diff options
-rw-r--r-- | src/qml/jsruntime/qv4runtime.cpp | 2 | ||||
-rw-r--r-- | tests/auto/qml/qjsengine/tst_qjsengine.cpp | 10 |
2 files changed, 11 insertions, 1 deletions
diff --git a/src/qml/jsruntime/qv4runtime.cpp b/src/qml/jsruntime/qv4runtime.cpp index 0211ad1011..9729228511 100644 --- a/src/qml/jsruntime/qv4runtime.cpp +++ b/src/qml/jsruntime/qv4runtime.cpp @@ -1408,7 +1408,7 @@ ReturnedValue Runtime::method_mod(const Value &left, const Value &right) { TRACE2(left, right); - if (Value::integerCompatible(left, right) && right.integerValue() != 0) { + if (Value::integerCompatible(left, right) && left.integerValue() > 0 && right.integerValue() > 0) { int intRes = left.integerValue() % right.integerValue(); if (intRes != 0 || left.integerValue() >= 0) return Encode(intRes); diff --git a/tests/auto/qml/qjsengine/tst_qjsengine.cpp b/tests/auto/qml/qjsengine/tst_qjsengine.cpp index c3a3926144..bb923951a8 100644 --- a/tests/auto/qml/qjsengine/tst_qjsengine.cpp +++ b/tests/auto/qml/qjsengine/tst_qjsengine.cpp @@ -201,6 +201,7 @@ private slots: void basicBlockMergeAfterLoopPeeling(); + void modulusCrash(); void malformedExpression(); void scriptScopes(); @@ -4137,6 +4138,15 @@ void tst_QJSEngine::basicBlockMergeAfterLoopPeeling() } +void tst_QJSEngine::modulusCrash() +{ + QJSEngine engine; + QJSValue result = engine.evaluate( + "var a = -2147483648; var b = -1; var c = a % b; c;" + ); + QVERIFY(result.isNumber() && result.toNumber() == 0.); +} + void tst_QJSEngine::malformedExpression() { QJSEngine engine; |