Merge remote-tracking branch 'origin/5.7' into dev

Conflicts:
	src/qml/jsapi/qjsengine.cpp
	src/qml/qml/qqmlengine_p.h
	src/quick/items/qquickanchors.cpp
	src/quick/items/qquickanimatedimage_p_p.h
	src/quick/items/qquickitem_p.h
	tests/auto/qml/qqmlecmascript/testtypes.h
	tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
	tests/benchmarks/qml/creation/tst_creation.cpp

Change-Id: I65861e32f16e8a04c7090a90231627e1ebf6ba6f

1 files changed, 7 insertions, 1 deletions

diff --git a/src/qml/jsruntime/qv4arraydata.cpp b/src/qml/jsruntime/qv4arraydata.cpp
index 73aa7047b8..4c4639c94f 100644
--- a/src/qml/jsruntime/qv4arraydata.cpp
+++ b/src/qml/jsruntime/qv4arraydata.cpp
@@ -287,7 +287,13 @@ void SimpleArrayData::push_front(Object *o, const Value *values, uint n)
         Q_ASSERT(o->d()->arrayData->type == Heap::ArrayData::Simple);
         dd = o->d()->arrayData.cast<Heap::SimpleArrayData>();
     }
-    dd->offset = (dd->offset - n) % dd->alloc;
+    if (n <= dd->offset) {
+        dd->offset -= n; // there is enough space left in front
+    } else {
+         // we need to wrap around, so:
+        dd->offset = dd->alloc - // start at the back, but subtract:
+                (n - dd->offset); // the number of items we can put in the free space at the start of the allocated array
+    }
     dd->len += n;
     for (uint i = 0; i < n; ++i)
         dd->data(i) = values[i].asReturnedValue();