1 files changed, 34 insertions, 2 deletions
diff --git a/src/qml/jsruntime/qv4internalclass.cpp b/src/qml/jsruntime/qv4internalclass.cpp
index bb2670036d..87987f7d50 100644
--- a/src/qml/jsruntime/qv4internalclass.cpp
+++ b/src/qml/jsruntime/qv4internalclass.cpp
@@ -136,12 +136,44 @@ InternalClass::InternalClass(const QV4::InternalClass &other)
 
 static void insertHoleIntoPropertyData(Object *object, int idx)
 {
-    memmove(object->d()->memberData->data + idx + 1, object->d()->memberData->data + idx, (object->internalClass()->size - idx - 1)*sizeof(Value));
+    int inlineSize = object->d()->inlineMemberSize;
+    int icSize = object->internalClass()->size;
+    int from = qMax(idx, inlineSize);
+    int to = from + 1;
+    if (from < icSize)
+        memmove(object->propertyData(to), object->propertyData(from), icSize - from - 1);
+    if (from == idx)
+        return;
+    if (inlineSize < icSize)
+        *object->propertyData(inlineSize) = *object->propertyData(inlineSize - 1);
+    from = idx;
+    to = from + 1;
+    if (from < inlineSize - 1)
+        memmove(object->propertyData(to), object->propertyData(from), inlineSize - from - 1);
 }
 
 static void removeFromPropertyData(Object *object, int idx, bool accessor = false)
 {
-    memmove(object->d()->memberData->data + idx, object->d()->memberData->data + idx + (accessor ? 2 : 1), (object->internalClass()->size - idx)*sizeof(Value));
+    int inlineSize = object->d()->inlineMemberSize;
+    int icSize = object->internalClass()->size;
+    int delta = (accessor ? 2 : 1);
+    int to = idx;
+    int from = to + delta;
+    if (from < inlineSize) {
+        memmove(object->propertyData(to), object->d()->propertyData(from), (inlineSize - from)*sizeof(Value));
+        to = inlineSize - delta;
+        from = inlineSize;
+    }
+    if (to < inlineSize && from < icSize) {
+        Q_ASSERT(from >= inlineSize);
+        memcpy(object->propertyData(to), object->d()->propertyData(from), (inlineSize - to)*sizeof(Value));
+        to = inlineSize;
+        from = inlineSize + delta;
+    }
+    if (from < icSize + delta) {
+        Q_ASSERT(to >= inlineSize && from > to);
+        memmove(object->propertyData(to), object->d()->propertyData(from), (icSize + delta - to)*sizeof(Value));
+    }
 }
 
 void InternalClass::changeMember(Object *object, String *string, PropertyAttributes data, uint *index)