Fix QQmlListModel crash when appending an empty array in debug mode

Calling QQmlListModel::append() with an empty JS array triggers an assert
in QAbstractItemModel::beginInsertRows() because it's called with
negative "last" parameter.

Change-Id: I202da260d79f2e6677c663c5785ff754c715fef8
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

1 files changed, 22 insertions, 0 deletions

diff --git a/tests/auto/qml/qqmllistmodel/tst_qqmllistmodel.cpp b/tests/auto/qml/qqmllistmodel/tst_qqmllistmodel.cpp
index 4618ea4071..9fdc54f067 100644
--- a/tests/auto/qml/qqmllistmodel/tst_qqmllistmodel.cpp
+++ b/tests/auto/qml/qqmllistmodel/tst_qqmllistmodel.cpp
@@ -125,6 +125,7 @@ private slots:
     void bindingsOnGetResult();
     void stringifyModelEntry();
     void qobjectTrackerForDynamicModelObjects();
+    void crash_append_empty_array();
 };
 
 bool tst_qqmllistmodel::compareVariantList(const QVariantList &testList, QVariant object)
@@ -1534,6 +1535,27 @@ void tst_qqmllistmodel::qobjectTrackerForDynamicModelObjects()
     QVERIFY(!ddata->jsWrapper.isNullOrUndefined());
 }
 
+void tst_qqmllistmodel::crash_append_empty_array()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine);
+    component.setData(
+                "import QtQuick 2.0\n"
+                "Item {\n"
+                "   ListModel {\n"
+                "      id: testModel\n"
+                "      objectName: \"testModel\""
+                "   }\n"
+                "}\n", QUrl());
+    QScopedPointer<QObject> scene(component.create());
+    QQmlListModel *model = scene->findChild<QQmlListModel*>("testModel");
+    QSignalSpy spy(model, &QQmlListModel::rowsAboutToBeInserted);
+    QQmlExpression expr(engine.rootContext(), model, "append(new Array())");
+    expr.evaluate();
+    QVERIFY2(!expr.hasError(), QTest::toString(expr.error().toString()));
+    QCOMPARE(spy.count(), 0);
+}
+
 QTEST_MAIN(tst_qqmllistmodel)
 
 #include "tst_qqmllistmodel.moc"