Fix interaction between head room and appending in arrays

We reserve space on both ends of the JS array for appending
and prepending. Make sure they interact well with each other
and don't cause any memory corruption.

Task-number: QTBUG-34853
Change-Id: I184280178690e3cb12ab9b199a8436b32383af38
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 95f03d2c5b..7c1eb7d54b 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -307,6 +307,7 @@ private slots:
     void updateCall();
     void numberParsing();
     void stringParsing();
+    void push_and_shift();
     void qtbug_32801();
     void thisObject();
     void qtbug_33754();
@@ -7318,6 +7319,18 @@ void tst_qqmlecmascript::stringParsing()
     }
 }
 
+void tst_qqmlecmascript::push_and_shift()
+{
+    QJSEngine e;
+    const QString program =
+            "var array = []; "
+            "for (var i = 0; i < 10000; i++) {"
+            "    array.push(5); array.unshift(5); array.push(5);"
+            "}"
+            "array.length;";
+    QVERIFY(e.evaluate(program).toNumber() == 30000);
+}
+
 void tst_qqmlecmascript::qtbug_32801()
 {
     QQmlComponent component(&engine, testFileUrl("qtbug_32801.qml"));