Merge branch 'release' of ssh://codereview.qt-project.org/qt/qtdeclarative into stable

Change-Id: I0bf06be69927d5961f1bdb4948c3572ef6111923

3 files changed, 21 insertions, 3 deletions

diff --git a/src/qml/compiler/qqmlcodegenerator.cpp b/src/qml/compiler/qqmlcodegenerator.cpp
index dcfad00472..c32ad2958d 100644
--- a/src/qml/compiler/qqmlcodegenerator.cpp
+++ b/src/qml/compiler/qqmlcodegenerator.cpp
@@ -1298,7 +1298,7 @@ QVector<int> JSCodeGen::generateJSCodeForFunctionsAndBindings(const QList<AST::N
     return runtimeFunctionIndices;
 }
 
-static QQmlPropertyData *lookupQmlCompliantProperty(QQmlPropertyCache *cache, const QString &name, bool *propertyExistsButForceNameLookup = 0)
+QQmlPropertyData *JSCodeGen::lookupQmlCompliantProperty(QQmlPropertyCache *cache, const QString &name, bool *propertyExistsButForceNameLookup)
 {
     if (propertyExistsButForceNameLookup)
         *propertyExistsButForceNameLookup = false;
@@ -1314,6 +1314,13 @@ static QQmlPropertyData *lookupQmlCompliantProperty(QQmlPropertyCache *cache, co
     if (pd && !cache->isAllowedInRevision(pd))
         pd = 0;
 
+    // Return a copy allocated from our memory pool. Property data pointers can change
+    // otherwise when the QQmlPropertyCache changes later in the QML type compilation process.
+    if (pd) {
+        QQmlPropertyData *copy = pd;
+        pd = _function->New<QQmlPropertyData>();
+        *pd = *copy;
+    }
     return pd;
 }
 
diff --git a/src/qml/compiler/qqmlcodegenerator_p.h b/src/qml/compiler/qqmlcodegenerator_p.h
index 636f2827bb..f16f910078 100644
--- a/src/qml/compiler/qqmlcodegenerator_p.h
+++ b/src/qml/compiler/qqmlcodegenerator_p.h
@@ -369,6 +369,8 @@ protected:
     virtual V4IR::Expr *fallbackNameLookup(const QString &name, int line, int col);
 
 private:
+    QQmlPropertyData *lookupQmlCompliantProperty(QQmlPropertyCache *cache, const QString &name, bool *propertyExistsButForceNameLookup = 0);
+
     QQmlEnginePrivate *engine;
     QString sourceCode;
     QQmlJS::Engine *jsEngine; // needed for memory pool
diff --git a/src/qml/compiler/qv4isel_masm.cpp b/src/qml/compiler/qv4isel_masm.cpp
index 468fef4116..ed57852cd6 100644
--- a/src/qml/compiler/qv4isel_masm.cpp
+++ b/src/qml/compiler/qv4isel_masm.cpp
@@ -1028,10 +1028,13 @@ void InstructionSelection::getElement(V4IR::Expr *base, V4IR::Expr *index, V4IR:
         _as->and32(Assembler::TrustedImm32(QV4::Managed::SimpleArray), Assembler::ReturnValueRegister);
         Assembler::Jump notSimple = _as->branch32(Assembler::Equal, Assembler::ReturnValueRegister, Assembler::TrustedImm32(0));
 
+        bool needNegativeCheck = false;
         Assembler::Jump fallback, fallback2;
         if (tindex->kind == V4IR::Temp::PhysicalRegister) {
             if (tindex->type == V4IR::SInt32Type) {
+                fallback = _as->branch32(Assembler::LessThan, (Assembler::RegisterID)tindex->index, Assembler::TrustedImm32(0));
                 _as->move((Assembler::RegisterID) tindex->index, Assembler::ScratchRegister);
+                needNegativeCheck = true;
             } else {
                 // double, convert and check if it's a int
                 fallback2 = _as->branchTruncateDoubleToUint32((Assembler::FPRegisterID) tindex->index, Assembler::ScratchRegister);
@@ -1057,13 +1060,17 @@ void InstructionSelection::getElement(V4IR::Expr *base, V4IR::Expr *index, V4IR:
 
             isInteger.link(_as);
             _as->or32(Assembler::TrustedImm32(0), Assembler::ScratchRegister);
+            needNegativeCheck = true;
         }
 
         // get data, ScratchRegister holds index
         addr = _as->loadTempAddress(Assembler::ReturnValueRegister, tbase);
         _as->load64(addr, Assembler::ReturnValueRegister);
         Address arrayDataLen(Assembler::ReturnValueRegister, qOffsetOf(Object, arrayDataLen));
-        Assembler::Jump outOfRange = _as->branch32(Assembler::GreaterThanOrEqual, Assembler::ScratchRegister, arrayDataLen);
+        Assembler::Jump outOfRange;
+        if (needNegativeCheck)
+            outOfRange = _as->branch32(Assembler::LessThan, Assembler::ScratchRegister, Assembler::TrustedImm32(0));
+        Assembler::Jump outOfRange2 = _as->branch32(Assembler::GreaterThanOrEqual, Assembler::ScratchRegister, arrayDataLen);
         Address arrayData(Assembler::ReturnValueRegister, qOffsetOf(Object, arrayData));
         _as->load64(arrayData, Assembler::ReturnValueRegister);
         Q_ASSERT(sizeof(Property) == (1<<4));
@@ -1081,7 +1088,9 @@ void InstructionSelection::getElement(V4IR::Expr *base, V4IR::Expr *index, V4IR:
         Assembler::Jump done = _as->jump();
 
         emptyValue.link(_as);
-        outOfRange.link(_as);
+        if (outOfRange.isSet())
+            outOfRange.link(_as);
+        outOfRange2.link(_as);
         if (fallback.isSet())
             fallback.link(_as);
         if (fallback2.isSet())