V4: Fix sorting of sparse arrays

setArrayData() needs to handle a nullptr argument.

Change-Id: I1ea05d9db9beb1fede6d3c068cfcf700702e8aa6
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

2 files changed, 22 insertions, 1 deletions

diff --git a/src/qml/jsruntime/qv4object_p.h b/src/qml/jsruntime/qv4object_p.h
index f3375929a3..9e901d6a34 100644
--- a/src/qml/jsruntime/qv4object_p.h
+++ b/src/qml/jsruntime/qv4object_p.h
@@ -157,7 +157,7 @@ struct Q_QML_EXPORT Object: Managed {
     const Value *propertyData(uint index) const { return d()->propertyData(index); }
 
     Heap::ArrayData *arrayData() const { return d()->arrayData; }
-    void setArrayData(ArrayData *a) { d()->arrayData.set(engine(), a->d()); }
+    void setArrayData(ArrayData *a) { d()->arrayData.set(engine(), a ? a->d() : nullptr); }
 
     void getProperty(const InternalClassEntry &entry, Property *p) const;
     void setProperty(const InternalClassEntry &entry, const Property *p);
diff --git a/tests/auto/qml/qjsengine/tst_qjsengine.cpp b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
index 59319bead2..9f697e5a74 100644
--- a/tests/auto/qml/qjsengine/tst_qjsengine.cpp
+++ b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
@@ -253,6 +253,7 @@ private slots:
 
     void triggerBackwardJumpWithDestructuring();
     void arrayConcatOnSparseArray();
+    void sortSparseArray();
 
 public:
     Q_INVOKABLE QJSValue throwingCppMethod1();
@@ -4982,6 +4983,26 @@ void tst_QJSEngine::arrayConcatOnSparseArray()
         QVERIFY(value.property(i).isUndefined());
 }
 
+void tst_QJSEngine::sortSparseArray()
+{
+    QJSEngine engine;
+    engine.installExtensions(QJSEngine::ConsoleExtension);
+    const auto value = engine.evaluate(
+            "(function() {\n"
+            "   var sparse = [0];\n"
+            "   sparse = Object.defineProperty(sparse, \"10\", "
+            "           {get: ()=>{return 2}, set: ()=>{return 2}} );\n"
+            "   return Array.prototype.sort.call(sparse, ()=>{});\n"
+            "})();");
+
+    QCOMPARE(value.property("length").toInt(), 11);
+    QVERIFY(value.property(0).isNumber());
+    QCOMPARE(value.property(0).toInt(), 0);
+    QVERIFY(value.property(1).isNumber());
+    QCOMPARE(value.property(1).toInt(), 2);
+    QVERIFY(value.property(10).isUndefined());
+}
+
 QTEST_MAIN(tst_QJSEngine)
 
 #include "tst_qjsengine.moc"