1 files changed, 30 insertions, 3 deletions

diff --git a/src/qml/jsruntime/qv4internalclass.cpp b/src/qml/jsruntime/qv4internalclass.cpp
index bac71b4537..7e3fd7dc12 100644
--- a/src/qml/jsruntime/qv4internalclass.cpp
+++ b/src/qml/jsruntime/qv4internalclass.cpp
@@ -43,6 +43,7 @@
 #include <qv4identifier_p.h>
 #include "qv4object_p.h"
 #include "qv4identifiertable_p.h"
+#include "qv4value_p.h"
 
 QT_BEGIN_NAMESPACE
 
@@ -128,22 +129,48 @@ InternalClass::InternalClass(const QV4::InternalClass &other)
 
 static void insertHoleIntoPropertyData(Object *object, int idx)
 {
+    int inlineSize = object->d()->vt->nInlineProperties;
     int icSize = object->internalClass()->size;
-    int from = idx;
+    int from = qMax(idx, inlineSize);
     int to = from + 1;
-    if (from < icSize)
+    if (from < icSize) {
         memmove(object->propertyData(to), object->propertyData(from),
                 (icSize - from - 1) * sizeof(Value));
+    }
+    if (from == idx)
+        return;
+    if (inlineSize < icSize)
+        *object->propertyData(inlineSize) = *object->propertyData(inlineSize - 1);
+    from = idx;
+    to = from + 1;
+    if (from < inlineSize - 1) {
+        memmove(object->propertyData(to), object->propertyData(from),
+                (inlineSize - from - 1) * sizeof(Value));
+    }
 }
 
 static void removeFromPropertyData(Object *object, int idx, bool accessor = false)
 {
+    int inlineSize = object->d()->vt->nInlineProperties;
     int delta = (accessor ? 2 : 1);
     int oldSize = object->internalClass()->size + delta;
     int to = idx;
     int from = to + delta;
-    if (from < oldSize)
+    if (from < inlineSize) {
+        memmove(object->propertyData(to), object->d()->propertyData(from), (inlineSize - from)*sizeof(Value));
+        to = inlineSize - delta;
+        from = inlineSize;
+    }
+    if (to < inlineSize && from < oldSize) {
+        Q_ASSERT(from >= inlineSize);
+        memcpy(object->propertyData(to), object->d()->propertyData(from), (inlineSize - to)*sizeof(Value));
+        to = inlineSize;
+        from = inlineSize + delta;
+    }
+    if (from < oldSize) {
+        Q_ASSERT(to >= inlineSize && from > to);
         memmove(object->propertyData(to), object->d()->propertyData(from), (oldSize - to)*sizeof(Value));
+    }
 }
 
 void InternalClass::changeMember(Object *object, String *string, PropertyAttributes data, uint *index)