JSON: When clearing duplicate object entries, also clear containers

Previously, if you had multiple entries with the same name in an object,
and some of them were again objects or arrays, parsing the JSON document
would leak memory.

Also, we use std::stable_sort instead of std::sort now, so that we don't
accidentally randomize the order of elements with equal keys.

[ChangeLog][QtCore][JSON] A memory leak in the JSON parser when reading
objects with duplicate keys was fixed.

Pick-to: 5.15 6.2 6.3
Fixes: QTBUG-99799
Change-Id: Ic2065f2e490c2d3506a356745542148ad9c24262
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>

1 files changed, 19 insertions, 0 deletions

diff --git a/tests/auto/corelib/serialization/json/tst_qtjson.cpp b/tests/auto/corelib/serialization/json/tst_qtjson.cpp
index 57a679dbc9..3a57d3b8a5 100644
--- a/tests/auto/corelib/serialization/json/tst_qtjson.cpp
+++ b/tests/auto/corelib/serialization/json/tst_qtjson.cpp
@@ -175,6 +175,7 @@ private Q_SLOTS:
     void fromToVariantConversions();
 
     void testIteratorComparison();
+    void noLeakOnNameClash();
 
 private:
     QString testDataDir;
@@ -3649,5 +3650,23 @@ void tst_QtJson::testIteratorComparison()
     QVERIFY(t.end() > t.begin());
 }
 
+void tst_QtJson::noLeakOnNameClash()
+{
+    QJsonDocument doc = QJsonDocument::fromJson("{\"\":{\"\":0},\"\":0}");
+    QVERIFY(!doc.isNull());
+    const QJsonObject obj = doc.object();
+
+    // Removed the duplicate key.
+    QCOMPARE(obj.length(), 1);
+
+    // Retained the last of the duplicates.
+    const QJsonValue val = obj.begin().value();
+    QVERIFY(val.isDouble());
+    QCOMPARE(val.toDouble(), 0.0);
+
+    // It should not leak.
+    // In particular it should not forget to deref the container for the inner object.
+}
+
 QTEST_MAIN(tst_QtJson)
 #include "tst_qtjson.moc"