V4: Don't crash when sorting arrays with non-stringifyable entries

Fixes: QTBUG-81108
Change-Id: I7e121776a2416b5338c4c1309ec7cc31c703ad28
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

2 files changed, 18 insertions, 0 deletions

diff --git a/src/qml/jsruntime/qv4arraydata.cpp b/src/qml/jsruntime/qv4arraydata.cpp
index 36a53a7057..1c587d2367 100644
--- a/src/qml/jsruntime/qv4arraydata.cpp
+++ b/src/qml/jsruntime/qv4arraydata.cpp
@@ -659,6 +659,12 @@ bool ArrayElementLessThan::operator()(Value v1, Value v2) const
     }
     ScopedString p1s(scope, v1.toString(scope.engine));
     ScopedString p2s(scope, v2.toString(scope.engine));
+
+    if (!p1s)
+        return false;
+    if (!p2s)
+        return true;
+
     return p1s->toQString() < p2s->toQString();
 }
 
diff --git a/tests/auto/qml/qjsengine/tst_qjsengine.cpp b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
index b9df69d2db..d348881e2e 100644
--- a/tests/auto/qml/qjsengine/tst_qjsengine.cpp
+++ b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
@@ -255,6 +255,7 @@ private slots:
     void arrayConcatOnSparseArray();
     void sortSparseArray();
     void compileBrokenRegexp();
+    void sortNonStringArray();
 
     void tostringRecursionCheck();
     void arrayIncludesWithLargeArray();
@@ -5067,6 +5068,17 @@ void tst_QJSEngine::printCircularArray()
     )js");
 }
 
+void tst_QJSEngine::sortNonStringArray()
+{
+    QJSEngine engine;
+    const auto value = engine.evaluate(
+        "const v4 = [Symbol.iterator, 1];"
+        "const v5 = v4.sort();"
+    );
+    QVERIFY(value.isError());
+    QCOMPARE(value.toString(), "TypeError: Cannot convert a symbol to a string.");
+}
+
 QTEST_MAIN(tst_QJSEngine)
 
 #include "tst_qjsengine.moc"