             ushort low = string[i + 1];
@@ -700,60 +700,37 @@ Q_CORE_EXPORT void initScripts(const ushort *string, int length, uchar *scripts)
 
         const QUnicodeTables::Properties *prop = QUnicodeTables::properties(ucs4);
 
-        if (Q_LIKELY(prop->script == script || prop->script <= QChar::Script_Inherited))
+        uchar nscript = prop->script;
+
+        if (Q_LIKELY(nscript == script || nscript <= QChar::Script_Common))
             continue;
 
+        // inherit preceding Common-s
+        if (Q_UNLIKELY(script <= QChar::Script_Common)) {
+            // also covers a case where the base character of Common script followed
+            // by one or more combining marks of non-Inherited, non-Common script
+            script = nscript;
+            continue;
+        }
+
         // Never break between a combining mark (gc= Mc, Mn or Me) and its base character.
         // Thus, a combining mark — whatever its script property value is — should inherit
         // the script property value of its base character.
         static const int test = (FLAG(QChar::Mark_NonSpacing) | FLAG(QChar::Mark_SpacingCombining) | FLAG(QChar::Mark_Enclosing));
-        if (Q_UNLIKELY(FLAG(prop->category) & test)) {
-            // In cases where the base character itself has the Common script property value,
-            // and it is followed by one or more combining marks with a specific script property value,
-            // it may be even better for processing to let the base acquire the script property value
-            // from the first mark. This approach can be generalized by treating all the characters
-            // of a combining character sequence as having the script property value
-            // of the first non-Inherited, non-Common character in the sequence if there is one,
-            // and otherwise treating all the characters as having the Common script property value.
-            if (Q_LIKELY(script > QChar::Script_Common || prop->script <= QChar::Script_Common))
-                continue;
-
-            script = QChar::Script(prop->script);
-        }
-
-#if 0 // ### Disabled due to regressions. The font selection algorithm is not prepared for this change.
-        if (Q_LIKELY(script != QChar::Script_Common)) {
-            // override preceding Common-s
-            while (sor > 0 && scripts[sor - 1] == QChar::Script_Common)
-                --sor;
-        } else {
-            // see if we are inheriting preceding run
-            if (sor > 0)
-                script = scripts[sor - 1];
-        }
-#endif
+        if (Q_UNLIKELY(FLAG(prop->category) & test))
+            continue;
 
-        while (sor < eor)
-            scripts[sor++] = script;
+        Q_ASSERT(script > QChar::Script_Common);
+        Q_ASSERT(sor < eor);
+        ::memset(scripts + sor, script, (eor - sor) * sizeof(uchar));
+        sor = eor;
 
-        script = prop->script;
-    }
-    eor = length;
-
-#if 0 // ### Disabled due to regressions. The font selection algorithm is not prepared for this change.
-    if (Q_LIKELY(script != QChar::Script_Common)) {
-        // override preceding Common-s
-        while (sor > 0 && scripts[sor - 1] == QChar::Script_Common)
-            --sor;
-    } else {
-        // see if we are inheriting preceding run
-        if (sor > 0)
-            script = scripts[sor - 1];
+        script = nscript;
     }
-#endif
 
-    while (sor < eor)
-        scripts[sor++] = script;
+    Q_ASSERT(script >= QChar::Script_Common);
+    Q_ASSERT(eor == length);
+    ::memset(scripts + sor, script, (eor - sor) * sizeof(uchar));
 }
 
 } // namespace QUnicodeTools
diff --git a/src/corelib/tools/qunicodetools_p.h b/src/corelib/tools/qunicodetools_p.h
index 1103f28452..5cde188656 100644
--- a/src/corelib/tools/qunicodetools_p.h
+++ b/src/corelib/tools/qunicodetools_p.h
@@ -77,6 +77,10 @@ struct ScriptItem
     int script;
 };
 
+} // namespace QUnicodeTools
+Q_DECLARE_TYPEINFO(QUnicodeTools::ScriptItem, Q_PRIMITIVE_TYPE);
+namespace QUnicodeTools {
+
 enum CharAttributeOption {
     GraphemeBreaks = 0x01,
     WordBreaks = 0x02,
diff --git a/src/corelib/tools/qvarlengtharray.h b/src/corelib/tools/qvarlengtharray.h
index 24574dc90b..c3ac104399 100644
--- a/src/corelib/tools/qvarlengtharray.h
+++ b/src/corelib/tools/qvarlengtharray.h
@@ -102,7 +102,8 @@ public:
     QVarLengthArray<T, Prealloc> &operator=(std::initializer_list<T> list)
     {
         resize(list.size());
-        std::copy(list.begin(), list.end(), this->begin());
+        std::copy(list.begin(), list.end(),
+                  QT_MAKE_CHECKED_ARRAY_ITERATOR(this->begin(), this->size()));
         return *this;
     }
 #endif
@@ -473,7 +474,7 @@ Q_OUTOFLINE_TEMPLATE typename QVarLengthArray<T, Prealloc>::iterator QVarLengthA
     int l = int(aend - ptr);
     int n = l - f;
     if (QTypeInfo<T>::isComplex) {
-        std::copy(ptr + l, ptr + s, ptr + f);
+        std::copy(ptr + l, ptr + s, QT_MAKE_CHECKED_ARRAY_ITERATOR(ptr + f, s - f));
         T *i = ptr + s;
         T *b = ptr + s - n;
         while (i != b) {
@@ -495,7 +496,7 @@ bool operator==(const QVarLengthArray<T, Prealloc1> &l, const QVarLengthArray<T,
     const T *rb = r.begin();
     const T *b  = l.begin();
     const T *e  = l.end();
-    return std::equal(b, e, rb);
+    return std::equal(b, e, QT_MAKE_CHECKED_ARRAY_ITERATOR(rb, r.size()));
 }
 
 template <typename T, int Prealloc1, int Prealloc2>
diff --git a/src/corelib/tools/qvector.h b/src/corelib/tools/qvector.h
index 13ae121450..557bec9676 100644
--- a/src/corelib/tools/qvector.h
+++ b/src/corelib/tools/qvector.h
@@ -773,7 +773,7 @@ bool QVector<T>::operator==(const QVector<T> &v) const
     const T *vb = v.d->begin();
     const T *b  = d->begin();
     const T *e  = d->end();
-    return std::equal(b, e, vb);
+    return std::equal(b, e, QT_MAKE_CHECKED_ARRAY_ITERATOR(vb, v.d->size));
 }
 
 template <typename T>
@@ -793,24 +793,28 @@ QVector<T> &QVector<T>::fill(const T &from, int asize)
 template <typename T>
 QVector<T> &QVector<T>::operator+=(const QVector &l)
 {
-    uint newSize = d->size + l.d->size;
-    const bool isTooSmall = newSize > d->alloc;
-    if (!isDetached() || isTooSmall) {
-        QArrayData::AllocationOptions opt(isTooSmall ? QArrayData::Grow : QArrayData::Default);
-        reallocData(d->size, isTooSmall ? newSize : d->alloc, opt);
-    }
+    if (d == Data::sharedNull()) {
+        *this = l;
+    } else {
+        uint newSize = d->size + l.d->size;
+        const bool isTooSmall = newSize > d->alloc;
+        if (!isDetached() || isTooSmall) {
+            QArrayData::AllocationOptions opt(isTooSmall ? QArrayData::Grow : QArrayData::Default);
+            reallocData(d->size, isTooSmall ? newSize : d->alloc, opt);
+        }
 
-    if (d->alloc) {
-        T *w = d->begin() + newSize;
-        T *i = l.d->end();
-        T *b = l.d->begin();
-        while (i != b) {
-            if (QTypeInfo<T>::isComplex)
-                new (--w) T(*--i);
-            else
-                *--w = *--i;
+        if (d->alloc) {
+            T *w = d->begin() + newSize;
+            T *i = l.d->end();
+            T *b = l.d->begin();
+            while (i != b) {
+                if (QTypeInfo<T>::isComplex)
+                    new (--w) T(*--i);
+                else
+                    *--w = *--i;
+            }
+            d->size = newSize;
         }
-        d->size = newSize;
     }
     return *this;
 }